Mění se datum - podezření na viry

[Lionelka]

Prosím o konrolu logu, mám podezření na viry. Notebook se chová nestandartně, občas zamrzává a mění se mi datum o několik let zpětně.

Dále žádám o pomoc s přístupy na viry.cz. Od posledního přihlášení jsem změnila emailovou adresu na: holeckovaz@yahoo.com a zapoměla jsem své heslo. Nyní jsem se nalogovala tak, že po zadání svého přihlašovacího jména si můj prohlížeč doplnil heslo z posledního přihlášení. Obávám se, že se to příště nemusí podařit a vzhledem ke změně emailové adresy nemám možnost zaslat znovu heslo emailem.
Prosím o změnu emailu, popřípadě mě informujte jak postupovat dál.

Zde přikládám log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Moje cesky at 2011-12-18 15:50:52
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive F: has 6 GB (16%) free of 38 GB
Total RAM: 2037 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:51:17, on 18.12.2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
F:\Windows\system32\Dwm.exe
F:\Windows\Explorer.EXE
F:\Windows\system32\taskeng.exe
F:\Windows\System32\igfxtray.exe
F:\Windows\System32\hkcmd.exe
F:\Windows\System32\igfxpers.exe
F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
F:\Windows\system32\igfxsrvc.exe
F:\Program Files\ESET\ESET Smart Security\egui.exe
F:\Program Files\TrustPort Disk Protection\Bin\TDWatch.exe
F:\Program Files\Common Files\TrustPort\bin\tptray.exe
F:\Windows\WindowsMobile\wmdc.exe
F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
F:\Program Files\HP\HP Software Update\hpwuSchd2.exe
F:\Program Files\Windows Sidebar\sidebar.exe
F:\Windows\ehome\ehtray.exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\Program Files\Windows Media Player\wmpnscfg.exe
F:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
F:\Windows\ehome\ehmsas.exe
F:\Windows\system32\wbem\unsecapp.exe
F:\Program Files\Skype\Plugin Manager\skypePM.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
F:\Users\Moje cesky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WAZ5JR3R\RSIT[1].exe
F:\Program Files\trend micro\Moje cesky.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - F:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: MyAshampoo - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O3 - Toolbar: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - F:\Program Files\MyAshampoo\prxtbMyA0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] F:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] F:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] F:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [GrooveMonitor] "F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrustPortDiskProtectionWatchDog] F:\Program Files\TrustPort Disk Protection\bin\TDWatch.exe
O4 - HKLM\..\Run: [TrustPortTray] "F:\Program Files\Common Files\TrustPort\Bin\tptray.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Sidebar] F:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] F:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @F:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @F:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\Windows\system32\browseui.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - F:\Windows\System32\DreamScene.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - F:\Program Files\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - F:\Program Files\Firebird\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - F:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

--
End of file - 7321 bytes

======Scheduled tasks folder======

F:\Windows\tasks\CHYZTBSHU.job
F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
F:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT24750 ... hSource=13"
prefs.js - "extensions.enabledItems" - "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3, {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198, {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:2.5.6.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.20"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=F:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=F:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=F:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=F:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=0.9.4]
"Description"=VLC Multimedia Plugin
"Path"=F:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1]
"Description"=Yahoo! activeX Plug-in Bridge
"Path"=F:\Program Files\Yahoo!\Common\npyaxmpb.dll

F:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

F:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

F:\Program Files\Mozilla Firefox\plugins\
npnul32.dll
NPOFF12.DLL
nppdf32.dll

F:\Program Files\Mozilla Firefox\searchplugins\
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\
{707db484-2428-402d-afb5-d85b387544c7}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

