Vir Fcb- nelze spustit Avast

Zpráva

Fanouš · #1 Příspěvek od **Fanouš** » 30 říj 2011 16:25

Zdravím. Posílám log z MBAM a RSIT. Kamarád měl - má -vir z Fcb

RogueKiller V6.1.5 [10/29/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Chcípáček [Admin rights]
Mode: Remove -- Date : 10/30/2011 16:03:45

Bad processes: 0

Registry Entries: 7
[BLACKLIST] HKLM\[...]\services : wxpdrivers (wxpdrivers.sys) -> DELETED
[DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9} : NameServer (10.255.255.10,10.255.255.20) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9} : NameServer (10.255.255.10,10.255.255.20) -> NOT REMOVED, USE DNSFIX
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED ()
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED ()

Particular Files / Folders:

Driver: [LOADED]

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]

Finished : << RKreport[1].txt >>
RKreport[1].txt

Logfile of random's system information tool 1.09 (written by random/random)
Run by Chcípáček at 2011-10-30 16:04:06
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 36 GB (47%) free of 76 GB
Total RAM: 1536 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:04:18, on 30.10.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Chcípáček\Downloads\RSIT.exe
C:\Program Files\trend micro\Chcípáček.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/#utm_source=icq&u ... um=centrum
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: OLE (Part 1 of 5) - - (no file)
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = ,
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 6507 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, toolbar@ask.com:3.11.3.15590, {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9, {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319, avg@igeared:6.103.018.001, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://search.ChatVibes.com/?q="

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
AskHPRFF.js
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
acpro.xml
avg_igeared.xml
crawlersrch.bak
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\extensions\
support@predictad.com
{800b5000-a755-47e1-992b-48a1c1357f07}
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\searchplugins\
askcom.xml
icqplugin-1.xml
icqplugin-10.xml
icqplugin-11.xml
icqplugin-12.xml
icqplugin-13.xml
icqplugin-14.xml
icqplugin-15.xml
icqplugin-16.xml
icqplugin-17.xml
icqplugin-18.xml
icqplugin-19.xml
icqplugin-2.xml
icqplugin-20.xml
icqplugin-21.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.gif
icqplugin.src
icqplugin.xml
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-08-16 3942048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2011-08-31 449608]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2453689.exe]
C:\Windows\Temp\2453689.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2702088.exe]
C:\Users\Chcípáček\AppData\Local\Temp\2702088.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2919411.exe]
C:\Users\Chcípáček\AppData\Local\Temp\2919411.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6933186.exe]
C:\Users\Chcípáček\AppData\Local\Temp\6933186.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6969057.exe]
C:\Windows\Temp\6969057.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\_AnyDVDtray.exe [2009-03-12 2587584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
C:\Users\Chcípáček\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tray_ico0]
C:\Windows\update.tray-7-0\svchost.exe [2011-10-28 1198080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wxpdrv]
C:\Windows\services32.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-10-30 16:04:07 ----D---- C:\Program Files\trend micro
2011-10-30 16:04:06 ----D---- C:\rsit
2011-10-30 16:03:20 ----A---- C:\Windows\system32\drivers\TrueSight.sys
2011-10-30 15:51:25 ----D---- C:\ProgramData\AVAST Software
2011-10-30 15:51:25 ----D---- C:\Program Files\AVAST Software
2011-10-30 15:37:10 ----D---- C:\Users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 15:37:01 ----D---- C:\ProgramData\Malwarebytes
2011-10-30 15:36:56 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-10-30 15:36:56 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-10-30 15:35:25 ----D---- C:\Program Files\CCleaner
2011-10-28 23:08:01 ----A---- C:\Windows\system32\drivers\aswFW.sys
2011-10-28 23:05:56 ----A---- C:\Windows\system32\drivers\aswNdis2.sys
2011-10-28 22:34:33 ----D---- C:\Windows\ufa
2011-10-28 22:34:33 ----D---- C:\Windows\phoenix
2011-10-28 22:24:11 ----A---- C:\Windows\btc_client_iplist.txt
2011-10-28 22:23:04 ----HD---- C:\Windows\update.5.0
2011-10-28 22:03:51 ----D---- C:\Windows\av_ico
2011-10-28 22:02:10 ----HD---- C:\Windows\update.tray-7-0-lnk
2011-10-28 22:02:10 ----HD---- C:\Windows\update.tray-7-0
2011-10-28 21:56:54 ----A---- C:\Windows\winlog-ids.txt
2011-10-28 21:56:54 ----A---- C:\Windows\winlog-dirs.txt
2011-10-28 21:52:51 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-10-28 21:52:50 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-10-28 21:52:39 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-10-28 21:52:37 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-10-28 21:52:36 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-10-28 21:52:32 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-10-28 21:50:28 ----A---- C:\Windows\system32\aswBoot.exe
2011-10-28 21:50:28 ----A---- C:\Windows\avastSS.scr
2011-10-28 14:42:00 ----N---- C:\bootsqm.dat
2011-10-28 11:01:10 ----A---- C:\Windows\unrar.exe
2011-10-28 11:00:06 ----A---- C:\Windows\iecheck_iplist.txt
2011-10-28 10:59:38 ----HD---- C:\Windows\update.2
2011-10-28 10:59:29 ----A---- C:\Windows\iplist.txt
2011-10-28 10:58:40 ----A---- C:\Windows\front_ip_list.txt
2011-10-28 10:58:26 ----HD---- C:\Windows\update.1
2011-10-13 02:03:03 ----A---- C:\Windows\system32\mshtmled.dll
2011-10-13 02:03:02 ----A---- C:\Windows\system32\iertutil.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jsproxy.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jscript9.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jscript.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\ieui.dll
2011-10-13 02:03:00 ----A---- C:\Windows\system32\wininet.dll
2011-10-13 02:03:00 ----A---- C:\Windows\system32\urlmon.dll
2011-10-13 02:02:59 ----A---- C:\Windows\system32\url.dll
2011-10-13 02:02:59 ----A---- C:\Windows\system32\ieframe.dll
2011-10-13 02:02:57 ----A---- C:\Windows\system32\mshtml.dll
2011-10-12 18:40:45 ----A---- C:\Windows\system32\psisdecd.dll
2011-10-12 18:40:44 ----A---- C:\Windows\system32\oleacc.dll
2011-10-12 18:40:43 ----A---- C:\Windows\system32\oleaut32.dll
2011-10-12 18:40:39 ----A---- C:\Windows\system32\win32k.sys

