Prosím o pomoc. Zamrzání firefoxu

Zpráva

Fugass · #1 Příspěvek od **Fugass** » 17 Lis 2011 17:05

Dobrý den
Prosím o pomoc při vyčištění notebooku. Po spuštění firefoxu dochází k zamrzání programu a avast mi začal hlásit nějaké malvary. Občas dochází také k pádu do modré obrazovky. Po obnovení systému mohu na internet pomocí IE.
Děkuji

Logfile of random's system information tool 1.09 (written by random/random)
Run by Kincl at 2011-11-17 16:57:31
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 71 GB (71%) free of 100 GB
Total RAM: 3063 MB (85% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:57:41, on 17.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17103)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kincl\Plocha\RSIT.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\trend micro\Kincl.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://intel-drv-cdn.systemrequirements ... b_srlx.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

--
End of file - 5150 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-854245398-343818398-682003330-1003.job
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-854245398-343818398-682003330-1003.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Kincl\Data aplikací\Mozilla\Firefox\Profiles\0kceghcc.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
npdeploytk.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-07-29 1545512]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-01-21 166912]
"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2010-01-20 2052096]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-07-23 498744]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"MobileConnect"=C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2009-09-18 2412032]
"avast"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-09-06 3722416]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AESTFltr]
C:\WINDOWS\system32\AESTFltr.exe [2009-02-18 737280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2009-01-21 134656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe [2009-01-21 134656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2008-08-08 524288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-01-21 205824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\Compaq610\chiputil.exe"="F:\Compaq610\chiputil.exe:*:Enabled:ChipUtil"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\Kincl\Local Settings\Temp\_iu14D2N.tmp"="C:\Documents and Settings\Kincl\Local Settings\Temp\_iu14D2N.tmp:*:Enabled:Setup/Uninstall"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Documents and Settings\Kincl\Plocha\RSIT.exe"="C:\Documents and Settings\Kincl\Plocha\RSIT.exe:*:Disabled:RSIT"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"msacm.voxacm160"=vct3216.acm
"msacm.scg726"=scg726.acm
"msacm.alf2cd"=alf2cd.acm
"msacm.ac3acm"=AC3ACM.acm
"vidc.dvsd"=mcdvd_32.dll
"vidc.xvid"=xvidvfw.dll
"vidc.DIVX"=DivX.dll
"vidc.mpg4"=mpg4c32.dll
"vidc.mp42"=mpg4c32.dll
"vidc.mp43"=mpg4c32.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3filter"=ac3filter.acm
"msacm.avis"=ff_acm.acm

