Blokace antiviru - enhanced protection mode, díky za pomoc

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\windows\ufa
  c:\windows\update.8.1
  c:\windows\update.tray-9-0
  c:\windows\update.tray-9-0-lnk
  c:\windows\update.tray-14-0
  c:\windows\update.tray-14-0-lnk
  c:\program files\Zrychleni Pocitace
  c:\program files\ICQ6Toolbar
  
  File::
  c:\windows\unrar.exe
  c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "swg"=-
  "PCSpeedUp"=-
  "ICQ"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "tray_ico"=-
  "tray_ico2"=
  "tray_ico3"=-
  "tray_ico4"=-
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "FirewallOverride"=dword:00000000
  "DisableThumbnailCache"=dword:00000000
  
  Driver::
  MpKslae14c215
  gupdate
  gupdatem
  ICQ Service
  
  RegNull::
  [HKEY_USERS\S-1-5-21-4149293690-2455191134-2119388712-1000\Software\SecuROM\License information*]
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[leos]

ComboFix 11-11-08.02 - milacek 08.11.2011 14:17:09.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2009.1258 [GMT 1:00]
Spuštěný z: c:\users\milacek\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\milacek\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt
c:\program files\ICQ6Toolbar\voucher.bmp
c:\program files\ICQ6Toolbar\voucher2.bmp
c:\program files\Zrychleni Pocitace
c:\program files\Zrychleni Pocitace\PCSpeedUp.lnk
c:\program files\Zrychleni Pocitace\PCSUService.log
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.8.1
c:\windows\update.tray-14-0-lnk
c:\windows\update.tray-14-0-lnk\svchost.exe
c:\windows\update.tray-14-0
c:\windows\update.tray-14-0\svchost.exe
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-9-0-lnk\svchost.exe
c:\windows\update.tray-9-0
c:\windows\update.tray-9-0\svchost.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MPKSLAE14C215
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_ICQ Service
-------\Service_MpKslae14c215
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-08 do 2011-11-08 )))))))))))))))))))))))))))))))
.
.
2011-11-08 13:22 . 2011-11-08 13:24 -------- d-----w- c:\users\milacek\AppData\Local\temp
2011-11-08 13:22 . 2011-11-08 13:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-08 11:10 . 2009-07-13 23:12 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-11-08 10:53 . 2011-11-08 10:54 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2011-11-08 09:46 . 2011-11-08 09:46 -------- d-----w- c:\windows\system32\%APPDATA%
2011-11-08 09:46 . 2011-11-08 09:46 -------- d-----w- C:\rsit
2011-11-08 09:15 . 2011-11-08 09:15 -------- d--h--w- c:\windows\PIF
2011-11-08 07:51 . 2011-11-08 11:22 -------- d-----w- c:\program files\Trend Micro
2011-10-26 20:06 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{648FAC96-D7F5-422D-9182-B145B297BED9}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-07 03:48 . 2010-11-16 13:14 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-26 307768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 150552]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-26 307768]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [BU]
"tray_ico2"="" [BU]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 TrueSight;TrueSight;c:\windows\system32\drivers\TrueSight.sys [2011-11-08 111872]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 21520]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-04-26 278560]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-10-16 171776]
.
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-11-08 14:27:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-08 13:27
ComboFix2.txt 2011-11-08 11:27
ComboFix3.txt 2011-11-08 09:29
.
Před spuštěním: Volných bajtů: 200 651 419 648
Po spuštění: Volných bajtů: 200 393 183 232
.
- - End Of File - - 41DC467278C4D8F0EE21C943DDE1DCBF

[vyosek]

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "tray_ico2"=-
  
  :files
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[leos]

All processes killed
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\tray_ico2 deleted successfully.
========== FILES ==========
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: milacek
->Temp folder emptied: 6594 bytes
->Temporary Internet Files folder emptied: 266031137 bytes
->Flash cache emptied: 235460 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 66016 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 254,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: milacek
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 11092011_095209

Files moved on Reboot...

Registry entries deleted on Reboot...