======List of files/folders modified in the last 1 month======

2011-10-30 16:04:09 ----D---- C:\Windows\Temp
2011-10-30 16:04:07 ----RD---- C:\Program Files
2011-10-30 16:03:20 ----D---- C:\Windows\system32\drivers
2011-10-30 16:00:08 ----AD---- C:\Windows
2011-10-30 15:51:49 ----SHD---- C:\Windows\Installer
2011-10-30 15:51:49 ----SHD---- C:\Config.Msi
2011-10-30 15:51:34 ----D---- C:\Windows\System32
2011-10-30 15:51:25 ----HD---- C:\ProgramData
2011-10-30 15:51:20 ----SHD---- C:\System Volume Information
2011-10-30 15:50:26 ----D---- C:\Windows\nview
2011-10-30 15:47:48 ----D---- C:\Windows\system32\DriverStore
2011-10-30 15:47:48 ----D---- C:\Windows\system32\catroot
2011-10-30 15:47:48 ----D---- C:\Windows\inf
2011-10-30 15:36:03 ----D---- C:\Windows\Panther
2011-10-30 15:36:01 ----D---- C:\Windows\SoftwareDistribution
2011-10-30 10:23:59 ----A---- C:\Windows\NeroDigital.ini
2011-10-30 09:27:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-10-30 09:19:06 ----D---- C:\Windows\system32\config
2011-10-30 08:29:07 ----D---- C:\Windows\system32\Tasks
2011-10-30 08:29:06 ----D---- C:\Windows\Tasks
2011-10-29 22:12:02 ----D---- C:\Windows\system32\catroot2
2011-10-29 21:24:08 ----D---- C:\Windows\tracing
2011-10-28 23:55:12 ----D---- C:\Users\Chcípáček\AppData\Roaming\ICQ
2011-10-28 23:30:59 ----D---- C:\Windows\system32\NDF
2011-10-28 10:59:57 ----D---- C:\Windows\system32\drivers\etc
2011-10-28 10:58:55 ----D---- C:\Windows\Prefetch
2011-10-19 21:25:33 ----D---- C:\Windows\debug
2011-10-13 02:32:54 ----D---- C:\Windows\Microsoft.NET
2011-10-13 02:32:42 ----RSD---- C:\Windows\assembly
2011-10-13 02:22:09 ----D---- C:\Windows\winsxs
2011-10-13 02:21:10 ----D---- C:\Program Files\Microsoft Silverlight
2011-10-13 02:19:49 ----D---- C:\Windows\system32\migration
2011-10-13 02:19:49 ----D---- C:\Windows\ehome
2011-10-13 02:19:49 ----D---- C:\Program Files\Internet Explorer
2011-10-13 02:01:10 ----A---- C:\Windows\system32\MRT.exe
2011-10-10 12:09:32 ----A---- C:\Windows\system32\PnkBstrB.exe
2011-10-07 14:31:04 ----D---- C:\Program Files\Mozilla Firefox
2011-10-01 13:41:37 ----SD---- C:\Users\Chcípáček\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-13 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R2 NVR0FLASHDev;NVR0FLASHDev; \??\C:\Windows\nvflash.sys [2009-01-07 36896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 dvdfab;dvdfab; C:\Windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-08-31 22216]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys [2009-01-06 36640]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-03-13 47360]
R3 TrueSight;TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
S2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2005-08-11 163584]
S2 CXTUNE;Conexant 2388x Tuner; C:\Windows\system32\drivers\CX88TUNE_IBV32.sys [2006-11-02 17664]
S3 a1t5xs9e;a1t5xs9e; C:\Windows\system32\drivers\a1t5xs9e.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 awb2f1ef;awb2f1ef; C:\Windows\system32\drivers\awb2f1ef.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 cpuz126;cpuz126; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\cpuz.sys []
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
S3 GVCplDrv;GVCplDrv; C:\Windows\system32\drivers\GVCplDrv.sys [2004-05-02 23040]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102912]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys []
S3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2005-12-10 3536768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SNP325;USB PC Camera (SNPSTD325); C:\Windows\system32\DRIVERS\snp325.sys []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 27648]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3); C:\Windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R2 nTuneService;Performance Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2009-01-06 174624]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 UpdateCenterService;Update Center Service; C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-01-07 121376]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
S4 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 AdvancedSystemCareService;Advanced SystemCare Service; C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-05-31 66872]
S4 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S4 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]

-----------------EOF-----------------

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 8046

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

30.10.2011 15:50:01
mbam-log-2011-10-30 (15-50-01).txt

Typ: Rychlá kontrola
Kontrolované objekty: 219169
Uplynulý čas: 11 minut, 54 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 8
Infikované hodnoty v registru: 2
Infikované datové položky v registru: 4
Infikované složky: 1
Infikované soubory: 15

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SAFEBOOT\AlternateShell (Hijack.Altshell) -> Bad: (services32.exe) Good: (cmd.exe) -> Quarantined and deleted successfully.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> Quarantined and deleted successfully.

Infikované soubory:
c:\Windows\update.1\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.

Fanouš · #2 Příspěvek od **Fanouš** » 30 říj 2011 17:16

ComboFix 11-10-30.02 - Chcípáček 30.10.2011 16:33:10.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.1536.722 [GMT 1:00]
Spuštěný z: c:\users\ChcÝpßŔek\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 24 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\64\AutocompletePro64.dll
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx
c:\program files\AutocompletePro\ChromeSetSearchInBrowser.exe
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-28 do 2011-10-30 )))))))))))))))))))))))))))))))
.
.
2011-10-30 15:42 . 2011-10-30 15:42 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-30 15:42 . 2011-10-30 15:42 -------- d-----w- c:\users\Chcípáček\AppData\Local\temp
2011-10-30 15:42 . 2011-10-30 15:42 -------- d-----w- c:\users\honza\AppData\Local\temp
2011-10-30 15:42 . 2011-10-30 15:42 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-10-30 15:42 . 2011-10-30 15:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-30 15:07 . 2011-10-30 15:07 -------- d-----w- c:\programdata\Kaspersky Lab
2011-10-30 15:04 . 2011-10-30 15:04 -------- d-----w- c:\program files\trend micro
2011-10-30 15:04 . 2011-10-30 15:04 -------- d-----w- C:\rsit
2011-10-30 15:03 . 2011-10-30 15:03 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-10-30 15:02 . 2011-10-30 15:02 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{65594C30-82C0-4773-BB6F-1A0E44560A2E}\offreg.dll
2011-10-30 14:51 . 2011-10-30 14:51 -------- d-----w- c:\programdata\AVAST Software
2011-10-30 14:51 . 2011-10-30 14:51 -------- d-----w- c:\program files\AVAST Software
2011-10-30 14:37 . 2011-10-30 14:37 -------- d-----w- c:\users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 14:37 . 2011-10-30 14:37 -------- d-----w- c:\programdata\Malwarebytes
2011-10-30 14:36 . 2011-10-30 14:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-30 14:36 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-30 14:35 . 2011-10-30 14:35 -------- d-----w- c:\program files\CCleaner
2011-10-30 09:14 . 2011-10-30 09:14 -------- d-----w- c:\users\Chcípáček\AppData\Local\Nero
2011-10-28 22:08 . 2011-09-06 20:38 111320 ----a-w- c:\windows\system32\drivers\aswFW.sys
2011-10-28 22:05 . 2011-09-06 20:37 195416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2011-10-28 09:45 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{65594C30-82C0-4773-BB6F-1A0E44560A2E}\mpengine.dll
2011-10-19 20:09 . 2011-10-29 20:14 -------- d-----w- c:\users\Chcípáček\AppData\Local\Facebook
2011-10-13 01:03 . 2011-09-01 02:22 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-10-13 01:03 . 2011-09-01 02:41 141088 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-10-13 01:03 . 2011-09-01 02:26 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2011-10-13 01:03 . 2011-09-01 02:35 1798144 ----a-w- c:\windows\system32\jscript9.dll
2011-10-13 01:03 . 2011-09-01 02:30 678912 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2011-10-13 01:03 . 2011-09-01 02:28 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-10-12 17:40 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-12 17:40 . 2011-08-17 04:19 75776 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-12 17:40 . 2011-08-27 04:26 233472 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 17:40 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-12 17:40 . 2011-09-06 02:28 2334720 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 11:09 . 2011-05-31 08:48 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-10-10 11:09 . 2011-05-31 08:48 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-04 07:20 . 2011-08-04 07:20 33656 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2011-08-03 11:50 . 2011-08-30 18:47 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:50 . 2011-08-30 18:47 16595560 ----a-w- c:\windows\system32\nvoglv32.dll
2011-08-03 11:50 . 2011-08-30 18:47 10304104 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-08-03 11:50 . 2011-08-30 18:47 914024 ----a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:50 . 2011-08-30 18:47 875112 ----a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:50 . 2011-08-30 18:47 5404776 ----a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:50 . 2011-08-30 18:47 2391656 ----a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:50 . 2011-08-30 18:47 2090088 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:50 . 2011-08-30 18:47 17193576 ----a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:50 . 2011-04-23 15:40 12636776 ----a-w- c:\windows\system32\nvd3dum.dll
2011-08-03 11:50 . 2011-04-23 15:40 2412136 ----a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:50 . 2011-04-07 20:43 600680 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-03 11:50 . 2011-04-07 20:43 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-08-03 11:50 . 2011-04-07 20:43 599144 ----a-w- c:\windows\system32\nvvsvc.exe
2011-08-03 11:50 . 2011-04-07 20:43 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-08-03 11:50 . 2011-04-07 20:43 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:50 . 2011-04-07 20:43 3730024 ----a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:50 . 2011-04-07 20:43 2558568 ----a-w- c:\windows\system32\nvsvc.dll
2011-10-07 13:30 . 2011-08-20 09:59 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files\Hot_MP3\tbHot_.dll" [2010-02-22 2353176]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
2010-02-22 10:05 2353176 ----a-w- c:\program files\Hot_MP3\tbHot_.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files\Hot_MP3\tbHot_.dll" [2010-02-22 2353176]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-11-15 09:42 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2009-03-12 15:15 2587584 ----a-w- c:\program files\SlySoft\AnyDVD\_AnyDVDtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tray_ico0]
2011-10-28 09:57 1198080 ---h--w- c:\windows\update.tray-7-0\svchost.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2009-03-11 17:22 2912256 ----a-w- c:\program files\WinFast\WFDTV\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
2009-10-02 14:17 90112 ----a-w- c:\program files\WinFast\WFDTV\DTVSchdl.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Advanced SystemCare 4"=c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R3 cpuz126;cpuz126;c:\users\CHCPEK~1\AppData\Local\Temp\cpuz.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
R3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3);c:\windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-13 691696]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-03-13 47360]
S3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 02820082
*NewlyCreated* - 9234047DRV
*NewlyCreated* - TRUESIGHT
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/#utm_source=icq&utm_medium=centrum
uDefault_Search_URL = hxxp://search.autocompletepro.com/?si=10206&bi=400
mStart Page = hxxp://search.ChatVibes.com
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: Interfaces\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
FF - ProfilePath - c:\users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.ChatVibes.com/?q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-2453689 - c:\windows\Temp\2453689.exe
MSConfigStartUp-2702088 - c:\users\Chcípáček\AppData\Local\Temp\2702088.exe
MSConfigStartUp-2919411 - c:\users\Chcípáček\AppData\Local\Temp\2919411.exe
MSConfigStartUp-6933186 - c:\users\Chcípáček\AppData\Local\Temp\6933186.exe
MSConfigStartUp-6969057 - c:\windows\Temp\6969057.exe
MSConfigStartUp-Facebook Update - c:\users\Chcípáček\AppData\Local\Facebook\Update\FacebookUpdate.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-wxpdrv - c:\windows\services32.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-10-30 16:48:44
ComboFix-quarantined-files.txt 2011-10-30 15:48
.
Před spuštěním: Volných bajtů: 37 372 067 840
Po spuštění: Volných bajtů: 37 898 854 400
.
- - End Of File - - AEB9A061E564103D1882CB3849A544E5