======List of files/folders created in the last 1 month======

2011-11-17 16:57:32 ----D---- C:\Program Files\trend micro
2011-11-17 16:57:31 ----D---- C:\rsit
2011-11-17 16:33:34 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-11-17 15:16:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2011-11-17 15:15:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2011-11-17 14:59:38 ----HD---- C:\WINDOWS\$NtUninstallKB2079403$
2011-11-17 14:59:37 ----HD---- C:\WINDOWS\$NtUninstallKB2160329$
2011-11-17 14:59:37 ----HD---- C:\WINDOWS\$NtUninstallKB2158563$
2011-11-17 14:59:37 ----HD---- C:\WINDOWS\$NtUninstallKB2141007$
2011-11-17 14:59:37 ----HD---- C:\WINDOWS\$NtUninstallKB2121546$
2011-11-17 14:59:35 ----HD---- C:\WINDOWS\$NtUninstallKB2259922$
2011-11-17 14:59:35 ----HD---- C:\WINDOWS\$NtUninstallKB2229593$
2011-11-17 14:59:35 ----HD---- C:\WINDOWS\$NtUninstallKB2183461$
2011-11-17 14:59:34 ----HD---- C:\WINDOWS\$NtUninstallKB2296011$
2011-11-17 14:59:34 ----HD---- C:\WINDOWS\$NtUninstallKB2286198$
2011-11-17 14:59:34 ----HD---- C:\WINDOWS\$NtUninstallKB2279986$
2011-11-17 14:59:33 ----HD---- C:\WINDOWS\$NtUninstallKB2345886$
2011-11-17 14:59:33 ----HD---- C:\WINDOWS\$NtUninstallKB2296199$
2011-11-17 14:59:32 ----HD---- C:\WINDOWS\$NtUninstallKB2347290$
2011-11-17 14:59:31 ----HD---- C:\WINDOWS\$NtUninstallKB2360937$
2011-11-17 14:59:31 ----HD---- C:\WINDOWS\$NtUninstallKB2360131$
2011-11-17 14:59:30 ----HD---- C:\WINDOWS\$NtUninstallKB2387149$
2011-11-17 14:59:30 ----HD---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2011-11-17 14:59:28 ----HD---- C:\WINDOWS\$NtUninstallKB2412687$
2011-11-17 14:59:28 ----HD---- C:\WINDOWS\$NtUninstallKB2393802$
2011-11-17 14:59:27 ----HD---- C:\WINDOWS\$NtUninstallKB2416400$
2011-11-17 14:59:26 ----HD---- C:\WINDOWS\$NtUninstallKB2423089$
2011-11-17 14:59:26 ----HD---- C:\WINDOWS\$NtUninstallKB2419632$
2011-11-17 14:59:25 ----HD---- C:\WINDOWS\$NtUninstallKB2467659$
2011-11-17 14:59:25 ----HD---- C:\WINDOWS\$NtUninstallKB2443685$
2011-11-17 14:59:25 ----HD---- C:\WINDOWS\$NtUninstallKB2443105$
2011-11-17 14:59:25 ----HD---- C:\WINDOWS\$NtUninstallKB2440591$
2011-11-17 14:59:25 ----HD---- C:\WINDOWS\$NtUninstallKB2436673$
2011-11-17 14:59:24 ----HD---- C:\WINDOWS\$NtUninstallKB2478971$
2011-11-17 14:59:24 ----HD---- C:\WINDOWS\$NtUninstallKB2478960$
2011-11-17 14:59:24 ----HD---- C:\WINDOWS\$NtUninstallKB2476687$
2011-11-17 14:59:24 ----HD---- C:\WINDOWS\$NtUninstallKB2476490$
2011-11-17 14:59:23 ----HD---- C:\WINDOWS\$NtUninstallKB2479943$
2011-11-17 14:59:23 ----HD---- C:\WINDOWS\$NtUninstallKB2479628$
2011-11-17 14:59:22 ----HD---- C:\WINDOWS\$NtUninstallKB2481109$
2011-11-17 14:59:21 ----HD---- C:\WINDOWS\$NtUninstallKB2482017$
2011-11-17 14:59:20 ----HD---- C:\WINDOWS\$NtUninstallKB2485376$
2011-11-17 14:59:20 ----HD---- C:\WINDOWS\$NtUninstallKB2483185$
2011-11-17 14:59:19 ----HD---- C:\WINDOWS\$NtUninstallKB2485663$
2011-11-17 14:59:18 ----HD---- C:\WINDOWS\$NtUninstallKB2503665$
2011-11-17 14:59:18 ----HD---- C:\WINDOWS\$NtUninstallKB2503658$
2011-11-17 14:59:18 ----HD---- C:\WINDOWS\$NtUninstallKB2497640$
2011-11-17 14:59:17 ----HD---- C:\WINDOWS\$NtUninstallKB2507618$
2011-11-17 14:59:17 ----HD---- C:\WINDOWS\$NtUninstallKB2506223$
2011-11-17 14:59:17 ----HD---- C:\WINDOWS\$NtUninstallKB2506212$
2011-11-17 14:59:16 ----HD---- C:\WINDOWS\$NtUninstallKB2508429$
2011-11-17 14:59:16 ----HD---- C:\WINDOWS\$NtUninstallKB2508272$
2011-11-17 14:59:16 ----HD---- C:\WINDOWS\$NtUninstallKB2507938$
2011-11-17 14:59:15 ----HD---- C:\WINDOWS\$NtUninstallKB2524375$
2011-11-17 14:59:15 ----HD---- C:\WINDOWS\$NtUninstallKB2511455$
2011-11-17 14:59:15 ----HD---- C:\WINDOWS\$NtUninstallKB2510581$
2011-11-17 14:59:15 ----HD---- C:\WINDOWS\$NtUninstallKB2509553$
2011-11-17 14:59:14 ----HD---- C:\WINDOWS\$NtUninstallKB2541763$
2011-11-17 14:59:14 ----HD---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-11-17 14:59:14 ----HD---- C:\WINDOWS\$NtUninstallKB2536276$
2011-11-17 14:59:14 ----HD---- C:\WINDOWS\$NtUninstallKB2535512$
2011-11-17 14:59:13 ----HD---- C:\WINDOWS\$NtUninstallKB2562937$
2011-11-17 14:59:13 ----HD---- C:\WINDOWS\$NtUninstallKB2555917$
2011-11-17 14:59:13 ----HD---- C:\WINDOWS\$NtUninstallKB2544893$
2011-11-17 14:59:12 ----HD---- C:\WINDOWS\$NtUninstallKB2566454$
2011-11-17 14:59:12 ----HD---- C:\WINDOWS\$NtUninstallKB2564958$
2011-11-17 14:59:11 ----HD---- C:\WINDOWS\$NtUninstallKB2570791$
2011-11-17 14:59:11 ----HD---- C:\WINDOWS\$NtUninstallKB2570222$
2011-11-17 14:59:11 ----HD---- C:\WINDOWS\$NtUninstallKB2567680$
2011-11-17 14:59:11 ----HD---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-17 14:59:10 ----HD---- C:\WINDOWS\$NtUninstallKB2616676$
2011-11-17 14:59:10 ----HD---- C:\WINDOWS\$NtUninstallKB2607712$
2011-11-17 14:59:10 ----HD---- C:\WINDOWS\$NtUninstallKB2592799$
2011-11-17 14:59:10 ----HD---- C:\WINDOWS\$NtUninstallKB2570947$
2011-11-17 14:59:09 ----HD---- C:\WINDOWS\$NtUninstallKB923561$
2011-11-17 14:59:09 ----HD---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2011-11-17 14:59:08 ----HD---- C:\WINDOWS\$NtUninstallKB939683$
2011-11-17 14:59:08 ----HD---- C:\WINDOWS\$NtUninstallKB929399$
2011-11-17 14:59:08 ----HD---- C:\WINDOWS\$NtUninstallKB923561_0$
2011-11-17 14:59:07 ----HD---- C:\WINDOWS\$NtUninstallKB950762$
2011-11-17 14:59:07 ----HD---- C:\WINDOWS\$NtUninstallKB946648_0$
2011-11-17 14:59:07 ----HD---- C:\WINDOWS\$NtUninstallKB946648$
2011-11-17 14:59:07 ----HD---- C:\WINDOWS\$NtUninstallKB944338-v2$
2011-11-17 14:59:07 ----HD---- C:\WINDOWS\$NtUninstallKB941569$
2011-11-17 14:59:06 ----HD---- C:\WINDOWS\$NtUninstallKB950974_0$
2011-11-17 14:59:06 ----HD---- C:\WINDOWS\$NtUninstallKB950974$
2011-11-17 14:59:06 ----HD---- C:\WINDOWS\$NtUninstallKB950762_0$
2011-11-17 14:59:05 ----HD---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2011-11-17 14:59:05 ----HD---- C:\WINDOWS\$NtUninstallKB951376-v2$
2011-11-17 14:59:05 ----HD---- C:\WINDOWS\$NtUninstallKB951066_0$
2011-11-17 14:59:05 ----HD---- C:\WINDOWS\$NtUninstallKB951066$
2011-11-17 14:59:04 ----HD---- C:\WINDOWS\$NtUninstallKB951748_0$
2011-11-17 14:59:04 ----HD---- C:\WINDOWS\$NtUninstallKB951748$
2011-11-17 14:59:03 ----HD---- C:\WINDOWS\$NtUninstallKB952004$
2011-11-17 14:59:03 ----HD---- C:\WINDOWS\$NtUninstallKB951978$
2011-11-17 14:59:02 ----HD---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2011-11-17 14:59:02 ----HD---- C:\WINDOWS\$NtUninstallKB952004_0$
2011-11-17 14:59:01 ----HD---- C:\WINDOWS\$NtUninstallKB952954_0$
2011-11-17 14:59:01 ----HD---- C:\WINDOWS\$NtUninstallKB952954$
2011-11-17 14:59:01 ----HD---- C:\WINDOWS\$NtUninstallKB952287_0$
2011-11-17 14:59:01 ----HD---- C:\WINDOWS\$NtUninstallKB952287$
2011-11-17 14:59:00 ----HD---- C:\WINDOWS\$NtUninstallKB955069_0$
2011-11-17 14:59:00 ----HD---- C:\WINDOWS\$NtUninstallKB955069$
2011-11-17 14:59:00 ----HD---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2011-11-17 14:59:00 ----HD---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2011-11-17 14:58:59 ----HD---- C:\WINDOWS\$NtUninstallKB955759$
2011-11-17 14:58:58 ----HD---- C:\WINDOWS\$NtUninstallKB955759_0$
2011-11-17 14:58:57 ----HD---- C:\WINDOWS\$NtUninstallKB956572$
2011-11-17 14:58:56 ----HD---- C:\WINDOWS\$NtUninstallKB956802_0$
2011-11-17 14:58:56 ----HD---- C:\WINDOWS\$NtUninstallKB956802$
2011-11-17 14:58:56 ----HD---- C:\WINDOWS\$NtUninstallKB956744$
2011-11-17 14:58:56 ----HD---- C:\WINDOWS\$NtUninstallKB956572_0$
2011-11-17 14:58:55 ----HD---- C:\WINDOWS\$NtUninstallKB956844_0$
2011-11-17 14:58:55 ----HD---- C:\WINDOWS\$NtUninstallKB956844$
2011-11-17 14:58:55 ----HD---- C:\WINDOWS\$NtUninstallKB956803_0$
2011-11-17 14:58:55 ----HD---- C:\WINDOWS\$NtUninstallKB956803$