F:\Users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - F:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
MyAshampoo Toolbar - F:\Program Files\MyAshampoo\prxtbMyA0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-30 342192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - F:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll [2011-11-11 1003576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - MyAshampoo Toolbar - F:\Program Files\MyAshampoo\prxtbMyA0.dll [2011-01-17 175912]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-11-30 342192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=F:\Windows\system32\igfxtray.exe [2008-02-11 141848]
"HotKeysCmds"=F:\Windows\system32\hkcmd.exe [2008-02-11 166424]
"Persistence"=F:\Windows\system32\igfxpers.exe [2008-02-11 133656]
"GrooveMonitor"=F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"egui"=F:\Program Files\ESET\ESET Smart Security\egui.exe [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"=F:\Program Files\TrustPort Disk Protection\bin\TDWatch.exe [2009-06-12 155480]
"TrustPortTray"=F:\Program Files\Common Files\TrustPort\Bin\tptray.exe [2009-06-12 835416]
"Windows Mobile Device Center"=F:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"Adobe Reader Speed Launcher"=F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"HP Software Update"=F:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-10-14 49152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=F:\Program Files\Windows Sidebar\sidebar.exe [2008-01-18 1233920]
"ehTray.exe"=F:\Windows\ehome\ehTray.exe [2008-01-18 125952]
"Skype"=F:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]
"swg"=F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-06-30 39408]
"WMPNSCFG"=F:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-18 202240]

F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - F:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
F:\Windows\system32\igfxdev.dll [2008-02-11 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - F:\Windows\System32\DreamScene.dll [2008-12-13 233888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"F:\Users\Moje cesky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7NU22VQU\IMAGE464-facebook.com.JPG.jpg[2].exe"="F:\Windows\infocard.exe:*:Enabled:Firewall Admin"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=F:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2023-06-27 02:16:04 ----D---- F:\ProgramData\WindowsSearch

======List of files/folders modified in the last 1 month======

2011-12-18 15:51:03 ----D---- F:\Windows\Prefetch
2011-12-18 15:50:53 ----D---- F:\Program Files\trend micro
2011-12-18 15:50:40 ----D---- F:\Windows\temp
2011-12-18 15:49:10 ----D---- F:\Users\Moje cesky\AppData\Roaming\Skype
2011-12-18 15:10:31 ----D---- F:\Users\Moje cesky\AppData\Roaming\skypePM
2011-12-08 12:23:50 ----SHD---- F:\Windows\Installer
2011-12-08 12:11:42 ----D---- F:\Program Files\Google