Fanouš · #3 Příspěvek od **Fanouš** » 30 říj 2011 17:58

Tak jen info na závěr. U PC už nejsem, ale chová se normálně, stabilně. Avast nešel - ono tam totiž původně nebylo nic - žádný antivir - ale Avast na Win 7 Ultimate nešel. Původně jsem totiž myslel, že tam byl. Včera tam zkusmo "někdo" stáhnul Eset , tak jsem to dnes dal pryč a dal jsem mu tam Aviru.Uvidíme, co bude dál. Jen je těžké něco vysvětlovat - jak se má člověk chovat na netu.
Pokud by tam bylo něco na dočištění, musel bych to udělat s ním " na dálku " po tel.
Fanouš

#4 Příspěvek od **cernohous13** » 31 říj 2011 07:44

Zdravím,

trochu bych to s ním zkusil dočistit a uklidit.
Snad zvládne založit si tu účet a přihlásit se do tvého topicu aby mi mohl dát nový log RSIT

C:\Users\Chcípáček\Downloads\RSIT.exe
zkopírovat do své odpovědi.

Návody máme psány i pro nezkušené usery - budeš to mít pod kontrolou

Fanouš · #5 Příspěvek od **Fanouš** » 31 říj 2011 14:10

Zdravím,
pokusím se info předat, snad to dospěje ke zdárnému konci

Zatím ahoj

#6 Příspěvek od **cernohous13** » 31 říj 2011 15:18

Jsme zvyklí i na blondýny

Fanouš · #7 Příspěvek od **Fanouš** » 06 lis 2011 17:16

Logfile of random's system information tool 1.09 (written by random/random)
Run by Chcípáček at 2011-11-06 17:11:00
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 31 GB (41%) free of 76 GB
Total RAM: 1536 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:11:51, on 6.11.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskeng.exe
C:\Users\Chcípáček\Downloads\RSIT.exe
C:\Program Files\trend micro\Chcípáček.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: OLE (Part 1 of 5) - - (no file)
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Google Update] "C:\Users\Chcípáček\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = ,
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 5321 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2478180410-4009266172-1965090003-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2478180410-4009266172-1965090003-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, toolbar@ask.com:3.11.3.15590, {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9, {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319, avg@igeared:6.103.018.001, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://search.ChatVibes.com/?q="

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
AskHPRFF.js
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
acpro.xml
avg_igeared.xml
crawlersrch.bak
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\extensions\
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\searchplugins\
askcom.xml
icqplugin-1.xml
icqplugin-10.xml
icqplugin-11.xml
icqplugin-12.xml
icqplugin-13.xml
icqplugin-14.xml
icqplugin-15.xml
icqplugin-16.xml
icqplugin-17.xml
icqplugin-18.xml
icqplugin-19.xml
icqplugin-2.xml
icqplugin-20.xml
icqplugin-21.xml
icqplugin-22.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.xml
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-08-16 3942048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-10-19 258512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Chcípáček\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-30 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\_AnyDVDtray.exe [2009-03-12 2587584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tray_ico0]
C:\Windows\update.tray-7-0\svchost.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-04-20 203776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-11-05 14:02:58 ----D---- C:\Program Files\Rockstar Games
2011-10-30 17:28:40 ----D---- C:\Users\Chcípáček\AppData\Roaming\Avira
2011-10-30 17:22:06 ----A---- C:\Windows\system32\drivers\ssmdrv.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avipbb.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2011-10-30 17:22:02 ----D---- C:\ProgramData\Avira
2011-10-30 17:22:02 ----D---- C:\Program Files\Avira
2011-10-30 16:48:50 ----SHD---- C:\$RECYCLE.BIN
2011-10-30 16:48:47 ----D---- C:\Windows\temp
2011-10-30 16:48:44 ----A---- C:\ComboFix.txt
2011-10-30 16:30:27 ----A---- C:\Windows\zip.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWSC.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWREG.exe
2011-10-30 16:30:27 ----A---- C:\Windows\sed.exe
2011-10-30 16:30:27 ----A---- C:\Windows\PEV.exe
2011-10-30 16:30:27 ----A---- C:\Windows\NIRCMD.exe
2011-10-30 16:30:27 ----A---- C:\Windows\MBR.exe
2011-10-30 16:30:27 ----A---- C:\Windows\grep.exe
2011-10-30 16:30:13 ----D---- C:\Windows\ERDNT
2011-10-30 16:30:05 ----D---- C:\Qoobox
2011-10-30 16:07:16 ----D---- C:\ProgramData\Kaspersky Lab
2011-10-30 16:04:07 ----D---- C:\Program Files\trend micro
2011-10-30 16:04:06 ----D---- C:\rsit
2011-10-30 16:03:20 ----A---- C:\Windows\system32\drivers\TrueSight.sys
2011-10-30 15:51:25 ----D---- C:\ProgramData\AVAST Software
2011-10-30 15:51:25 ----D---- C:\Program Files\AVAST Software
2011-10-30 15:37:10 ----D---- C:\Users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 15:37:01 ----D---- C:\ProgramData\Malwarebytes
2011-10-30 15:35:25 ----D---- C:\Program Files\CCleaner
2011-10-28 23:08:01 ----A---- C:\Windows\system32\drivers\aswFW.sys
2011-10-28 23:05:56 ----A---- C:\Windows\system32\drivers\aswNdis2.sys
2011-10-28 22:34:33 ----D---- C:\Windows\ufa
2011-10-28 22:24:11 ----A---- C:\Windows\btc_client_iplist.txt
2011-10-28 22:03:51 ----D---- C:\Windows\av_ico
2011-10-28 22:02:10 ----HD---- C:\Windows\update.tray-7-0-lnk
2011-10-28 22:02:10 ----HD---- C:\Windows\update.tray-7-0
2011-10-28 21:56:54 ----A---- C:\Windows\winlog-ids.txt
2011-10-28 21:56:54 ----A---- C:\Windows\winlog-dirs.txt
2011-10-28 11:01:10 ----A---- C:\Windows\unrar.exe
2011-10-28 11:00:06 ----A---- C:\Windows\iecheck_iplist.txt
2011-10-28 10:59:29 ----A---- C:\Windows\iplist.txt
2011-10-28 10:58:40 ----A---- C:\Windows\front_ip_list.txt
2011-10-13 02:03:03 ----A---- C:\Windows\system32\mshtmled.dll
2011-10-13 02:03:02 ----A---- C:\Windows\system32\iertutil.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jsproxy.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jscript9.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\jscript.dll
2011-10-13 02:03:01 ----A---- C:\Windows\system32\ieui.dll
2011-10-13 02:03:00 ----A---- C:\Windows\system32\wininet.dll
2011-10-13 02:03:00 ----A---- C:\Windows\system32\urlmon.dll
2011-10-13 02:02:59 ----A---- C:\Windows\system32\url.dll
2011-10-13 02:02:59 ----A---- C:\Windows\system32\ieframe.dll
2011-10-13 02:02:57 ----A---- C:\Windows\system32\mshtml.dll
2011-10-12 18:40:45 ----A---- C:\Windows\system32\psisdecd.dll
2011-10-12 18:40:44 ----A---- C:\Windows\system32\oleacc.dll
2011-10-12 18:40:43 ----A---- C:\Windows\system32\oleaut32.dll
2011-10-12 18:40:39 ----A---- C:\Windows\system32\win32k.sys