2011-11-17 14:58:54 ----HD---- C:\WINDOWS\$NtUninstallKB958644_0$
2011-11-17 14:58:54 ----HD---- C:\WINDOWS\$NtUninstallKB958644$
2011-11-17 14:58:54 ----HD---- C:\WINDOWS\$NtUninstallKB958470$
2011-11-17 14:58:54 ----HD---- C:\WINDOWS\$NtUninstallKB957097_0$
2011-11-17 14:58:54 ----HD---- C:\WINDOWS\$NtUninstallKB957097$
2011-11-17 14:58:53 ----HD---- C:\WINDOWS\$NtUninstallKB958869$
2011-11-17 14:58:53 ----HD---- C:\WINDOWS\$NtUninstallKB958687_0$
2011-11-17 14:58:53 ----HD---- C:\WINDOWS\$NtUninstallKB958687$
2011-11-17 14:58:52 ----HD---- C:\WINDOWS\$NtUninstallKB960803$
2011-11-17 14:58:52 ----HD---- C:\WINDOWS\$NtUninstallKB960225_0$
2011-11-17 14:58:52 ----HD---- C:\WINDOWS\$NtUninstallKB960225$
2011-11-17 14:58:52 ----HD---- C:\WINDOWS\$NtUninstallKB959426_0$
2011-11-17 14:58:52 ----HD---- C:\WINDOWS\$NtUninstallKB959426$
2011-11-17 14:58:51 ----HD---- C:\WINDOWS\$NtUninstallKB961501$
2011-11-17 14:58:51 ----HD---- C:\WINDOWS\$NtUninstallKB961118$
2011-11-17 14:58:51 ----HD---- C:\WINDOWS\$NtUninstallKB960859_0$
2011-11-17 14:58:51 ----HD---- C:\WINDOWS\$NtUninstallKB960859$
2011-11-17 14:58:51 ----HD---- C:\WINDOWS\$NtUninstallKB960803_0$
2011-11-17 14:58:50 ----HD---- C:\WINDOWS\$NtUninstallKB961501_0$
2011-11-17 14:58:48 ----HD---- C:\WINDOWS\$NtUninstallKB967715_0$
2011-11-17 14:58:48 ----HD---- C:\WINDOWS\$NtUninstallKB967715$
2011-11-17 14:58:47 ----HD---- C:\WINDOWS\$NtUninstallKB968389$
2011-11-17 14:58:46 ----HD---- C:\WINDOWS\$NtUninstallKB969059$
2011-11-17 14:58:46 ----HD---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2011-11-17 14:58:46 ----HD---- C:\WINDOWS\$NtUninstallKB968389_0$
2011-11-17 14:58:45 ----HD---- C:\WINDOWS\$NtUninstallKB969947$
2011-11-17 14:58:45 ----HD---- C:\WINDOWS\$NtUninstallKB969059_0$
2011-11-17 14:58:44 ----HD---- C:\WINDOWS\$NtUninstallKB970430$
2011-11-17 14:58:44 ----HD---- C:\WINDOWS\$NtUninstallKB970238_0$
2011-11-17 14:58:44 ----HD---- C:\WINDOWS\$NtUninstallKB970238$
2011-11-17 14:58:44 ----HD---- C:\WINDOWS\$NtUninstallKB969947_0$
2011-11-17 14:58:43 ----HD---- C:\WINDOWS\$NtUninstallKB971029$
2011-11-17 14:58:42 ----HD---- C:\WINDOWS\$NtUninstallKB971468$
2011-11-17 14:58:42 ----HD---- C:\WINDOWS\$NtUninstallKB971032$
2011-11-17 14:58:41 ----HD---- C:\WINDOWS\$NtUninstallKB971486$
2011-11-17 14:58:40 ----HD---- C:\WINDOWS\$NtUninstallKB971557$
2011-11-17 14:58:40 ----HD---- C:\WINDOWS\$NtUninstallKB971486_0$
2011-11-17 14:58:39 ----HD---- C:\WINDOWS\$NtUninstallKB971633_0$
2011-11-17 14:58:39 ----HD---- C:\WINDOWS\$NtUninstallKB971633$
2011-11-17 14:58:39 ----HD---- C:\WINDOWS\$NtUninstallKB971557_0$
2011-11-17 14:58:38 ----HD---- C:\WINDOWS\$NtUninstallKB972270$
2011-11-17 14:58:38 ----HD---- C:\WINDOWS\$NtUninstallKB971961$
2011-11-17 14:58:38 ----HD---- C:\WINDOWS\$NtUninstallKB971737$
2011-11-17 14:58:38 ----HD---- C:\WINDOWS\$NtUninstallKB971657_0$
2011-11-17 14:58:38 ----HD---- C:\WINDOWS\$NtUninstallKB971657$
2011-11-17 14:58:37 ----HD---- C:\WINDOWS\$NtUninstallKB973507$
2011-11-17 14:58:37 ----HD---- C:\WINDOWS\$NtUninstallKB973354_0$
2011-11-17 14:58:37 ----HD---- C:\WINDOWS\$NtUninstallKB973354$
2011-11-17 14:58:37 ----HD---- C:\WINDOWS\$NtUninstallKB972270_0$
2011-11-17 14:58:36 ----HD---- C:\WINDOWS\$NtUninstallKB973525$
2011-11-17 14:58:36 ----HD---- C:\WINDOWS\$NtUninstallKB973507_0$
2011-11-17 14:58:35 ----HD---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2011-11-17 14:58:34 ----HD---- C:\WINDOWS\$NtUninstallKB973687$
2011-11-17 14:58:34 ----HD---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2011-11-17 14:58:33 ----HD---- C:\WINDOWS\$NtUninstallKB973815_0$
2011-11-17 14:58:33 ----HD---- C:\WINDOWS\$NtUninstallKB973815$
2011-11-17 14:58:33 ----HD---- C:\WINDOWS\$NtUninstallKB973687_1$
2011-11-17 14:58:33 ----HD---- C:\WINDOWS\$NtUninstallKB973687_0$
2011-11-17 14:58:32 ----HD---- C:\WINDOWS\$NtUninstallKB973869_0$
2011-11-17 14:58:32 ----HD---- C:\WINDOWS\$NtUninstallKB973869$
2011-11-17 14:58:31 ----HD---- C:\WINDOWS\$NtUninstallKB974318$
2011-11-17 14:58:31 ----HD---- C:\WINDOWS\$NtUninstallKB974112_0$
2011-11-17 14:58:31 ----HD---- C:\WINDOWS\$NtUninstallKB974112$
2011-11-17 14:58:31 ----HD---- C:\WINDOWS\$NtUninstallKB973904$
2011-11-17 14:58:30 ----HD---- C:\WINDOWS\$NtUninstallKB974571_0$
2011-11-17 14:58:30 ----HD---- C:\WINDOWS\$NtUninstallKB974571$
2011-11-17 14:58:30 ----HD---- C:\WINDOWS\$NtUninstallKB974392_0$
2011-11-17 14:58:30 ----HD---- C:\WINDOWS\$NtUninstallKB974392$
2011-11-17 14:58:30 ----HD---- C:\WINDOWS\$NtUninstallKB974318_0$
2011-11-17 14:58:29 ----HD---- C:\WINDOWS\$NtUninstallKB975467$
2011-11-17 14:58:29 ----HD---- C:\WINDOWS\$NtUninstallKB975025_0$
2011-11-17 14:58:29 ----HD---- C:\WINDOWS\$NtUninstallKB975025$
2011-11-17 14:58:28 ----HD---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2011-11-17 14:58:28 ----HD---- C:\WINDOWS\$NtUninstallKB975467_0$
2011-11-17 14:58:27 ----HD---- C:\WINDOWS\$NtUninstallKB975713$
2011-11-17 14:58:27 ----HD---- C:\WINDOWS\$NtUninstallKB975562$
2011-11-17 14:58:27 ----HD---- C:\WINDOWS\$NtUninstallKB975561$
2011-11-17 14:58:27 ----HD---- C:\WINDOWS\$NtUninstallKB975560$
2011-11-17 14:58:26 ----HD---- C:\WINDOWS\$NtUninstallKB976325$
2011-11-17 14:58:26 ----HD---- C:\WINDOWS\$NtUninstallKB976098-v2$
2011-11-17 14:58:23 ----HD---- C:\WINDOWS\$NtUninstallKB977165$
2011-11-17 14:58:23 ----HD---- C:\WINDOWS\$NtUninstallKB976325_0$
2011-11-17 14:58:22 ----HD---- C:\WINDOWS\$NtUninstallKB978037$
2011-11-17 14:58:22 ----HD---- C:\WINDOWS\$NtUninstallKB977914$
2011-11-17 14:58:22 ----HD---- C:\WINDOWS\$NtUninstallKB977816$
2011-11-17 14:58:21 ----HD---- C:\WINDOWS\$NtUninstallKB978542$
2011-11-17 14:58:21 ----HD---- C:\WINDOWS\$NtUninstallKB978338$
2011-11-17 14:58:21 ----HD---- C:\WINDOWS\$NtUninstallKB978262$
2011-11-17 14:58:21 ----HD---- C:\WINDOWS\$NtUninstallKB978251$
2011-11-17 14:58:20 ----HD---- C:\WINDOWS\$NtUninstallKB978706$
2011-11-17 14:58:20 ----HD---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2011-11-17 14:58:20 ----HD---- C:\WINDOWS\$NtUninstallKB978601$
2011-11-17 14:58:19 ----HD---- C:\WINDOWS\$NtUninstallKB979559$
2011-11-17 14:58:19 ----HD---- C:\WINDOWS\$NtUninstallKB979482$
2011-11-17 14:58:19 ----HD---- C:\WINDOWS\$NtUninstallKB979309$
2011-11-17 14:58:19 ----HD---- C:\WINDOWS\$NtUninstallKB979306$
2011-11-17 14:58:17 ----HD---- C:\WINDOWS\$NtUninstallKB979687$
2011-11-17 14:58:17 ----HD---- C:\WINDOWS\$NtUninstallKB979683$
2011-11-17 14:58:16 ----HD---- C:\WINDOWS\$NtUninstallKB980232$
2011-11-17 14:58:16 ----HD---- C:\WINDOWS\$NtUninstallKB980218$
2011-11-17 14:58:16 ----HD---- C:\WINDOWS\$NtUninstallKB980195$
2011-11-17 14:58:16 ----HD---- C:\WINDOWS\$NtUninstallKB980182$
2011-11-17 14:58:15 ----HD---- C:\WINDOWS\$NtUninstallKB981793$
2011-11-17 14:58:15 ----HD---- C:\WINDOWS\$NtUninstallKB981349$
2011-11-17 14:58:15 ----HD---- C:\WINDOWS\$NtUninstallKB981322$
2011-11-17 14:58:15 ----HD---- C:\WINDOWS\$NtUninstallKB980436$
2011-11-17 14:58:13 ----HD---- C:\WINDOWS\$NtUninstallKB981957$
2011-11-17 14:58:13 ----HD---- C:\WINDOWS\$NtUninstallKB981852$
2011-11-17 14:58:12 ----HD---- C:\WINDOWS\$NtUninstallKB982214$
2011-11-17 14:58:12 ----HD---- C:\WINDOWS\$NtUninstallKB982132$
2011-11-17 14:58:12 ----HD---- C:\WINDOWS\$NtUninstallKB981997$
2011-11-17 14:58:11 ----HD---- C:\WINDOWS\$NtUninstallKB982665$
2011-11-17 14:58:11 ----HD---- C:\WINDOWS\$NtUninstallKB982381$
2011-11-17 14:58:10 ----HD---- C:\WINDOWS\$NtUninstallKB982802$
2011-11-17 14:58:10 ----HD---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2011-10-28 13:41:33 ----D---- C:\Program Files\Xenocode
2011-10-28 13:29:57 ----D---- C:\Program Files\High Quality Photo Resizer
2011-10-24 18:16:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\Installations