[vyosek]

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

v nouzovem rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti) projedte PC temito utilitami, at se zbavime zbytku antiviru co tam mate

• http://go.microsoft.com/?linkid=9748340
• http://download.microsoft.com/download/ ... leanUp.exe

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Nainstalujte zabezpeceni PC - doporcujici Avast, Aviru nebo MSE

Dejte novy log z RSIT a napiste co PC

[leos]

diky, jen mi nešel spustit TCliner - není platná aplikace 32... a nemuzu nainstalovat MSE - chyba při instalaci. Prošel jsem fora na Microsoftu co delat, ale nic nepomaha. pritom jsem vše řádně odinstaloval. Co udělat? Chcete log z RSITu?

[leos]

Logfile of random's system information tool 1.09 (written by random/random)
Run by milacek at 2011-11-09 12:34:12
Microsoft Windows 7 Home Premium
System drive C: has 207 GB (87%) free of 238 GB
Total RAM: 2009 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:34:33, on 9.11.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16869)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Lenovo\Energy Management\utility.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Lenovo\Energy Management\Energy Management.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Conexant\SAII\SmartAudio.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\milacek\Desktop\RSIT.exe
C:\Program Files\trend micro\milacek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe
O4 - HKLM\..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /c
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - Unknown owner - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (file missing)