======List of files/folders modified in the last 1 month======

2011-11-06 17:11:14 ----D---- C:\Windows\Prefetch
2011-11-06 13:03:02 ----D---- C:\Windows\system32\config
2011-11-06 12:56:56 ----D---- C:\Windows\System32
2011-11-06 12:56:56 ----D---- C:\Windows\inf
2011-11-06 12:56:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-05 14:03:17 ----SHD---- C:\System Volume Information
2011-11-05 14:02:58 ----RD---- C:\Program Files
2011-11-05 14:02:58 ----HD---- C:\Program Files\InstallShield Installation Information
2011-11-05 12:48:26 ----AD---- C:\Windows
2011-11-03 17:02:17 ----D---- C:\Windows\tracing
2011-10-30 17:31:32 ----D---- C:\Windows\system32\drivers
2011-10-30 17:22:22 ----D---- C:\Windows\system32\catroot
2011-10-30 17:22:02 ----D---- C:\ProgramData
2011-10-30 17:21:34 ----SHD---- C:\Windows\Installer
2011-10-30 17:21:34 ----D---- C:\Config.Msi
2011-10-30 17:15:33 ----D---- C:\Program Files\Mozilla Firefox
2011-10-30 17:14:36 ----D---- C:\Windows\Tasks
2011-10-30 17:14:36 ----D---- C:\Windows\system32\Tasks
2011-10-30 16:54:53 ----D---- C:\Windows\SoftwareDistribution
2011-10-30 16:54:19 ----D---- C:\Windows\system32\NDF
2011-10-30 16:43:15 ----A---- C:\Windows\system.ini
2011-10-30 16:43:07 ----D---- C:\Windows\system32\drivers\etc
2011-10-30 16:38:36 ----D---- C:\Windows\AppPatch
2011-10-30 16:38:34 ----D---- C:\Program Files\Common Files
2011-10-30 15:59:50 ----D---- C:\Windows\nview
2011-10-30 15:47:48 ----D---- C:\Windows\system32\DriverStore
2011-10-30 15:36:03 ----D---- C:\Windows\Panther
2011-10-30 10:23:59 ----A---- C:\Windows\NeroDigital.ini
2011-10-29 22:12:02 ----D---- C:\Windows\system32\catroot2
2011-10-28 23:55:12 ----D---- C:\Users\Chcípáček\AppData\Roaming\ICQ
2011-10-19 21:25:33 ----D---- C:\Windows\debug
2011-10-13 02:32:54 ----D---- C:\Windows\Microsoft.NET
2011-10-13 02:32:42 ----RSD---- C:\Windows\assembly
2011-10-13 02:22:09 ----D---- C:\Windows\winsxs
2011-10-13 02:21:10 ----D---- C:\Program Files\Microsoft Silverlight
2011-10-13 02:19:49 ----D---- C:\Windows\system32\migration
2011-10-13 02:19:49 ----D---- C:\Windows\ehome
2011-10-13 02:19:49 ----D---- C:\Program Files\Internet Explorer
2011-10-13 02:01:10 ----A---- C:\Windows\system32\MRT.exe
2011-10-10 12:09:32 ----A---- C:\Windows\system32\PnkBstrB.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-13 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2011-10-19 134344]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2011-10-19 36000]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2011-10-19 74640]
R2 NVR0FLASHDev;NVR0FLASHDev; \??\C:\Windows\nvflash.sys [2009-01-07 36896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 dvdfab;dvdfab; C:\Windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys [2009-01-06 36640]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-03-13 47360]
S2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2005-08-11 163584]
S2 CXTUNE;Conexant 2388x Tuner; C:\Windows\system32\drivers\CX88TUNE_IBV32.sys [2006-11-02 17664]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 as9hz1m8;as9hz1m8; C:\Windows\system32\drivers\as9hz1m8.sys []
S3 atk31i3f;atk31i3f; C:\Windows\system32\drivers\atk31i3f.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 catchme;catchme; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\catchme.sys []
S3 cpuz126;cpuz126; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\cpuz.sys []
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
S3 GVCplDrv;GVCplDrv; C:\Windows\system32\drivers\GVCplDrv.sys [2004-05-02 23040]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102912]
S3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2005-12-10 3536768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SNP325;USB PC Camera (SNPSTD325); C:\Windows\system32\DRIVERS\snp325.sys []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TrueSight;TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 27648]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3); C:\Windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira Realtime Protection; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-10-19 110032]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]
R2 nTuneService;Performance Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2009-01-06 174624]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 UpdateCenterService;Update Center Service; C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-01-07 121376]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
S4 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 AdvancedSystemCareService;Advanced SystemCare Service; C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-05-31 66872]
S4 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S4 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]

-----------------EOF-----------------

#8 Příspěvek od **cernohous13** » 06 lis 2011 20:25

Spusť program C:\Program Files\trend micro\Chcípáček.exe
klik "Do a system scan only"
dej fajfku do čtverečků před řádky:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10206&bi=400
R3 - URLSearchHook: OLE (Part 1 of 5) - - (no file)
O4 - HKCU\..\Run: [Google Update] "C:\Users\Chcípáček\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
"Fix checked" -> OK

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“ (pro Vistu a Win7 – pravým a „Run As Administrator“).
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „Moveit!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\

Script OTM

Kód: Vybrat vše

:Commands
[purity]
[resethosts]
[emptytemp]
[emptyflash]
[clearallrestorepoints]

:Files
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2478180410-4009266172-1965090003-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2478180410-4009266172-1965090003-1000UA.job
C:\ProgramData\AVAST Software
C:\Program Files\AVAST Software
C:\Windows\system32\drivers\aswFW.sys
C:\Windows\system32\drivers\aswNdis2.sys
C:\Windows\system32\drivers\aswFW.sys
C:\Windows\system32\drivers\aswNdis2.sys
C:\Windows\ufa
C:\Windows\btc_client_iplist.txt
C:\Windows\av_ico
C:\Windows\update.tray-7-0-lnk
C:\Windows\update.tray-7-0
C:\Windows\winlog-ids.txt
C:\Windows\winlog-dirs.txt
C:\Windows\unrar.exe
C:\Windows\iecheck_iplist.txt
C:\Windows\iplist.txt
C:\Windows\front_ip_list.txt
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s
C:\Program Files\IObit

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tray_ico0]

:Services
AdvancedSystemCareService

Fanouš · #9 Příspěvek od **Fanouš** » 13 lis 2011 17:23

Logfile of random's system information tool 1.09 (written by random/random)
Run by Chcípáček at 2011-11-13 17:17:48
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 22 GB (29%) free of 76 GB
Total RAM: 1536 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:18:34, on 13.11.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Chcípáček\Downloads\RSIT.exe
C:\Program Files\trend micro\Chcípáček.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.321Search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: fliptoast.lnk = C:\Program Files\fliptoast\fliptoast.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = ,
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 4880 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.321search.com/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, toolbar@ask.com:3.11.3.15590, {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9, {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319, avg@igeared:6.103.018.001, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://search.ChatVibes.com/?q="