======List of files/folders modified in the last 1 month======

2011-11-17 16:57:41 ----D---- C:\WINDOWS\Prefetch
2011-11-17 16:57:32 ----RD---- C:\Program Files
2011-11-17 16:57:03 ----D---- C:\WINDOWS\Temp
2011-11-17 16:53:38 ----D---- C:\WINDOWS\system32
2011-11-17 16:53:38 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-11-17 16:51:44 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-11-17 16:51:34 ----D---- C:\WINDOWS\system32\CatRoot2
2011-11-17 16:49:19 ----AD---- C:\WINDOWS
2011-11-17 16:49:08 ----A---- C:\Documents and Settings\All Users\Data aplikací\HPWALog.txt
2011-11-17 16:48:25 ----D---- C:\WINDOWS\system32\drivers
2011-11-17 16:48:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-11-17 16:45:55 ----D---- C:\WINDOWS\system32\CatRoot
2011-11-17 16:45:36 ----HD---- C:\WINDOWS\inf
2011-11-17 16:45:11 ----D---- C:\Documents and Settings\Kincl\Data aplikací\Mozilla
2011-11-17 16:44:49 ----D---- C:\Program Files\Mozilla Firefox
2011-11-17 16:40:47 ----D---- C:\Program Files\PC Tools Firewall Plus
2011-11-17 16:40:47 ----D---- C:\Program Files\Common Files
2011-11-17 16:40:06 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-11-17 15:15:50 ----D---- C:\WINDOWS\Debug
2011-11-17 15:15:44 ----A---- C:\WINDOWS\system32\MRT.exe
2011-11-17 15:10:58 ----D---- C:\Program Files\LSI SoftModem
2011-11-17 15:10:58 ----D---- C:\Program Files\Common Files\LightScribe
2011-11-17 15:07:47 ----RSD---- C:\WINDOWS\assembly
2011-11-17 15:04:04 ----D---- C:\WINDOWS\system32\config
2011-11-17 15:03:47 ----D---- C:\WINDOWS\system32\wbem
2011-11-17 15:03:45 ----D---- C:\WINDOWS\Registration
2011-11-17 14:57:51 ----D---- C:\WINDOWS\system32\LogFiles
2011-11-17 14:50:28 ----D---- C:\WINDOWS\Minidump
2011-11-11 15:58:31 ----HD---- C:\WINDOWS\$hf_mig$
2011-11-01 12:13:25 ----SHD---- C:\WINDOWS\Installer
2011-11-01 12:12:38 ----HD---- C:\Config.Msi
2011-11-01 08:06:47 ----SHD---- C:\System Volume Information
2011-10-23 09:26:15 ----D---- C:\WINDOWS\Microsoft.NET

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R2 LF30FS;LF30FS; \??\C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys []
R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2009-02-18 113536]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2008-10-29 1204128]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-03-18 103744]
R3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2009-01-14 534568]
R3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2009-01-14 37160]
R3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2009-01-14 991656]
R3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2009-01-14 156816]
R3 btwmodem;Modem Bluetooth; C:\WINDOWS\system32\DRIVERS\btwmodem.sys [2009-01-14 37032]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2009-01-14 47272]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2009-03-19 9216]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-01-21 6278560]
R3 NETw5x32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2009-03-04 4202496]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2009-07-02 1765168]
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-03-30 1550891]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-07-29 213680]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2009-07-17 297728]
S2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\WINDOWS\system32\DRIVERS\ewusbnet.sys [2009-07-23 112640]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2004-02-04 24177]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2004-02-04 57372]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HpqKbFiltr;HpqKbFilter Driver; C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102528]
S3 hwusbfake;Huawei DataCard USB Fake; C:\WINDOWS\system32\DRIVERS\ewusbfake.sys [2009-07-23 100480]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-09-06 44768]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 17 Lis 2011 17:28

Zdravim a pekny vecer preji

Kde Avast hlasi havet

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

Utilitu spustte a prikazte ji, at skenuje - klik na Start Scan
Pokud utilita najde infikekci, bude ji chtit lecit (Cure), povolte leceni kliknutim na Continue
Pokud utilita najde podezrely soubor (suspicious), bude jej chtit preskocit (Skip), povolte preskoceni kliknutim na Continue
Po dokonceni skenu bude mozna nutny restart PC, povolte jej kliknutim na Reboot now
Po restartu na Vas vyskoci log, pokud se tak nestane, najdete jej primo na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt - jeho obsah sem vlozte
Pokud restart nebude vyzadovan, kliknete na Close a nasledne na Report - vytvori se log - jeho obsah sem vlozte