--
End of file - 4520 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-06-04 186904]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-04-26 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-04-26 174104]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-04-26 150552]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2010-04-26 307768]
"EnergyUtility"=C:\Program Files\Lenovo\Energy Management\utility.exe [2009-09-29 4114288]
"Energy Management"=C:\Program Files\Lenovo\Energy Management\Energy Management.exe [2009-09-29 5064560]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SAIICpl.exe [2010-04-26 307768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-04-26 215552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-11-09 12:34:12 ----D---- C:\rsit
2011-11-09 12:22:24 ----D---- C:\7253e2d09e9c65b49358c6
2011-11-09 11:16:44 ----D---- C:\Windows\pss
2011-11-09 10:59:00 ----D---- C:\Program Files\CCleaner
2011-11-09 10:52:39 ----D---- C:\WINSSLog
2011-11-09 09:50:26 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2011-11-09 09:50:26 ----A---- C:\Windows\system32\drivers\ks.sys
2011-11-09 09:49:22 ----A---- C:\Windows\system32\wcncsvc.dll
2011-11-08 14:27:59 ----D---- C:\Windows\temp
2011-11-08 14:27:12 ----SHD---- C:\$RECYCLE.BIN
2011-11-08 12:18:41 ----A---- C:\Windows\system32\d2d1.dll
2011-11-08 12:18:40 ----A---- C:\Windows\system32\FntCache.dll
2011-11-08 12:18:40 ----A---- C:\Windows\system32\DWrite.dll
2011-11-08 12:00:33 ----A---- C:\Windows\system32\ieframe.dll
2011-11-08 12:00:31 ----A---- C:\Windows\system32\iertutil.dll
2011-11-08 12:00:30 ----A---- C:\Windows\system32\wininet.dll
2011-11-08 12:00:30 ----A---- C:\Windows\system32\urlmon.dll
2011-11-08 12:00:30 ----A---- C:\Windows\system32\mshtml.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\mstime.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\msfeeds.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\licmgr10.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\iepeers.dll
2011-11-08 12:00:29 ----A---- C:\Windows\system32\iedkcs32.dll
2011-11-08 12:00:28 ----A---- C:\Windows\system32\url.dll
2011-11-08 12:00:28 ----A---- C:\Windows\system32\mshtmled.dll
2011-11-08 12:00:28 ----A---- C:\Windows\system32\msfeedssync.exe
2011-11-08 12:00:28 ----A---- C:\Windows\system32\jsproxy.dll
2011-11-08 12:00:28 ----A---- C:\Windows\system32\ieui.dll
2011-11-08 11:59:57 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-11-08 11:59:57 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-11-08 11:59:28 ----A---- C:\Windows\system32\ntdll.dll
2011-11-08 11:58:49 ----A---- C:\Windows\system32\drivers\fvevol.sys
2011-11-08 11:58:48 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-11-08 11:58:48 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-11-08 11:58:48 ----A---- C:\Windows\system32\drivers\srv.sys
2011-11-08 11:58:47 ----A---- C:\Windows\system32\drivers\afd.sys
2011-11-08 11:58:46 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-11-08 11:58:45 ----A---- C:\Windows\system32\xmllite.dll
2011-11-08 11:58:45 ----A---- C:\Windows\system32\prevhost.exe
2011-11-08 11:58:44 ----A---- C:\Windows\system32\vbscript.dll
2011-11-08 11:58:44 ----A---- C:\Windows\system32\jscript.dll
2011-11-08 11:57:55 ----A---- C:\Windows\system32\atmlib.dll
2011-11-08 11:57:55 ----A---- C:\Windows\system32\atmfd.dll
2011-11-08 11:57:54 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-11-08 11:57:54 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-11-08 11:57:54 ----A---- C:\Windows\system32\dnsapi.dll
2011-11-08 11:57:52 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-11-08 11:57:52 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-11-08 11:57:52 ----A---- C:\Windows\system32\cdd.dll
2011-11-08 11:57:49 ----A---- C:\Windows\system32\msdri.dll
2011-11-08 11:57:35 ----A---- C:\Windows\system32\psisdecd.dll
2011-11-08 11:57:33 ----A---- C:\Windows\system32\umpnpmgr.dll
2011-11-08 11:57:30 ----A---- C:\Windows\system32\kerberos.dll
2011-11-08 11:57:27 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-11-08 11:57:27 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-11-08 11:57:27 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-11-08 11:57:26 ----A---- C:\Windows\system32\oleaut32.dll
2011-11-08 11:57:26 ----A---- C:\Windows\system32\oleacc.dll
2011-11-08 11:57:23 ----A---- C:\Windows\system32\odbc32.dll