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
AskHPRFF.js
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
acpro.xml
avg_igeared.xml
crawlersrch.bak
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\extensions\
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\searchplugins\
askcom.xml
icqplugin-1.xml
icqplugin-10.xml
icqplugin-11.xml
icqplugin-12.xml
icqplugin-13.xml
icqplugin-14.xml
icqplugin-15.xml
icqplugin-16.xml
icqplugin-17.xml
icqplugin-18.xml
icqplugin-19.xml
icqplugin-2.xml
icqplugin-20.xml
icqplugin-21.xml
icqplugin-22.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.xml
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-08-16 3942048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-10-19 258512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\_AnyDVDtray.exe [2009-03-12 2587584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]

C:\Users\Chcípáček\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
fliptoast.lnk - C:\Program Files\fliptoast\fliptoast.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-04-20 203776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-11-13 17:10:29 ----D---- C:\_OTM
2011-11-13 17:02:31 ----D---- C:\Program Files\trend micro
2011-11-12 14:46:37 ----SHD---- C:\Windows\system32\AI_RecycleBin
2011-11-12 14:46:29 ----D---- C:\Users\Chcípáček\AppData\Roaming\com.w3i.FlipToast
2011-11-12 14:46:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-11-12 14:40:06 ----D---- C:\Program Files\Prolific Publishing, Inc
2011-11-07 17:36:31 ----A---- C:\Windows\system32\shell32.dll
2011-11-07 17:36:02 ----A---- C:\Windows\system32\xmllite.dll
2011-11-05 14:02:58 ----D---- C:\Program Files\Rockstar Games
2011-10-30 17:28:40 ----D---- C:\Users\Chcípáček\AppData\Roaming\Avira
2011-10-30 17:22:06 ----A---- C:\Windows\system32\drivers\ssmdrv.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avipbb.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2011-10-30 17:22:02 ----D---- C:\ProgramData\Avira
2011-10-30 17:22:02 ----D---- C:\Program Files\Avira
2011-10-30 16:48:50 ----SHD---- C:\$RECYCLE.BIN
2011-10-30 16:48:47 ----D---- C:\Windows\temp
2011-10-30 16:48:44 ----A---- C:\ComboFix.txt
2011-10-30 16:30:27 ----A---- C:\Windows\zip.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWSC.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWREG.exe
2011-10-30 16:30:27 ----A---- C:\Windows\sed.exe
2011-10-30 16:30:27 ----A---- C:\Windows\PEV.exe
2011-10-30 16:30:27 ----A---- C:\Windows\NIRCMD.exe
2011-10-30 16:30:27 ----A---- C:\Windows\MBR.exe
2011-10-30 16:30:27 ----A---- C:\Windows\grep.exe
2011-10-30 16:30:13 ----D---- C:\Windows\ERDNT
2011-10-30 16:30:05 ----D---- C:\Qoobox
2011-10-30 16:07:16 ----D---- C:\ProgramData\Kaspersky Lab
2011-10-30 16:04:06 ----D---- C:\rsit
2011-10-30 16:03:20 ----A---- C:\Windows\system32\drivers\TrueSight.sys
2011-10-30 15:37:10 ----D---- C:\Users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 15:37:01 ----D---- C:\ProgramData\Malwarebytes
2011-10-30 15:35:25 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2011-11-13 17:18:20 ----D---- C:\Windows\system32\config
2011-11-13 17:17:23 ----D---- C:\Windows\SoftwareDistribution
2011-11-13 17:16:33 ----AD---- C:\Windows
2011-11-13 17:16:04 ----D---- C:\Windows\Prefetch
2011-11-13 17:15:04 ----D---- C:\Windows\inf
2011-11-13 17:10:50 ----RD---- C:\Program Files
2011-11-13 17:10:50 ----D---- C:\Windows\Tasks
2011-11-13 17:10:50 ----D---- C:\Windows\system32\drivers
2011-11-13 17:10:50 ----D---- C:\ProgramData
2011-11-13 11:16:40 ----D---- C:\Windows\System32
2011-11-13 11:16:40 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-12 15:31:48 ----SHD---- C:\Windows\Installer
2011-11-12 15:31:48 ----D---- C:\Config.Msi
2011-11-12 15:31:34 ----SHD---- C:\System Volume Information
2011-11-12 15:27:02 ----D---- C:\Windows\tracing
2011-11-12 14:46:13 ----D---- C:\ProgramData\Adobe
2011-11-12 14:46:02 ----D---- C:\Program Files\Adobe
2011-11-12 14:46:00 ----D---- C:\Program Files\Common Files
2011-11-12 14:45:39 ----D---- C:\Users\Chcípáček\AppData\Roaming\Adobe
2011-11-10 20:21:32 ----D---- C:\Program Files\Mozilla Firefox
2011-11-07 17:57:35 ----D---- C:\Windows\winsxs
2011-11-07 17:36:29 ----D---- C:\Windows\system32\catroot2
2011-11-07 17:36:29 ----D---- C:\Windows\system32\catroot
2011-11-05 14:02:58 ----HD---- C:\Program Files\InstallShield Installation Information
2011-10-30 17:14:36 ----D---- C:\Windows\system32\Tasks
2011-10-30 16:54:19 ----D---- C:\Windows\system32\NDF
2011-10-30 16:43:15 ----A---- C:\Windows\system.ini
2011-10-30 16:43:07 ----D---- C:\Windows\system32\drivers\etc
2011-10-30 16:38:36 ----D---- C:\Windows\AppPatch
2011-10-30 15:59:50 ----D---- C:\Windows\nview
2011-10-30 15:47:48 ----D---- C:\Windows\system32\DriverStore
2011-10-30 15:36:03 ----D---- C:\Windows\Panther
2011-10-30 10:23:59 ----A---- C:\Windows\NeroDigital.ini
2011-10-28 23:55:12 ----D---- C:\Users\Chcípáček\AppData\Roaming\ICQ
2011-10-19 21:25:33 ----D---- C:\Windows\debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-13 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2011-10-19 134344]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2011-10-19 36000]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2011-10-19 74640]
R2 NVR0FLASHDev;NVR0FLASHDev; \??\C:\Windows\nvflash.sys [2009-01-07 36896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 dvdfab;dvdfab; C:\Windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys [2009-01-06 36640]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-03-13 47360]
S2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2005-08-11 163584]
S2 CXTUNE;Conexant 2388x Tuner; C:\Windows\system32\drivers\CX88TUNE_IBV32.sys [2006-11-02 17664]
S3 ac69d2qt;ac69d2qt; C:\Windows\system32\drivers\ac69d2qt.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 aoopmcfj;aoopmcfj; C:\Windows\system32\drivers\aoopmcfj.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 catchme;catchme; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\catchme.sys []
S3 cpuz126;cpuz126; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\cpuz.sys []
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
S3 GVCplDrv;GVCplDrv; C:\Windows\system32\drivers\GVCplDrv.sys [2004-05-02 23040]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102912]
S3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2005-12-10 3536768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SNP325;USB PC Camera (SNPSTD325); C:\Windows\system32\DRIVERS\snp325.sys []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TrueSight;TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 27648]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3); C:\Windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira Realtime Protection; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-10-19 110032]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]
R2 nTuneService;Performance Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2009-01-06 174624]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 UpdateCenterService;Update Center Service; C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-01-07 121376]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
S4 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-05-31 66872]
S4 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S4 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]

-----------------EOF-----------------

Error: Unable to interpret <%windir%\system32\SET*.tmp /s> in the current context!
Error: Unable to interpret <%windir%\*.tmp /s> in the current context!
Error: Unable to interpret <C:\Program Files\IObit> in the current context!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tray_ico0\ deleted successfully.
========== SERVICES/DRIVERS ==========
Service AdvancedSystemCareService stopped successfully!
Service AdvancedSystemCareService deleted successfully!

OTM by OldTimer - Version 3.1.19.0 log created on 11132011_171057
File/Folder C:\Windows\system32\SET*.tmp not found.