Fugass · #3 Příspěvek od **Fugass** » 17 Lis 2011 17:52

Většinou hlásí havěť ve windows/system32

17:43:13.0484 3320 TDSS rootkit removing tool 2.6.19.0 Nov 16 2011 12:18:50
17:43:15.0500 3320 ============================================================
17:43:15.0500 3320 Current date / time: 2011/11/17 17:43:15.0500
17:43:15.0500 3320 SystemInfo:
17:43:15.0500 3320
17:43:15.0500 3320 OS Version: 5.1.2600 ServicePack: 3.0
17:43:15.0500 3320 Product type: Workstation
17:43:15.0500 3320 ComputerName: KOMAR
17:43:15.0500 3320 UserName: Kincl
17:43:15.0500 3320 Windows directory: C:\WINDOWS
17:43:15.0500 3320 System windows directory: C:\WINDOWS
17:43:15.0500 3320 Processor architecture: Intel x86
17:43:15.0500 3320 Number of processors: 2
17:43:15.0500 3320 Page size: 0x1000
17:43:15.0500 3320 Boot type: Normal boot
17:43:15.0500 3320 ============================================================
17:43:16.0921 3320 Initialize success
17:43:35.0421 3792 ============================================================
17:43:35.0421 3792 Scan started
17:43:35.0421 3792 Mode: Manual;
17:43:35.0421 3792 ============================================================
17:43:36.0203 3792 Aavmker4 (95d1de2a6613494e853a9738d5d9acd4) C:\WINDOWS\system32\drivers\Aavmker4.sys
17:43:36.0203 3792 Aavmker4 - ok
17:43:36.0218 3792 Abiosdsk - ok
17:43:36.0234 3792 abp480n5 - ok
17:43:36.0265 3792 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:43:36.0281 3792 ACPI - ok
17:43:36.0312 3792 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
17:43:36.0312 3792 ACPIEC - ok
17:43:36.0328 3792 adpu160m - ok
17:43:36.0359 3792 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:43:36.0375 3792 aec - ok
17:43:36.0406 3792 AESTAud (9277c31f1b10ea626c5ea06c5e73b04d) C:\WINDOWS\system32\drivers\AESTAud.sys
17:43:36.0421 3792 AESTAud - ok
17:43:36.0453 3792 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
17:43:36.0468 3792 AFD - ok
17:43:36.0531 3792 AgereSoftModem (35c391e40471a0b479328fc7b1b5f40f) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
17:43:36.0546 3792 AgereSoftModem - ok
17:43:36.0671 3792 Aha154x - ok
17:43:36.0687 3792 aic78u2 - ok
17:43:36.0703 3792 aic78xx - ok
17:43:36.0718 3792 AliIde - ok
17:43:36.0734 3792 amsint - ok
17:43:36.0781 3792 AnyDVD (6ddda7f2deabf1e80acee14fe85c1d4f) C:\WINDOWS\system32\Drivers\AnyDVD.sys
17:43:36.0796 3792 AnyDVD - ok
17:43:36.0812 3792 asc - ok
17:43:36.0828 3792 asc3350p - ok
17:43:36.0843 3792 asc3550 - ok
17:43:36.0890 3792 aswFsBlk (c47623ffd181a1e7d63574dde2a0a711) C:\WINDOWS\system32\drivers\aswFsBlk.sys
17:43:36.0890 3792 aswFsBlk - ok
17:43:36.0906 3792 aswMon2 (fff2dbb17a3c89f87f78d5fa72ca47fd) C:\WINDOWS\system32\drivers\aswMon2.sys
17:43:36.0906 3792 aswMon2 - ok
17:43:36.0937 3792 aswRdr (36239e24470a3dd81fae37510953cc6c) C:\WINDOWS\system32\drivers\aswRdr.sys
17:43:36.0937 3792 aswRdr - ok
17:43:37.0000 3792 aswSnx (caa846e9c83836bdc3d2d700c678db65) C:\WINDOWS\system32\drivers\aswSnx.sys
17:43:37.0015 3792 aswSnx - ok
17:43:37.0046 3792 aswSP (748ae7f2d7da33adb063fe05704a9969) C:\WINDOWS\system32\drivers\aswSP.sys
17:43:37.0046 3792 aswSP - ok
17:43:37.0062 3792 aswTdi (ca9925ce1dbd07ffe1eb357752cf5577) C:\WINDOWS\system32\drivers\aswTdi.sys
17:43:37.0062 3792 aswTdi - ok
17:43:37.0109 3792 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:43:37.0109 3792 AsyncMac - ok
17:43:37.0140 3792 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:43:37.0140 3792 atapi - ok
17:43:37.0250 3792 Atdisk - ok
17:43:37.0281 3792 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:43:37.0281 3792 Atmarpc - ok
17:43:37.0328 3792 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:43:37.0343 3792 audstub - ok
17:43:37.0390 3792 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:43:37.0406 3792 Beep - ok
17:43:37.0468 3792 btaudio (4b43dfe1c1fbb305a1dc5504ef9bb34e) C:\WINDOWS\system32\drivers\btaudio.sys
17:43:37.0484 3792 btaudio - ok
17:43:37.0500 3792 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
17:43:37.0500 3792 BTDriver - ok
17:43:37.0546 3792 BTKRNL (ed0bd05be3c494a8fec0674880d5bc4d) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
17:43:37.0562 3792 BTKRNL - ok
17:43:37.0687 3792 BTWDNDIS (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
17:43:37.0687 3792 BTWDNDIS - ok
17:43:37.0718 3792 btwmodem (5922bae0cd84924b9cd7e6bb515ee070) C:\WINDOWS\system32\DRIVERS\btwmodem.sys
17:43:37.0734 3792 btwmodem - ok
17:43:37.0765 3792 BTWUSB (6b622612fe21b59faee2ca4385959778) C:\WINDOWS\system32\Drivers\btwusb.sys
17:43:37.0765 3792 BTWUSB - ok
17:43:37.0812 3792 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:43:37.0812 3792 cbidf2k - ok
17:43:37.0843 3792 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:43:37.0859 3792 CCDECODE - ok
17:43:37.0859 3792 cd20xrnt - ok
17:43:37.0890 3792 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:43:37.0890 3792 Cdaudio - ok
17:43:37.0921 3792 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:43:37.0921 3792 Cdfs - ok
17:43:37.0968 3792 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:43:37.0968 3792 Cdrom - ok
17:43:37.0984 3792 Changer - ok
17:43:38.0000 3792 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
17:43:38.0015 3792 CmBatt - ok
17:43:38.0015 3792 CmdIde - ok
17:43:38.0031 3792 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
17:43:38.0031 3792 Compbatt - ok
17:43:38.0062 3792 Cpqarray - ok
17:43:38.0078 3792 dac2w2k - ok
17:43:38.0093 3792 dac960nt - ok
17:43:38.0109 3792 DgiVecp - ok
17:43:38.0125 3792 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:43:38.0125 3792 Disk - ok
17:43:38.0171 3792 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
17:43:38.0187 3792 dmboot - ok
17:43:38.0296 3792 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
17:43:38.0296 3792 dmio - ok
17:43:38.0312 3792 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:43:38.0312 3792 dmload - ok
17:43:38.0343 3792 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:43:38.0359 3792 DMusic - ok
17:43:38.0500 3792 dpti2o - ok
17:43:38.0640 3792 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:43:38.0640 3792 drmkaud - ok
17:43:38.0671 3792 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) C:\WINDOWS\system32\Drivers\ElbyCDFL.sys
17:43:38.0687 3792 ElbyCDFL - ok
17:43:38.0703 3792 ElbyCDIO (178cc9403816c082d22a1d47fa1f9c85) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
17:43:38.0718 3792 ElbyCDIO - ok
17:43:38.0765 3792 ewusbnet (9032405f762f1afa92dfef99cb078306) C:\WINDOWS\system32\DRIVERS\ewusbnet.sys
17:43:38.0765 3792 ewusbnet - ok
17:43:38.0812 3792 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:43:38.0828 3792 Fastfat - ok
17:43:38.0843 3792 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
17:43:38.0843 3792 Fdc - ok
17:43:38.0875 3792 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
17:43:38.0875 3792 Fips - ok
17:43:38.0890 3792 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
17:43:38.0890 3792 Flpydisk - ok
17:43:38.0921 3792 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
17:43:38.0921 3792 FltMgr - ok
17:43:38.0968 3792 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:43:38.0984 3792 Fs_Rec - ok
17:43:39.0109 3792 FTDIBUS (f5475f8a28c2d67cdfe927db40c843fa) C:\WINDOWS\system32\drivers\ftdibus.sys
17:43:39.0109 3792 FTDIBUS - ok
17:43:39.0125 3792 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:43:39.0140 3792 Ftdisk - ok
17:43:39.0156 3792 FTSER2K (f415747e671198b4a39bdb2634f47917) C:\WINDOWS\system32\drivers\ftser2k.sys
17:43:39.0156 3792 FTSER2K - ok
17:43:39.0187 3792 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:43:39.0187 3792 Gpc - ok
17:43:39.0234 3792 HBtnKey (fc657b7751729efe54e2ff24f50e5bab) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
17:43:39.0234 3792 HBtnKey - ok
17:43:39.0265 3792 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:43:39.0265 3792 HDAudBus - ok
17:43:39.0328 3792 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:43:39.0328 3792 HidUsb - ok
17:43:39.0359 3792 hpn - ok
17:43:39.0390 3792 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
17:43:39.0390 3792 HpqKbFiltr - ok
17:43:39.0437 3792 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
17:43:39.0453 3792 HTTP - ok
17:43:39.0500 3792 hwdatacard (60aec3f4ec355d9f46d545a0fa08ce87) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
17:43:39.0515 3792 hwdatacard - ok
17:43:39.0656 3792 hwusbfake (b93d3c81ef1d372dc5bd5e6275362e1a) C:\WINDOWS\system32\DRIVERS\ewusbfake.sys
17:43:39.0656 3792 hwusbfake - ok
17:43:39.0671 3792 i2omgmt - ok
17:43:39.0687 3792 i2omp - ok
17:43:39.0703 3792 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:43:39.0718 3792 i8042prt - ok
17:43:39.0906 3792 ialm (3b743262b6456167888d15f1121b3bf7) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
17:43:39.0984 3792 ialm - ok
17:43:40.0125 3792 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:43:40.0125 3792 Imapi - ok
17:43:40.0140 3792 ini910u - ok
17:43:40.0140 3792 IntelIde - ok
17:43:40.0156 3792 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:43:40.0171 3792 intelppm - ok
17:43:40.0187 3792 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
17:43:40.0187 3792 Ip6Fw - ok
17:43:40.0203 3792 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:43:40.0203 3792 IpFilterDriver - ok
17:43:40.0218 3792 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:43:40.0218 3792 IpInIp - ok
17:43:40.0250 3792 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:43:40.0250 3792 IpNat - ok
17:43:40.0265 3792 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:43:40.0265 3792 IPSec - ok
17:43:40.0281 3792 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:43:40.0281 3792 IRENUM - ok
17:43:40.0312 3792 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:43:40.0312 3792 isapnp - ok
17:43:40.0359 3792 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:43:40.0359 3792 Kbdclass - ok
17:43:40.0375 3792 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:43:40.0375 3792 kbdhid - ok
17:43:40.0406 3792 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:43:40.0406 3792 kmixer - ok
17:43:40.0421 3792 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:43:40.0437 3792 KSecDD - ok
17:43:40.0437 3792 lbrtfdc - ok
17:43:40.0515 3792 LF30FS (10e0d92e5b21c045e0a53befb71dc09d) C:\Program Files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys
17:43:40.0515 3792 LF30FS - ok
17:43:40.0656 3792 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:43:40.0671 3792 mnmdd - ok
17:43:40.0687 3792 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
17:43:40.0703 3792 Modem - ok
17:43:40.0734 3792 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:43:40.0734 3792 Mouclass - ok
17:43:40.0765 3792 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:43:40.0781 3792 mouhid - ok