2011-11-08 11:57:20 ----A---- C:\Windows\system32\tzres.dll
2011-11-08 11:57:11 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-11-08 11:57:11 ----A---- C:\Windows\system32\drivers\dfsc.sys
2011-11-08 11:57:08 ----A---- C:\Windows\system32\inetcomm.dll
2011-11-08 11:57:07 ----A---- C:\Windows\system32\win32k.sys
2011-11-08 11:57:02 ----A---- C:\Windows\system32\tquery.dll
2011-11-08 11:57:02 ----A---- C:\Windows\system32\mssrch.dll
2011-11-08 11:57:01 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-11-08 11:57:01 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-11-08 11:57:01 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-11-08 11:57:01 ----A---- C:\Windows\system32\mssvp.dll
2011-11-08 11:57:01 ----A---- C:\Windows\system32\mssphtb.dll
2011-11-08 11:57:01 ----A---- C:\Windows\system32\mssph.dll
2011-11-08 11:57:01 ----A---- C:\Windows\system32\msscntrs.dll
2011-11-08 11:56:55 ----A---- C:\Windows\system32\FXSCOVER.exe
2011-11-08 11:56:54 ----A---- C:\Windows\system32\XpsPrint.dll
2011-11-08 11:56:53 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-11-08 11:56:53 ----A---- C:\Windows\system32\CPFilters.dll
2011-11-08 11:56:52 ----A---- C:\Windows\system32\sbe.dll
2011-11-08 11:56:52 ----A---- C:\Windows\system32\EncDec.dll
2011-11-08 11:56:27 ----A---- C:\Windows\explorer.exe
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-11-08 11:56:26 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-11-08 11:56:26 ----A---- C:\Windows\system32\winsrv.dll
2011-11-08 11:56:26 ----A---- C:\Windows\system32\KernelBase.dll
2011-11-08 11:56:26 ----A---- C:\Windows\system32\kernel32.dll
2011-11-08 11:56:26 ----A---- C:\Windows\system32\conhost.exe
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-11-08 11:56:25 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-11-08 11:56:22 ----A---- C:\Windows\system32\mstscax.dll
2011-11-08 11:56:21 ----A---- C:\Windows\system32\mstsc.exe
2011-11-08 11:55:51 ----A---- C:\Windows\system32\odbctrac.dll
2011-11-08 11:55:51 ----A---- C:\Windows\system32\odbcjt32.dll
2011-11-08 11:55:51 ----A---- C:\Windows\system32\odbccu32.dll
2011-11-08 11:55:51 ----A---- C:\Windows\system32\odbccr32.dll
2011-11-08 11:55:51 ----A---- C:\Windows\system32\odbccp32.dll
2011-11-08 11:55:50 ----A---- C:\Windows\system32\d3d10_1.dll
2011-11-08 11:55:27 ----A---- C:\Windows\system32\mf.dll
2011-11-08 11:55:27 ----A---- C:\Windows\system32\d3d10warp.dll
2011-11-08 11:55:25 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-11-08 11:55:25 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-11-08 11:55:24 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-11-08 11:55:24 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-11-08 11:55:23 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-11-08 11:55:22 ----A---- C:\Windows\system32\upnp.dll
2011-11-08 11:55:22 ----A---- C:\Windows\system32\msxml6.dll
2011-11-08 11:55:22 ----A---- C:\Windows\system32\msxml3.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\wscsvc.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\wscapi.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\winhttp.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\WebClnt.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\slwga.dll
2011-11-08 11:55:21 ----A---- C:\Windows\system32\davclnt.dll
2011-11-08 11:55:20 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2011-11-08 11:55:20 ----A---- C:\Windows\system32\secproc_ssp.dll
2011-11-08 11:55:20 ----A---- C:\Windows\system32\secproc_isv.dll
2011-11-08 11:55:20 ----A---- C:\Windows\system32\secproc.dll
2011-11-08 11:55:20 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2011-11-08 11:55:20 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2011-11-08 11:55:20 ----A---- C:\Windows\system32\RMActivate_isv.exe
2011-11-08 11:55:20 ----A---- C:\Windows\system32\RMActivate.exe
2011-11-08 11:54:54 ----A---- C:\Windows\system32\mfc42u.dll
2011-11-08 11:54:54 ----A---- C:\Windows\system32\mfc42.dll
2011-11-08 11:54:20 ----A---- C:\Windows\system32\poqexec.exe
2011-11-08 11:54:12 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-11-08 11:53:15 ----A---- C:\Windows\system32\drivers\TrueSight.sys
2011-11-08 10:46:30 ----D---- C:\Windows\system32\%APPDATA%
2011-11-08 10:16:20 ----D---- C:\Windows\ERDNT
2011-11-08 10:15:12 ----HD---- C:\Windows\PIF
2011-11-08 08:51:26 ----D---- C:\Program Files\Trend Micro