OTM by OldTimer - Version 3.1.19.0 log created on 11132011_171049

#10 Příspěvek od **cernohous13** » 13 lis 2011 19:13

zdá se, že máš čisto
a jestli už nenacházíš nic podivného, tak po sobě uklidím

ComboFix odinstalujeme
jdi Start -> Spustit... a zkopíruj ComboFix /Uninstall (pozor, za x je mezera) -> OK

Stáhni a spusť T-cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe - uklidí po použitých čističích.
Po spuštění ignoruj případné varování antiviru - je to v pořádku
Po provedení akce T-cleaner smažeš

Stáhni TempFolderCleaner http://oldtimer.geekstogo.com/TFC.exe
Zavři všechny programy a spusť. Po ukončení akce bude PC restartován.
Pokud ne, restartuj sám.
(čistí Temp složky , nečistí URL, historii, prefetch ani cookies)

stáhni program OTC tady: http://oldtimer.geekstogo.com/OTC.exe - spusť ho -> "CleanUp" (smaže dříve použité čističe)

Vypni Obnovení systému -> restartuj -> zapni Obnovení systému http://www.viry.cz/forum/viewtopic.php?t=47040

Mohu doporučit kontrolu a vyčištění Ccleanerem - vidím ho nainstalovaný

zavřít Internetový prohlížeč a
spustit "Čistič" > "Spustit Ccleaner" - odstraní nepotřebné
spustit "Registry" > "Hledej problémy" > "Opravit vybrané problémy"
souhlas se zálohou registrů - opakovat dokud nebudou registry čisté.

Návod:http://jnp.zive.cz/Clanky/Prirucka-do-k ... fault.aspx

Po vyčištění by se hodila defragmentace
doporučuji http://www.slunecnice.cz/sw/defraggler/ + čeština

Kdyby něco z návodu nefungovalo, pokračuj dalším krokem.

Po provedení mi napiš jestli jsou ještě nějaké problémy

Fanouš · #11 Příspěvek od **Fanouš** » 13 lis 2011 20:44

Zdravím a díky. Budu u toho PC zase až o víkendu. Ten user má obavy a strach,aby něco nezvojtil

Ale jinak, co povídal, tak se zdá, že je to O.K.
Díky a přeji pěkný zbytek večera

#12 Příspěvek od **cernohous13** » 13 lis 2011 20:46

Zatím nemáš zač - až to doděláte, dej mi vědět

Fanouš · #13 Příspěvek od **Fanouš** » 20 lis 2011 14:25

Zdravím, tak je tu pokračování. Nevím proč, ale změnilo se bootování v Biosu - chtělo to první bootovat z CD. Musel jsem to změnit zpět na HDD. Posílám raději log z RSIT a ComboFixu