17:43:40.0796 3792 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:43:40.0812 3792 MountMgr - ok
17:43:40.0812 3792 mraid35x - ok
17:43:40.0843 3792 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:43:40.0843 3792 MRxDAV - ok
17:43:40.0906 3792 MRxSmb (5eaf5f906278f476330258f2e24fabd9) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:43:40.0906 3792 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\mrxsmb.sys. Real md5: 5eaf5f906278f476330258f2e24fabd9, Fake md5: 7d304a5eb4344ebeeab53a2fe3ffb9f0
17:43:40.0921 3792 MRxSmb ( Rootkit.Win32.ZAccess.aml ) - infected
17:43:40.0921 3792 MRxSmb - detected Rootkit.Win32.ZAccess.aml (0)
17:43:40.0953 3792 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:43:40.0953 3792 Msfs - ok
17:43:40.0984 3792 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:43:41.0000 3792 MSKSSRV - ok
17:43:41.0125 3792 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:43:41.0140 3792 MSPCLOCK - ok
17:43:41.0140 3792 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:43:41.0156 3792 MSPQM - ok
17:43:41.0187 3792 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:43:41.0187 3792 mssmbios - ok
17:43:41.0203 3792 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
17:43:41.0218 3792 MSTEE - ok
17:43:41.0234 3792 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
17:43:41.0250 3792 Mup - ok
17:43:41.0265 3792 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:43:41.0281 3792 NABTSFEC - ok
17:43:41.0296 3792 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:43:41.0312 3792 NDIS - ok
17:43:41.0343 3792 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:43:41.0343 3792 NdisIP - ok
17:43:41.0390 3792 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:43:41.0406 3792 NdisTapi - ok
17:43:41.0421 3792 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:43:41.0421 3792 Ndisuio - ok
17:43:41.0453 3792 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:43:41.0453 3792 NdisWan - ok
17:43:41.0484 3792 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
17:43:41.0500 3792 NDProxy - ok
17:43:41.0500 3792 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:43:41.0515 3792 NetBIOS - ok
17:43:41.0546 3792 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:43:41.0546 3792 NetBT - ok
17:43:41.0718 3792 NETw5x32 (ccdb8db66acd3c0a6c8e171b79f60ac4) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
17:43:41.0781 3792 NETw5x32 - ok
17:43:41.0921 3792 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:43:41.0937 3792 Npfs - ok
17:43:41.0953 3792 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:43:41.0984 3792 Ntfs - ok
17:43:42.0031 3792 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:43:42.0031 3792 Null - ok
17:43:42.0062 3792 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:43:42.0062 3792 NwlnkFlt - ok
17:43:42.0093 3792 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:43:42.0093 3792 NwlnkFwd - ok
17:43:42.0125 3792 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\drivers\Parport.sys
17:43:42.0125 3792 Parport - ok
17:43:42.0140 3792 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:43:42.0156 3792 PartMgr - ok
17:43:42.0171 3792 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
17:43:42.0187 3792 ParVdm - ok
17:43:42.0203 3792 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
17:43:42.0218 3792 PCI - ok
17:43:42.0234 3792 PCIDump - ok
17:43:42.0250 3792 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:43:42.0250 3792 PCIIde - ok
17:43:42.0281 3792 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:43:42.0296 3792 Pcmcia - ok
17:43:42.0312 3792 PDCOMP - ok
17:43:42.0312 3792 PDFRAME - ok
17:43:42.0328 3792 PDRELI - ok
17:43:42.0343 3792 PDRFRAME - ok
17:43:42.0359 3792 perc2 - ok
17:43:42.0375 3792 perc2hib - ok
17:43:42.0421 3792 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:43:42.0437 3792 PptpMiniport - ok
17:43:42.0484 3792 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:43:42.0484 3792 PSched - ok
17:43:42.0500 3792 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:43:42.0500 3792 Ptilink - ok
17:43:42.0500 3792 ql1080 - ok
17:43:42.0515 3792 Ql10wnt - ok
17:43:42.0531 3792 ql12160 - ok
17:43:42.0531 3792 ql1240 - ok
17:43:42.0546 3792 ql1280 - ok
17:43:42.0562 3792 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:43:42.0562 3792 RasAcd - ok
17:43:42.0625 3792 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:43:42.0625 3792 Rasl2tp - ok
17:43:42.0640 3792 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:43:42.0640 3792 RasPppoe - ok
17:43:42.0656 3792 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:43:42.0656 3792 Raspti - ok
17:43:42.0671 3792 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:43:42.0671 3792 Rdbss - ok
17:43:42.0718 3792 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:43:42.0718 3792 RDPCDD - ok
17:43:42.0734 3792 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:43:42.0750 3792 rdpdr - ok
17:43:42.0781 3792 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
17:43:42.0781 3792 RDPWD - ok
17:43:42.0812 3792 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:43:42.0812 3792 redbook - ok
17:43:42.0859 3792 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:43:42.0859 3792 Secdrv - ok
17:43:42.0875 3792 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:43:42.0875 3792 Serenum - ok
17:43:42.0906 3792 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\drivers\Serial.sys
17:43:42.0921 3792 Serial - ok
17:43:42.0937 3792 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:43:42.0937 3792 Sfloppy - ok
17:43:42.0953 3792 Simbad - ok
17:43:42.0968 3792 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:43:42.0984 3792 SLIP - ok
17:43:43.0109 3792 SNP2UVC (d8aba1293b82e7af2f78b67ca46fcb3d) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
17:43:43.0140 3792 SNP2UVC - ok
17:43:43.0187 3792 Sparrow - ok
17:43:43.0234 3792 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:43:43.0234 3792 splitter - ok
17:43:43.0265 3792 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
17:43:43.0281 3792 sr - ok
17:43:43.0328 3792 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
17:43:43.0343 3792 Srv - ok
17:43:43.0359 3792 SSPORT - ok
17:43:43.0437 3792 STHDA (dc3489f1ef71ad75b34740d0e6979187) C:\WINDOWS\system32\drivers\sthda.sys
17:43:43.0468 3792 STHDA - ok
17:43:43.0546 3792 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:43:43.0546 3792 streamip - ok
17:43:43.0562 3792 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:43:43.0578 3792 swenum - ok
17:43:43.0593 3792 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:43:43.0609 3792 swmidi - ok
17:43:43.0625 3792 symc810 - ok
17:43:43.0640 3792 symc8xx - ok
17:43:43.0656 3792 sym_hi - ok
17:43:43.0671 3792 sym_u3 - ok
17:43:43.0718 3792 SynTP (1de40024679cde0e573465253519730e) C:\WINDOWS\system32\DRIVERS\SynTP.sys
17:43:43.0734 3792 SynTP - ok
17:43:43.0812 3792 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:43:43.0812 3792 sysaudio - ok
17:43:43.0859 3792 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:43:43.0875 3792 Tcpip - ok
17:43:43.0890 3792 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:43:43.0906 3792 TDPIPE - ok
17:43:43.0906 3792 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:43:43.0921 3792 TDTCP - ok
17:43:43.0953 3792 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:43:43.0968 3792 TermDD - ok
17:43:43.0984 3792 TosIde - ok
17:43:44.0015 3792 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:43:44.0015 3792 Udfs - ok
17:43:44.0046 3792 ultra - ok
17:43:44.0062 3792 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:43:44.0078 3792 Update - ok
17:43:44.0109 3792 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:43:44.0125 3792 usbccgp - ok
17:43:44.0156 3792 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:43:44.0171 3792 usbehci - ok
17:43:44.0187 3792 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:43:44.0187 3792 usbhub - ok
17:43:44.0218 3792 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:43:44.0234 3792 usbprint - ok
17:43:44.0296 3792 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:43:44.0296 3792 USBSTOR - ok
17:43:44.0328 3792 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:43:44.0343 3792 usbuhci - ok
17:43:44.0375 3792 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
17:43:44.0390 3792 usbvideo - ok
17:43:44.0421 3792 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:43:44.0421 3792 VgaSave - ok
17:43:44.0437 3792 ViaIde - ok
17:43:44.0468 3792 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
17:43:44.0468 3792 VolSnap - ok
17:43:44.0546 3792 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:43:44.0562 3792 Wanarp - ok
17:43:44.0593 3792 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
17:43:44.0609 3792 Wdf01000 - ok
17:43:44.0625 3792 WDICA - ok
17:43:44.0656 3792 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:43:44.0656 3792 wdmaud - ok
17:43:44.0703 3792 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
17:43:44.0718 3792 WmiAcpi - ok
17:43:44.0765 3792 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
17:43:44.0781 3792 WpdUsb - ok
17:43:44.0843 3792 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:43:44.0859 3792 WSTCODEC - ok
17:43:44.0875 3792 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:43:44.0890 3792 WudfPf - ok
17:43:44.0906 3792 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:43:44.0921 3792 WudfRd - ok
17:43:44.0984 3792 yukonwxp (bdb2509bb037e1d15d1b3a63f5b77bb4) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
17:43:44.0984 3792 yukonwxp - ok
17:43:45.0031 3792 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
17:43:45.0171 3792 \Device\Harddisk0\DR0 - ok
17:43:45.0187 3792 Boot (0x1200) (06fec2b7de1b6872b9ab33308549b949) \Device\Harddisk0\DR0\Partition0
17:43:45.0187 3792 \Device\Harddisk0\DR0\Partition0 - ok
17:43:45.0203 3792 Boot (0x1200) (373fc88b55b1754b27b17d5d247a7c35) \Device\Harddisk0\DR0\Partition1
17:43:45.0203 3792 \Device\Harddisk0\DR0\Partition1 - ok
17:43:45.0218 3792 Boot (0x1200) (1ae92c738029aacde9690641d8c7757a) \Device\Harddisk0\DR0\Partition2
17:43:45.0218 3792 \Device\Harddisk0\DR0\Partition2 - ok
17:43:45.0218 3792 ============================================================
17:43:45.0218 3792 Scan finished
17:43:45.0218 3792 ============================================================
17:43:45.0218 0644 Detected object count: 1
17:43:45.0218 0644 Actual detected object count: 1
17:44:29.0031 0644 Backup copy found, using it..
17:44:29.0062 0644 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys - will be cured on reboot
17:44:30.0125 0644 C:\WINDOWS\system32\c_78682.nls - will be deleted on reboot
17:44:30.0843 0644 MRxSmb ( Rootkit.Win32.ZAccess.aml ) - User select action: Cure
17:44:37.0937 2316 Deinitialize success