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fvevol;BitLocker Drive Encryption Filter Driver; F:\Windows\System32\DRIVERS\fvevol.sys [2008-01-18 145464]
R0 MEMLOCK;Secured Memory Driver; F:\Windows\system32\drivers\memlock.sys [2009-06-12 14136]
R1 ehdrv;ehdrv; F:\Windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R2 eamon;eamon; F:\Windows\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 EncDisk;EncDisk; \??\F:\Program Files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
R2 epfw;epfw; F:\Windows\system32\DRIVERS\epfw.sys [2009-05-14 133000]
R2 epfwwfp;epfwwfp; F:\Windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
R2 rismxdp;Ricoh xD-Picture Card Driver; F:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R3 BthEnum;Služba Bluetooth Enumerator; F:\Windows\system32\DRIVERS\BthEnum.sys [2008-12-13 19456]
R3 BthPan;Zařízení Bluetooth (síť PAN); F:\Windows\system32\DRIVERS\bthpan.sys [2008-01-18 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; F:\Windows\System32\Drivers\BTHUSB.sys [2008-12-13 29184]
R3 E100B;Intel(R) PRO Adapter Driver; F:\Windows\system32\DRIVERS\e100b325.sys [2008-01-18 159744]
R3 Epfwndis;Eset Personal Firewall; F:\Windows\system32\DRIVERS\Epfwndis.sys [2009-05-14 33096]
R3 HBtnKey;HBtnKey; F:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; F:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 HSF_DPV;HSF_DPV; F:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; F:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 igfx;igfx; F:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
R3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; F:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); F:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-18 49664]
R3 rimmptsk;rimmptsk; F:\Windows\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; F:\Windows\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]
R3 sdbus;sdbus; F:\Windows\system32\DRIVERS\sdbus.sys [2008-01-18 88576]
R3 usbvideo;Zobrazovací zařízení USB (WDM); F:\Windows\System32\Drivers\usbvideo.sys [2008-01-18 134016]
R3 winachsf;winachsf; F:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 BTHPORT;Ovladač portu Bluetooth; F:\Windows\System32\Drivers\BTHport.sys [2008-12-13 220160]
S3 Dot4;Ovladač MS IEEE-1284.4; F:\Windows\system32\DRIVERS\Dot4.sys [2008-01-18 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; F:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-18 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; F:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-18 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; F:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 ialm;ialm; F:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; F:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; F:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; F:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; F:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; F:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 usb_rndisx;Adaptér USB RNDIS; F:\Windows\system32\DRIVERS\usb8023x.sys [2008-01-18 15872]
S3 usbscan;Ovladač skeneru USB; F:\Windows\system32\DRIVERS\usbscan.sys [2008-01-18 35328]
S3 WpdUsb;WpdUsb; F:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936]
S3 WUDFRd;WUDFRd; F:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 ekrn;ESET Service; F:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; F:\Program Files\Firebird\bin\fbguard.exe [2007-12-12 65536]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; F:\Windows\system32\svchost.exe [2008-01-18 21504]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; F:\Program Files\Firebird\bin\fbserver.exe [2007-12-12 1531989]
S2 gupdate;Služba Google Update (gupdate); F:\Program Files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
S2 Net Driver HPZ12;Net Driver HPZ12; F:\Windows\System32\svchost.exe [2008-01-18 21504]
S2 Pml Driver HPZ12;Pml Driver HPZ12; F:\Windows\System32\svchost.exe [2008-01-18 21504]
S3 EhttpSrv;ESET HTTP Server; F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-05-14 20680]
S3 gupdatem;Služba Google Update (gupdatem); F:\Program Files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
S3 gusvc;Google Software Updater; F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-02-01 182768]
S3 hpqcxs08;hpqcxs08; F:\Windows\system32\svchost.exe [2008-01-18 21504]
S3 McComponentHostService;McAfee Security Scan Component Host Service; F:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; F:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; F:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; F:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Poslete mi do soukrome zpravy (nebo na email vyosek@forum.viry.cz) jaky email a heslo chcete tam a ja se o to postaram

Poprosim jeste i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

[Lionelka]