ComboFix 11-11-20.01 - Chcípáček 20.11.2011 14:03:00.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.1536.930 [GMT 1:00]
Spuštěný z: c:\users\ChcÝpßŔek\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_COMSysApp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-20 do 2011-11-20 )))))))))))))))))))))))))))))))
.
.
2011-11-20 13:11 . 2011-11-20 13:11 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-11-20 13:11 . 2011-11-20 13:11 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-11-20 13:11 . 2011-11-20 13:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-20 12:54 . 2011-11-20 12:54 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{65594C30-82C0-4773-BB6F-1A0E44560A2E}\offreg.dll
2011-11-13 16:10 . 2011-11-13 16:10 -------- d-----w- C:\_OTM
2011-11-13 16:02 . 2011-11-20 12:57 -------- d-----w- c:\program files\trend micro
2011-11-12 13:46 . 2011-11-12 14:31 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2011-11-12 13:46 . 2011-11-12 13:46 -------- d-----w- c:\users\Chcípáček\AppData\Roaming\com.w3i.FlipToast
2011-11-12 13:46 . 2011-11-12 13:46 -------- d-----w- c:\program files\Common Files\Adobe AIR
2011-11-12 13:40 . 2011-11-12 14:26 -------- d-----w- c:\program files\Prolific Publishing, Inc
2011-11-05 13:02 . 2011-11-05 13:02 -------- d-----w- c:\program files\Rockstar Games
2011-11-05 13:02 . 2004-10-22 01:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-11-05 13:02 . 2004-10-22 01:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-11-05 13:02 . 2004-10-22 01:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-11-05 13:02 . 2004-10-22 01:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-11-05 13:02 . 2004-10-22 01:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-11-05 13:02 . 2011-11-05 13:02 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-11-05 13:02 . 2011-11-05 13:02 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-10-30 16:28 . 2011-10-30 16:28 -------- d-----w- c:\users\Chcípáček\AppData\Roaming\Avira
2011-10-30 16:22 . 2011-10-19 15:56 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-10-30 16:22 . 2011-10-19 15:56 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2011-10-30 16:22 . 2011-10-19 15:56 134344 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-10-30 16:22 . 2011-10-30 16:22 -------- d-----w- c:\programdata\Avira
2011-10-30 16:22 . 2011-10-30 16:22 -------- d-----w- c:\program files\Avira
2011-10-30 15:54 . 2011-10-30 15:54 -------- d-----w- c:\users\Chcípáček\AppData\Local\Diagnostics
2011-10-30 15:48 . 2011-11-20 13:14 -------- d-----w- c:\users\Chcípáček\AppData\Local\temp
2011-10-30 15:07 . 2011-10-30 15:07 -------- d-----w- c:\programdata\Kaspersky Lab
2011-10-30 15:04 . 2011-10-30 15:04 -------- d-----w- C:\rsit
2011-10-30 15:03 . 2011-10-30 15:03 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-10-30 14:37 . 2011-10-30 14:37 -------- d-----w- c:\users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 14:37 . 2011-10-30 14:37 -------- d-----w- c:\programdata\Malwarebytes
2011-10-30 14:35 . 2011-10-30 14:35 -------- d-----w- c:\program files\CCleaner
2011-10-30 09:14 . 2011-10-30 09:14 -------- d-----w- c:\users\Chcípáček\AppData\Local\Nero
2011-10-28 09:45 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{65594C30-82C0-4773-BB6F-1A0E44560A2E}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-15 08:30 . 2011-05-21 22:07 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 11:09 . 2011-05-31 08:48 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-10-10 11:09 . 2011-05-31 08:48 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-09-06 02:28 . 2011-10-12 17:40 2334720 ----a-w- c:\windows\system32\win32k.sys
2011-09-01 02:35 . 2011-10-13 01:03 1798144 ----a-w- c:\windows\system32\jscript9.dll
2011-09-01 02:28 . 2011-10-13 01:03 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-09-01 02:22 . 2011-10-13 01:03 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-08-27 04:26 . 2011-10-12 17:40 233472 ----a-w- c:\windows\system32\oleacc.dll
2011-08-27 04:26 . 2011-10-12 17:40 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-11-10 19:21 . 2011-08-20 09:59 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-30_15.43.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-11 00:58 . 2011-06-11 00:58 51024 c:\windows\System32\vcomp100.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 81744 c:\windows\System32\mfcm100u.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 81744 c:\windows\System32\mfcm100.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 60752 c:\windows\System32\mfc100rus.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 43344 c:\windows\System32\mfc100kor.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 43856 c:\windows\System32\mfc100jpn.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 62288 c:\windows\System32\mfc100ita.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 36176 c:\windows\System32\mfc100cht.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 36176 c:\windows\System32\mfc100chs.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 64336 c:\windows\System32\mfc100fra.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 63824 c:\windows\System32\mfc100esn.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 55120 c:\windows\System32\mfc100enu.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 64336 c:\windows\System32\mfc100deu.dll
+ 2011-10-30 16:22 . 2010-06-17 14:14 28520 c:\windows\System32\drivers\ssmdrv.sys
- 2010-03-13 16:03 . 2011-10-30 14:35 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-13 16:03 . 2011-11-13 16:32 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:34 . 2011-10-29 19:18 89968 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2009-07-14 04:34 . 2011-11-12 14:50 89968 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-11-12 13:44 . 2011-11-12 13:44 32256 c:\windows\Installer\4c16c7.msi
+ 2011-11-20 12:51 . 2011-11-20 13:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-10-30 15:00 . 2011-10-30 15:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-20 12:51 . 2011-11-20 13:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-30 15:00 . 2011-10-30 15:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-07 16:36 . 2011-11-07 16:36 180224 c:\windows\winsxs\x86_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7601.21748_none_8bb018931ac2fd62\xmllite.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 180224 c:\windows\winsxs\x86_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7601.17633_none_8b2c4a4201a1c2f4\xmllite.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 180224 c:\windows\winsxs\x86_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.20987_none_899d7b931dbde7e3\xmllite.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 180224 c:\windows\winsxs\x86_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.16834_none_8946ed86047a705f\xmllite.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 180224 c:\windows\System32\xmllite.dll
- 2009-07-14 00:20 . 2009-07-14 01:16 180224 c:\windows\System32\xmllite.dll
+ 2009-07-14 02:05 . 2011-11-20 12:56 606992 c:\windows\System32\perfh009.dat
- 2009-07-14 02:05 . 2011-10-30 15:09 606992 c:\windows\System32\perfh009.dat
- 2009-07-14 08:44 . 2011-10-30 15:09 622422 c:\windows\System32\perfh005.dat
+ 2009-07-14 08:44 . 2011-11-20 12:56 622422 c:\windows\System32\perfh005.dat
- 2009-07-14 02:05 . 2011-10-30 15:09 103370 c:\windows\System32\perfc009.dat
+ 2009-07-14 02:05 . 2011-11-20 12:56 103370 c:\windows\System32\perfc009.dat
+ 2009-07-14 08:44 . 2011-11-20 12:56 118604 c:\windows\System32\perfc005.dat
- 2009-07-14 08:44 . 2011-10-30 15:09 118604 c:\windows\System32\perfc005.dat
+ 2011-06-11 00:58 . 2011-06-11 00:58 773968 c:\windows\System32\msvcr100.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 421200 c:\windows\System32\msvcp100.dll
+ 2011-11-15 08:30 . 2011-11-15 08:30 247968 c:\windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe
+ 2011-11-15 08:30 . 2011-11-15 08:30 335520 c:\windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.dll
+ 2010-03-13 16:11 . 2011-11-12 13:44 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2010-03-13 16:11 . 2011-10-29 11:59 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-06-11 00:58 . 2011-06-11 00:58 138056 c:\windows\System32\atl100.dll
- 2009-07-14 04:47 . 2011-10-30 14:58 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:47 . 2011-11-20 12:40 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-08-10 19:57 . 2011-11-20 12:40 560120 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2478180410-4009266172-1965090003-1000-8192.dat
+ 2011-02-19 22:08 . 2011-02-19 22:08 163840 c:\windows\Installer\1beade.msi
+ 2009-07-14 02:03 . 2011-11-07 16:55 7340032 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:03 . 2011-10-13 01:20 7340032 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2011-06-11 00:58 . 2011-06-11 00:58 4422992 c:\windows\System32\mfc100u.dll
+ 2011-06-11 00:58 . 2011-06-11 00:58 4397384 c:\windows\System32\mfc100.dll
+ 2003-10-06 13:27 . 2003-10-06 13:27 5099520 c:\windows\System32\Goldfish.scr
- 2010-03-13 16:03 . 2011-10-30 14:35 3391488 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-13 16:03 . 2011-11-13 16:32 3391488 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:41 . 2011-11-13 16:32 4194304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:41 . 2011-10-30 14:35 4194304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:34 . 2011-11-07 16:59 5980439 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:34 . 2011-10-13 01:25 5980439 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-06-28 20:27 . 2011-06-28 20:27 4028928 c:\windows\Installer\8ebe15.msp
+ 2011-11-07 16:36 . 2011-11-07 16:36 12872704 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.21804_none_6ec5054c895384f1\shell32.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 12872704 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.17678_none_6df3b84f706b10f3\shell32.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 12871168 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7600.21039_none_6cc310308c4121a6\shell32.dll
+ 2011-11-07 16:36 . 2011-11-07 16:36 12868096 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7600.16874_none_6c095a2173483fab\shell32.dll
+ 2011-05-19 01:02 . 2011-11-07 16:36 40465965 c:\windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin
+ 2011-11-07 16:36 . 2011-11-07 16:36 12872704 c:\windows\System32\shell32.dll
+ 2011-10-30 22:19 . 2011-11-20 12:40 12813656 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2478180410-4009266172-1965090003-1000-4096.dat
+ 2011-04-19 21:29 . 2011-11-12 14:38 27433740 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2478180410-4009266172-1965090003-1000-12288.dat
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files\Hot_MP3\tbHot_.dll" [2010-02-22 2353176]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
2010-02-22 10:05 2353176 ----a-w- c:\program files\Hot_MP3\tbHot_.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9384bd4c-dd14-4be9-80f7-f6277511e4f5}"= "c:\program files\Hot_MP3\tbHot_.dll" [2010-02-22 2353176]
.
[HKEY_CLASSES_ROOT\clsid\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-19 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-11-15 09:42 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2009-03-12 15:15 2587584 ----a-w- c:\program files\SlySoft\AnyDVD\_AnyDVDtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2009-03-11 17:22 2912256 ----a-w- c:\program files\WinFast\WFDTV\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
2009-10-02 14:17 90112 ----a-w- c:\program files\WinFast\WFDTV\DTVSchdl.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Advanced SystemCare 4"=c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R3 cpuz126;cpuz126;c:\users\CHCPEK~1\AppData\Local\Temp\cpuz.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
R3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3);c:\windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-13 691696]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-19 36000]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-03-13 47360]
.
.
.
------- Doplňkový sken -------
.
uStart Page = www.321Search.com
mStart Page = hxxp://search.ChatVibes.com
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: Interfaces\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
FF - ProfilePath - c:\users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.ChatVibes.com/?q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-LifeGlobe Goldfish Aquarium_is1 - c:\program files\Prolific Publishing
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
c:\windows\system32\taskhost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2011-11-20 14:19:15 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-20 13:19
ComboFix2.txt 2011-10-30 15:48
.
Před spuštěním: Volných bajtů: 22 691 848 192
Po spuštění: Volných bajtů: 23 352 418 304
.
- - End Of File - - 132FD0CADA4BAB5FE819534300FB8E20

Logfile of random's system information tool 1.09 (written by random/random)
Run by Chcípáček at 2011-11-20 13:57:31
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 22 GB (29%) free of 76 GB
Total RAM: 1536 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:58:01, on 20.11.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Chcípáček\Downloads\RSIT.exe
C:\Program Files\trend micro\Chcípáček.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.321Search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ChatVibes.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Hot MP3 Toolbar - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\tbHot_.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2478180410-4009266172-1965090003-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = 10.255.255.10,10.255.255.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{AE84AF11-26BA-4F81-B3E5-36E7A84A04F9}: NameServer = ,
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 4850 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, toolbar@ask.com:3.11.3.15590, {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9, {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319, avg@igeared:6.103.018.001, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "http://search.ChatVibes.com/?q="