#4 Příspěvek od **vyosek** » 17 Lis 2011 18:18

No mate\mel jste tam zhavou novinku a peknou mrchu

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jejna plochu.

Utilitu spustte a prikazte ji, at skenuje - klik na Scan
Kliknutim na Save log ulozte log aswMBR na plochu
Obsah logu aswMBR mi sem vlozte

Fugass · #5 Příspěvek od **Fugass** » 17 Lis 2011 18:35

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-17 18:29:28
-----------------------------
18:29:28.562 OS Version: Windows 5.1.2600 Service Pack 3
18:29:28.562 Number of processors: 2 586 0xF0D
18:29:28.562 ComputerName: KOMAR UserName: Kincl
18:29:29.421 Initialize success
18:29:29.671 AVAST engine defs: 11111702
18:29:49.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
18:29:49.453 Disk 0 Vendor: Hitachi_HTS723232L9A360 FC4OC60D Size: 305245MB BusType: 3
18:29:51.484 Disk 0 MBR read successfully
18:29:51.484 Disk 0 MBR scan
18:29:51.484 Disk 0 Windows XP default MBR code
18:29:51.484 Disk 0 scanning sectors +625121280
18:29:51.546 Disk 0 scanning C:\WINDOWS\system32\drivers
18:29:58.625 Service scanning
18:29:59.625 Modules scanning
18:30:03.187 Disk 0 trace - called modules:
18:30:03.203 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
18:30:03.218 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a48dab8]
18:30:03.218 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\0000007a[0x8a4bd9e8]
18:30:03.218 5 ACPI.sys[b9f69620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a4bdd98]
18:30:03.656 AVAST engine scan C:\WINDOWS
18:30:07.718 AVAST engine scan C:\WINDOWS\system32
18:31:31.125 AVAST engine scan C:\WINDOWS\system32\drivers
18:31:42.218 AVAST engine scan C:\Documents and Settings\Kincl
18:32:53.187 AVAST engine scan C:\Documents and Settings\All Users
18:32:57.031 File: C:\Documents and Settings\All Users\Data aplikací\Installations\{DB7AE42C-695D-4D36-A8FA-31A1C6454436}\Installer\CommonCustomActions\closeapp.exe **INFECTED** Win32:MalOb-EI [Cryp]
18:33:10.406 Scan finished successfully
18:33:24.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Kincl\Plocha\MBR.dat"
18:33:24.156 The log file has been saved successfully to "C:\Documents and Settings\Kincl\Plocha\aswMBR.txt"

#6 Příspěvek od **vyosek** » 17 Lis 2011 18:38

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

C:\Documents and Settings\Kincl\Plocha\MBR.dat
C:\Documents and Settings\All Users\Data aplikací\Installations\{DB7AE42C-695D-4D36-A8FA-31A1C6454436}\Installer\CommonCustomActions\closeapp.exe
Kliknete na Prochazet
Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
Kliknete na Send File
Pokud na Vas vyskoci obrazovka jako je nize, tak kliknete na ReAnalyse
Vysledek analyzy sem vlozte (jako odkaz)

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Fugass · #7 Příspěvek od **Fugass** » 17 Lis 2011 19:02