======List of files/folders modified in the last 1 month======

2011-11-09 12:23:23 ----SHD---- C:\Windows\Installer
2011-11-09 12:23:23 ----RD---- C:\Program Files
2011-11-09 12:23:23 ----D---- C:\Windows\system32\drivers
2011-11-09 12:23:22 ----D---- C:\Windows\inf
2011-11-09 12:23:10 ----D---- C:\Windows\System32
2011-11-09 12:23:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-09 12:23:09 ----D---- C:\Windows\system32\catroot
2011-11-09 12:22:57 ----D---- C:\Windows
2011-11-09 12:22:41 ----D---- C:\Windows\system32\config
2011-11-09 11:54:26 ----D---- C:\Windows\system32\Tasks
2011-11-09 11:53:17 ----SD---- C:\Windows\system32\Microsoft
2011-11-09 11:52:57 ----D---- C:\Windows\Tasks
2011-11-09 11:32:49 ----HD---- C:\Windows\system32\GroupPolicy
2011-11-09 11:32:23 ----D---- C:\Windows\SoftwareDistribution
2011-11-09 11:31:41 ----SD---- C:\ProgramData\Microsoft
2011-11-09 11:26:27 ----D---- C:\Program Files\Wroom
2011-11-09 11:26:15 ----SHD---- C:\System Volume Information
2011-11-09 11:25:55 ----HD---- C:\Program Files\InstallShield Installation Information
2011-11-09 11:25:40 ----A---- C:\Windows\Disney.ini
2011-11-09 11:09:11 ----D---- C:\Program Files\Google
2011-11-09 11:07:38 ----D---- C:\Windows\winsxs
2011-11-09 11:07:34 ----D---- C:\Windows\AppPatch
2011-11-09 11:00:55 ----D---- C:\Windows\Minidump
2011-11-09 11:00:55 ----D---- C:\Windows\debug
2011-11-09 10:15:31 ----D---- C:\Windows\Microsoft.NET
2011-11-09 10:15:22 ----RSD---- C:\Windows\assembly
2011-11-09 10:10:33 ----D---- C:\Program Files\Microsoft Silverlight
2011-11-09 10:09:25 ----RSD---- C:\Windows\Fonts
2011-11-09 10:09:25 ----D---- C:\Windows\system32\cs-CZ
2011-11-09 10:09:25 ----D---- C:\Windows\ehome
2011-11-09 10:09:24 ----D---- C:\Program Files\Internet Explorer
2011-11-09 10:09:22 ----D---- C:\Windows\system32\migration
2011-11-09 10:09:19 ----D---- C:\Windows\system32\DriverStore
2011-11-09 10:09:13 ----D---- C:\ProgramData\Microsoft Help
2011-11-09 09:52:18 ----D---- C:\Windows\system32\drivers\etc
2011-11-09 09:50:29 ----D---- C:\Windows\system32\catroot2
2011-11-09 09:50:07 ----D---- C:\Program Files\Common Files\microsoft shared
2011-11-08 14:25:30 ----D---- C:\Windows\system32\wdi
2011-11-08 14:24:03 ----A---- C:\Windows\system.ini
2011-11-08 14:19:43 ----D---- C:\Program Files\Common Files
2011-11-08 12:18:26 ----D---- C:\ProgramData\Adobe
2011-11-08 11:46:52 ----D---- C:\Windows\system32\en-US
2011-11-08 11:46:50 ----D---- C:\Program Files\Microsoft.NET
2011-11-08 11:41:34 ----A---- C:\AtmApInit.txt
2011-11-08 11:40:18 ----D---- C:\Windows\system32\wfp
2011-11-08 11:40:12 ----D---- C:\Windows\system32\wbem
2011-11-08 11:38:06 ----D---- C:\Windows\system32\drivers\UMDF
2011-11-08 11:38:05 ----D---- C:\Windows\system32\CodeIntegrity
2011-11-08 11:37:46 ----D---- C:\Windows\servicing
2011-11-08 11:37:38 ----D---- C:\Windows\AppCompat
2011-11-08 11:37:20 ----D---- C:\Program Files\Common Files\Adobe
2011-11-08 11:37:02 ----D---- C:\Windows\registration
2011-11-08 11:33:52 ----RD---- C:\Users
2011-11-08 11:33:50 ----SD---- C:\Users\milacek\AppData\Roaming\Microsoft
2011-11-08 11:33:10 ----D---- C:\ProgramData\Google
2011-11-08 11:33:10 ----D---- C:\ProgramData
2011-11-08 09:26:18 ----D---- C:\Windows\Logs
2011-11-08 09:18:06 ----D---- C:\Windows\Prefetch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-06-04 330264]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver; C:\Windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 21520]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2010-04-26 218744]
R3 BCM43XX;Broadcom 802.11 – ovladač síťového adaptéru; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-07-13 1131008]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2010-04-26 517688]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2010-04-26 5922816]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2010-04-26 278560]
R3 usbsmi;Lenovo EasyCamera; C:\Windows\system32\DRIVERS\SMIksdrv.sys [2009-10-16 171776]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 TrueSight;TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [2011-11-08 111872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-06-04 354840]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[leos]

pc se chová celkem ok, jen si nejsem jist, zda jsou všechny breberky fuč.
zbývá jen instalace antiviru.
Čekám na vaše doporučení co dále...

[vyosek]

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[leos]

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 8126

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

9.11.2011 18:07:08
mbam-log-2011-11-09 (18-07-08).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 240107
Uplynulý čas: 52 minut, 12 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[vyosek]

Jakou chybu MSE hlasi? Zkousel jste treba Avast

[leos]

pri instalaci skonci s chybou 0x800654 nebo jak to psal. Na webu microsoftu k tomu pisou navody, ale nic nefungovalo, reg klice k vymazu jsem nenasel. Avast jsem zatim nezkousel.

[vyosek]

Zkuste Avast a uvidime

[leos]

Tak Avast jede a myslím, že dobře.
Mám si na něco ještě dát pozor? Zkusím to otestovat v provozu a uvidím.
Poslední otázka - kamarád, co mu patří tento pc, mi říkal, že se to začalo projevovat tak, že když doma zapojil nottebook do sítě wifi, tak wifi spojení skolabovalo a ani velke pc nejelo, provider zkontroloval spojeni a vse bylo ok, takze chyba v pc. Doufám, ze se to tímto vyresilo. Co myslíte?
Jinak moc díky za ochotu a pomoc.

[vyosek]

PC bylo napadeno tzv. Facebook virem - proto bylo ve stavu v jakem bylo...

PC otestujte a napiste...