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
AskHPRFF.js
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
acpro.xml
avg_igeared.xml
crawlersrch.bak
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\extensions\
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Chcípáček\AppData\Roaming\Mozilla\Firefox\Profiles\bfbneaek.default\searchplugins\
askcom.xml
icqplugin-1.xml
icqplugin-10.xml
icqplugin-11.xml
icqplugin-12.xml
icqplugin-13.xml
icqplugin-14.xml
icqplugin-15.xml
icqplugin-16.xml
icqplugin-17.xml
icqplugin-18.xml
icqplugin-19.xml
icqplugin-2.xml
icqplugin-20.xml
icqplugin-21.xml
icqplugin-22.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.xml
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9384bd4c-dd14-4be9-80f7-f6277511e4f5}]
Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Users\Chcípáček\SkypePortable\App\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-08-16 3942048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - Hot MP3 Toolbar - C:\Program Files\Hot_MP3\tbHot_.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-10-19 258512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\_AnyDVDtray.exe [2009-03-12 2587584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-03-11 2912256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-10-02 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-04-20 203776]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-11-13 17:10:29 ----D---- C:\_OTM
2011-11-13 17:02:31 ----D---- C:\Program Files\trend micro
2011-11-12 14:46:37 ----SHD---- C:\Windows\system32\AI_RecycleBin
2011-11-12 14:46:29 ----D---- C:\Users\Chcípáček\AppData\Roaming\com.w3i.FlipToast
2011-11-12 14:46:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-11-12 14:40:06 ----D---- C:\Program Files\Prolific Publishing, Inc
2011-11-07 17:36:31 ----A---- C:\Windows\system32\shell32.dll
2011-11-07 17:36:02 ----A---- C:\Windows\system32\xmllite.dll
2011-11-05 14:02:58 ----D---- C:\Program Files\Rockstar Games
2011-10-30 17:28:40 ----D---- C:\Users\Chcípáček\AppData\Roaming\Avira
2011-10-30 17:22:06 ----A---- C:\Windows\system32\drivers\ssmdrv.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avipbb.sys
2011-10-30 17:22:04 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2011-10-30 17:22:02 ----D---- C:\ProgramData\Avira
2011-10-30 17:22:02 ----D---- C:\Program Files\Avira
2011-10-30 16:48:50 ----SHD---- C:\$RECYCLE.BIN
2011-10-30 16:48:47 ----D---- C:\Windows\temp
2011-10-30 16:48:44 ----A---- C:\ComboFix.txt
2011-10-30 16:30:27 ----A---- C:\Windows\zip.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWSC.exe
2011-10-30 16:30:27 ----A---- C:\Windows\SWREG.exe
2011-10-30 16:30:27 ----A---- C:\Windows\sed.exe
2011-10-30 16:30:27 ----A---- C:\Windows\PEV.exe
2011-10-30 16:30:27 ----A---- C:\Windows\NIRCMD.exe
2011-10-30 16:30:27 ----A---- C:\Windows\MBR.exe
2011-10-30 16:30:27 ----A---- C:\Windows\grep.exe
2011-10-30 16:30:13 ----D---- C:\Windows\ERDNT
2011-10-30 16:30:05 ----D---- C:\Qoobox
2011-10-30 16:07:16 ----D---- C:\ProgramData\Kaspersky Lab
2011-10-30 16:04:06 ----D---- C:\rsit
2011-10-30 16:03:20 ----A---- C:\Windows\system32\drivers\TrueSight.sys
2011-10-30 15:37:10 ----D---- C:\Users\Chcípáček\AppData\Roaming\Malwarebytes
2011-10-30 15:37:01 ----D---- C:\ProgramData\Malwarebytes
2011-10-30 15:35:25 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2011-11-20 13:57:44 ----D---- C:\Windows\Prefetch
2011-11-20 13:56:28 ----D---- C:\Windows\System32
2011-11-20 13:56:28 ----D---- C:\Windows\inf
2011-11-20 13:56:28 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-20 13:55:27 ----D---- C:\Windows\system32\config
2011-11-16 08:35:56 ----SHD---- C:\System Volume Information
2011-11-15 20:09:21 ----AD---- C:\Windows
2011-11-13 17:17:23 ----D---- C:\Windows\SoftwareDistribution
2011-11-13 17:10:50 ----RD---- C:\Program Files
2011-11-13 17:10:50 ----D---- C:\Windows\Tasks
2011-11-13 17:10:50 ----D---- C:\Windows\system32\drivers
2011-11-13 17:10:50 ----D---- C:\ProgramData
2011-11-12 15:31:48 ----SHD---- C:\Windows\Installer
2011-11-12 15:31:48 ----D---- C:\Config.Msi
2011-11-12 15:27:02 ----D---- C:\Windows\tracing
2011-11-12 14:46:13 ----D---- C:\ProgramData\Adobe
2011-11-12 14:46:02 ----D---- C:\Program Files\Adobe
2011-11-12 14:46:00 ----D---- C:\Program Files\Common Files
2011-11-12 14:45:39 ----D---- C:\Users\Chcípáček\AppData\Roaming\Adobe
2011-11-10 20:21:32 ----D---- C:\Program Files\Mozilla Firefox
2011-11-07 17:57:35 ----D---- C:\Windows\winsxs
2011-11-07 17:36:29 ----D---- C:\Windows\system32\catroot2
2011-11-07 17:36:29 ----D---- C:\Windows\system32\catroot
2011-11-05 14:02:58 ----HD---- C:\Program Files\InstallShield Installation Information
2011-10-30 17:14:36 ----D---- C:\Windows\system32\Tasks
2011-10-30 16:54:19 ----D---- C:\Windows\system32\NDF
2011-10-30 16:43:15 ----A---- C:\Windows\system.ini
2011-10-30 16:43:07 ----D---- C:\Windows\system32\drivers\etc
2011-10-30 16:38:36 ----D---- C:\Windows\AppPatch
2011-10-30 15:59:50 ----D---- C:\Windows\nview
2011-10-30 15:47:48 ----D---- C:\Windows\system32\DriverStore
2011-10-30 15:36:03 ----D---- C:\Windows\Panther
2011-10-30 10:23:59 ----A---- C:\Windows\NeroDigital.ini
2011-10-28 23:55:12 ----D---- C:\Users\Chcípáček\AppData\Roaming\ICQ

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-13 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2011-10-19 134344]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2011-10-19 36000]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2011-10-19 74640]
R2 NVR0FLASHDev;NVR0FLASHDev; \??\C:\Windows\nvflash.sys [2009-01-07 36896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 dvdfab;dvdfab; C:\Windows\system32\drivers\dvdfab.sys [2010-11-08 49024]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys [2009-01-06 36640]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-03-13 47360]
S2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2005-08-11 163584]
S2 CXTUNE;Conexant 2388x Tuner; C:\Windows\system32\drivers\CX88TUNE_IBV32.sys [2006-11-02 17664]
S3 a6oqa8gi;a6oqa8gi; C:\Windows\system32\drivers\a6oqa8gi.sys []
S3 a6v0mh2e;a6v0mh2e; C:\Windows\system32\drivers\a6v0mh2e.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 catchme;catchme; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\catchme.sys []
S3 cpuz126;cpuz126; \??\C:\Users\CHCPEK~1\AppData\Local\Temp\cpuz.sys []
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
S3 GVCplDrv;GVCplDrv; C:\Windows\system32\drivers\GVCplDrv.sys [2004-05-02 23040]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102912]
S3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2005-12-10 3536768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SNP325;USB PC Camera (SNPSTD325); C:\Windows\system32\DRIVERS\snp325.sys []
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TrueSight;TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [2011-10-30 111872]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 27648]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WFLR6654;WinFast TV2000 XP Expert (FM1216MK3); C:\Windows\system32\drivers\wfeaglxt.sys [2009-08-10 433920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira Realtime Protection; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-10-19 110032]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]
R2 nTuneService;Performance Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2009-01-06 174624]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-08-03 599144]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
R2 UpdateCenterService;Update Center Service; C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-01-07 121376]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1343400]
S4 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-09-23 935208]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-05-31 66872]
S4 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S4 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]

-----------------EOF-----------------

#14 Příspěvek od **cernohous13** » 20 lis 2011 15:02

Otevři Poznámkový blok (Notepad) a vlož zelený text ze scriptu.

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000

Soubor ulož jako -> oprava.reg - Uložit jako typ -> Všechny soubory
Zavři a dvojklikem na ikonu spusť - jen problikne a opraví registry - po akci jej smažeš.

13.10. jsem dával návod na odinstalaci a úklid - zjevně dosud neproběhlo

Fanouš · #15 Příspěvek od **Fanouš** » 21 lis 2011 15:46

Zdravím

Ono je to na dlouhé lokte... S tím časem... Ani ne tak mým, jako toho dotyčného.
Takže malý posun ...
Provedeno - opravené registry,
- čištění pomocí T- cleaner - O.k.
OTC -O.K.
TempFolderCleaner - zde nevím proč, po restartu jsme museli znovu zadat ručně nastavení internetu ( Nastavit protokol TCP/IPv4 -bránu, DNS atd. )
CCleaner -O.K.

Chybí - vypnout bod obnovy a derfagmentace ... A odinstalovat ComboFix ...

Kdy k tomu dojde, je ve hvězdách

Zatím díky za pomoc a trpělivost
Zdravím Fanouš

VIRY.CZ

Vir Fcb- nelze spustit Avast

Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast

Re: Vir Fcb- nelze spustit Avast