http://www.virustotal.com/file-scan/rep ... 1321552533

http://www.virustotal.com/file-scan/rep ... 1321551993

#8 Příspěvek od **vyosek** » 17 Lis 2011 20:06

Fajn, provedte ComboFix

Fugass · #9 Příspěvek od **Fugass** » 18 Lis 2011 17:29

ComboFix 11-11-18.02 - Kincl 18.11.2011 17:12:46.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3063.2675 [GMT 1:00]
Spuštěný z: c:\documents and settings\Kincl\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB13005$
c:\windows\$NtUninstallKB13005$\3485447400
c:\windows\$NtUninstallKB13005$\934476416\@
c:\windows\$NtUninstallKB13005$\934476416\L\qrnatgww
c:\windows\$NtUninstallKB13005$\934476416\loader.tlb
c:\windows\$NtUninstallKB13005$\934476416\U\@00000001
c:\windows\$NtUninstallKB13005$\934476416\U\@000000c0
c:\windows\$NtUninstallKB13005$\934476416\U\@000000cb
c:\windows\$NtUninstallKB13005$\934476416\U\@000000cf
c:\windows\$NtUninstallKB13005$\934476416\U\@80000000
c:\windows\$NtUninstallKB13005$\934476416\U\@800000c0
c:\windows\$NtUninstallKB13005$\934476416\U\@800000cb
c:\windows\$NtUninstallKB13005$\934476416\U\@800000cf
c:\windows\system32\
c:\windows\ydi.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-18 do 2011-11-18 )))))))))))))))))))))))))))))))
.
.
2011-11-18 06:45 . 2011-11-18 06:45 -------- d-----w- c:\program files\Marvell
2011-11-17 15:57 . 2011-11-17 15:57 -------- d-----w- c:\program files\trend micro
2011-11-17 15:57 . 2011-11-17 15:57 -------- d-----w- C:\rsit
2011-11-17 15:33 . 2011-09-06 21:45 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-17 14:03 . 2011-11-17 14:03 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-16 20:40 . 2011-11-17 14:44 -------- d-sh--w- c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80
2011-10-28 12:41 . 2011-10-28 12:41 -------- d-----w- c:\program files\Xenocode
2011-10-28 12:41 . 2011-10-28 12:41 -------- d-----w- c:\documents and settings\Kincl\Local Settings\Data aplikací\Xenocode
2011-10-28 12:29 . 2011-10-28 12:42 -------- d-----w- c:\program files\High Quality Photo Resizer
2011-10-24 17:16 . 2011-10-24 17:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-17 16:45 . 2006-10-20 21:33 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 14:22 . 2010-01-19 18:00 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2011-09-28 07:06 602112 ----a-w- c:\windows\system32\SET11B.tmp
2011-09-28 07:06 . 2004-08-17 13:49 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-25 14:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-25 14:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 2004-08-17 13:49 602112 ----a-w- c:\windows\system32\crypt32(3).dll
2011-09-06 20:45 . 2010-09-19 11:04 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:38 . 2011-08-09 11:12 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2010-09-19 11:04 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2010-09-19 11:04 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2010-09-19 11:04 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2010-09-19 11:04 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2010-09-19 11:04 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2010-09-19 11:04 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2010-09-19 11:04 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-06 14:10 . 2006-10-20 21:31 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-21 06:46 . 2011-05-20 19:50 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-05 07:07 . 2011-11-17 15:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-29 1545512]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-01-20 2052096]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AESTFltr]
2009-02-18 12:41 737280 ----a-w- c:\windows\system32\AESTFltr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 01:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-01-21 10:20 134656 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-01-21 10:18 134656 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2008-08-08 05:03 524288 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\Kincl\\Plocha\\RSIT.exe"=
"c:\\Documents and Settings\\Kincl\\Plocha\\tdsskiller.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9.8.2011 12:12 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19.9.2010 12:04 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.9.2010 12:04 20568]
R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys [19.11.2004 17:07 101488]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [20.1.2010 15:49 113536]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [27.6.2010 10:12 112640]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [28.6.2010 21:17 100480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 12:24 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Kincl\Data aplikací\Mozilla\Firefox\Profiles\0kceghcc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
SafeBoot-73159064.sys
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-18 17:21
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(956)
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(3840)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-11-18 17:24:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-18 16:24
.
Před spuštěním: Volných bajtů: 75 428 937 728
Po spuštění: Volných bajtů: 75 523 313 664
.
- - End Of File - - 710835CA74E82942924E704290C665F5

#10 Příspěvek od **vyosek** » 18 Lis 2011 19:49

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Folder::
c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Fugass · #11 Příspěvek od **Fugass** » 18 Lis 2011 22:11

ComboFix 11-11-18.02 - Kincl 18.11.2011 21:54:02.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3063.2523 [GMT 1:00]
Spuštěný z: c:\documents and settings\Kincl\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Kincl\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-18 do 2011-11-18 )))))))))))))))))))))))))))))))
.
.
2011-11-18 16:58 . 2011-11-18 16:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Office Genuine Advantage
2011-11-18 06:45 . 2011-11-18 06:45 -------- d-----w- c:\program files\Marvell
2011-11-17 15:57 . 2011-11-17 15:57 -------- d-----w- c:\program files\trend micro
2011-11-17 15:57 . 2011-11-17 15:57 -------- d-----w- C:\rsit
2011-11-17 15:33 . 2011-09-06 21:45 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-17 14:03 . 2011-11-17 14:03 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-16 20:40 . 2011-11-17 14:44 -------- d-sh--w- c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80
2011-10-28 12:41 . 2011-10-28 12:41 -------- d-----w- c:\program files\Xenocode
2011-10-28 12:41 . 2011-10-28 12:41 -------- d-----w- c:\documents and settings\Kincl\Local Settings\Data aplikací\Xenocode
2011-10-28 12:29 . 2011-10-28 12:42 -------- d-----w- c:\program files\High Quality Photo Resizer
2011-10-24 17:16 . 2011-10-24 17:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-17 16:45 . 2006-10-20 21:33 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 14:22 . 2010-01-19 18:00 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2011-09-28 07:06 602112 ----a-w- c:\windows\system32\SET11B.tmp
2011-09-28 07:06 . 2004-08-17 13:49 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-25 14:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-25 14:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 2004-08-17 13:49 602112 ----a-w- c:\windows\system32\crypt32(3).dll
2011-09-06 20:45 . 2010-09-19 11:04 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:38 . 2011-08-09 11:12 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2010-09-19 11:04 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2010-09-19 11:04 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2010-09-19 11:04 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2010-09-19 11:04 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2010-09-19 11:04 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2010-09-19 11:04 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2010-09-19 11:04 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-06 14:10 . 2006-10-20 21:31 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-21 06:46 . 2011-05-20 19:50 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-05 07:07 . 2011-11-17 15:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-18_16.22.01 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-10-25 14:00 . 2011-11-18 16:23 73996 c:\windows\system32\perfc009.dat
+ 2001-10-25 14:00 . 2011-11-18 17:04 73996 c:\windows\system32\perfc009.dat
- 2001-10-25 14:00 . 2011-11-18 16:23 85120 c:\windows\system32\perfc005.dat
+ 2001-10-25 14:00 . 2011-11-18 17:04 85120 c:\windows\system32\perfc005.dat
+ 2001-10-25 14:00 . 2011-11-18 17:04 441536 c:\windows\system32\perfh009.dat
- 2001-10-25 14:00 . 2011-11-18 16:23 441536 c:\windows\system32\perfh009.dat
+ 2001-10-25 14:00 . 2011-11-18 17:04 440682 c:\windows\system32\perfh005.dat
- 2001-10-25 14:00 . 2011-11-18 16:23 440682 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-29 1545512]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-01-20 2052096]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AESTFltr]
2009-02-18 12:41 737280 ----a-w- c:\windows\system32\AESTFltr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 01:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-01-21 10:20 134656 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-01-21 10:18 134656 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2008-08-08 05:03 524288 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\Kincl\\Plocha\\RSIT.exe"=
"c:\\Documents and Settings\\Kincl\\Plocha\\tdsskiller.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9.8.2011 12:12 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19.9.2010 12:04 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.9.2010 12:04 20568]
R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys [19.11.2004 17:07 101488]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [20.1.2010 15:49 113536]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [27.6.2010 10:12 112640]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [28.6.2010 21:17 100480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 12:24 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Kincl\Data aplikací\Mozilla\Firefox\Profiles\0kceghcc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-18 22:02
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(948)
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(3664)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-11-18 22:05:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-18 21:05
ComboFix2.txt 2011-11-18 16:24
.
Před spuštěním: Volných bajtů: 75 462 021 120
Po spuštění: Volných bajtů: 75 446 181 888
.
- - End Of File - - D241025B0B560520B82EB5E3E05E1437

#12 Příspěvek od **vyosek** » 18 Lis 2011 22:15

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

Do okna vlozte skript nize

Kód: Vybrat vše

:dir
c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80 /sub

Kliknete na Look
Tlacitko Look se zmeni na Scanning a zsedne
Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

Fugass · #13 Příspěvek od **Fugass** » 18 Lis 2011 22:23

SystemLook 30.07.11 by jpshortstuff
Log created at 22:22 on 18/11/2011 by Kincl
Administrator - Elevation successful

========== dir ==========

c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80 - Parameters: "/sub"

---Files---
@ --ahs-- 2048 bytes [20:40 16/11/2011] [20:40 16/11/2011]

No folders found.

-= EOF =-

#14 Příspěvek od **vyosek** » 18 Lis 2011 22:30

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:files
c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

Fugass · #15 Příspěvek od **Fugass** » 18 Lis 2011 22:38

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
========== FILES ==========
c:\documents and settings\Kincl\Local Settings\Data aplikací\37b2fa80 folder moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
C:\WINDOWS\system32\SET11B.tmp moved successfully.
C:\WINDOWS\system32\SET3D.tmp moved successfully.
C:\WINDOWS\system32\SET42.tmp moved successfully.
C:\WINDOWS\002984_.tmp moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Kincl
->Temp folder emptied: 397 bytes
->Temporary Internet Files folder emptied: 3960913 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 21389448 bytes
->Flash cache emptied: 509 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 114755 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 138496 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 25,00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: Kincl
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

OTM by OldTimer - Version 3.1.19.0 log created on 11182011_223430

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

VIRY.CZ

Prosím o pomoc. Zamrzání firefoxu

Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu

Re: Prosím o pomoc. Zamrzání firefoxu