posílám požadovaný log: zbytek pošlu na Váš mail


info.txt logfile of random's system information tool 1.06 2010-06-30 22:50:13

======Uninstall list======

-->"F:\Program Files\TrustPort Disk Protection\unins000.exe"
Abakus-->MsiExec.exe /X{7515B06B-F8F1-4A5B-81C7-BAB02EEA9A81}
Adobe Flash Player 10 ActiveX-->F:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->F:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A91000000001}
Aktualizace ovladače pro aplikaci Centrum zařízení Windows Mobile-->MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E}
Ashampoo Burning Studio 7.10-->"F:\Program Files\Ashampoo\Ashampoo Burning Studio 7\unins000.exe"
Bullzip PDF Printer 6.0.0.865-->"F:\Program Files\Bullzip\PDF Printer\unins000.exe"
CCleaner (remove only)-->"F:\Program Files\CCleaner\uninst.exe"
Centrum zařízení Windows Mobile-->MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
Codec Pack - All In 1 6.0.3.0-->F:\Windows\iun6002.exe "F:\Program Files\Codec Pack - All In 1\irunin.ini"
Firebird 1.5.5-->"F:\Program Files\Firebird\unins000.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->"F:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_6447DDAF760F41DD.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
GPL Ghostscript Lite 8.64-->"F:\Program Files\Bullzip\PDF Printer\gs\unins000.exe"
HijackThis 2.0.2-->"F:\Program Files\trend micro\HijackThis.exe" /uninstall
Install_Simulace_2009_min-->MsiExec.exe /I{D43CDC11-B6DC-4339-8EB7-6C20C2BAB336}
Intel(R) Graphics Media Accelerator Driver-->F:\Windows\system32\igxpun.exe -uninstall
Microsoft .NET Framework 3.5-->F:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Office Access MUI (Czech) 2007-->MsiExec.exe /X{90120000-0015-0405-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"F:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Czech) 2007-->MsiExec.exe /X{90120000-0016-0405-0000-0000000FF1CE}
Microsoft Office Groove MUI (Czech) 2007-->MsiExec.exe /X{90120000-00BA-0405-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Czech) 2007-->MsiExec.exe /X{90120000-0044-0405-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Czech) 2007-->MsiExec.exe /X{90120000-00A1-0405-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Czech) 2007-->MsiExec.exe /X{90120000-001A-0405-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Czech) 2007-->MsiExec.exe /X{90120000-0018-0405-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Czech) 2007-->MsiExec.exe /X{90120000-002C-0405-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Czech) 2007-->MsiExec.exe /X{90120000-0019-0405-0000-0000000FF1CE}
Microsoft Office Shared MUI (Czech) 2007-->MsiExec.exe /X{90120000-006E-0405-0000-0000000FF1CE}
Microsoft Office Word MUI (Czech) 2007-->MsiExec.exe /X{90120000-001B-0405-0000-0000000FF1CE}
Microsoft SQL Server Compact 3.5 ENU-->MsiExec.exe /I{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}
Mozilla Firefox (3.0.19)-->F:\Program Files\Mozilla Firefox\uninstall\helper.exe
OpenOffice.org 2.3-->MsiExec.exe /I{39CDC80C-4330-4556-990D-1975211E2370}
Poradce - AWD, verze 1.25/1-->C:\GEN\uninst.exe
Simulace_2009-->MsiExec.exe /I{7B6FC9C2-C5B4-4F58-8E50-1587236285D0}
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
TrustPort PC Security (Pouze odebrat)-->F:\Program Files\Common Files\TrustPort\bin\uninst.exe
Ultimate Extras sounds from Microsoft® Tinker™-->RunDll32 advpack.dll,LaunchINFSection F:\Windows\INF\UltSound2.inf,Uninstall
Update for Office 2007 (KB934391)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
Update for Office 2007 (KB934393)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
VLC media player 0.9.4-->F:\Program Files\VideoLAN\VLC\uninstall.exe
WebEx-->F:\PROGRA~2\WebEx\atcliun.exe
WinRAR-->F:\Program Files\WinRAR\uninstall.exe
Zvuková schémata systému Windows-->RunDll32 advpack.dll,LaunchINFSection F:\Windows\INF\UltSound.inf,Uninstall

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Mojecesky-PC
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.00. 6001 Service Pack 1 Multiprocessor Free.
Record Number: 42768
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 6005
Message: Služba Event Log byla spuštěna.
Record Number: 42769
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 6013
Message: Doba provozu systému je 27 sekund.
Record Number: 42770
Source Name: EventLog
Time Written: 20091221133304.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 4
Message: Adaptér Intel(R) PRO/100 VE Network Connection: Nefunkční spojení adaptéru
Record Number: 42771
Source Name: E100B
Time Written: 20091221133257.234126-000
Event Type: Upozornění
User:

Computer Name: Mojecesky-PC
Event Code: 18
Message: Systém Windows nemůže uložit ověřovací kódy Bluetooth (klíče linky) u místního adaptéru. Klávesnice Bluetooth nemusí být funkční v systému BIOS během spuštění.
Record Number: 42772
Source Name: BTHUSB
Time Written: 20091221133259.636541-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: Mojecesky-PC
Event Code: 1
Message: Klient Certifikační služby byl úspěšně spuštěn.
Record Number: 6569
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20100630202846.547234-000
Event Type: Informace
User: Mojecesky-PC\Moje cesky

Computer Name: Mojecesky-PC
Event Code: 1
Message: Klient Certifikační služby byl úspěšně spuštěn.
Record Number: 6570
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20100630202855.548434-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: Mojecesky-PC
Event Code: 1
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.
Record Number: 6571
Source Name: SecurityCenter
Time Written: 20100630203017.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 1001
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně odstraněny. Data záznamu obsahují nové hodnoty položek Last Counter a Last Help systémového registru.
Record Number: 6572
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100630203307.000000-000
Event Type: Informace
User:

Computer Name: Mojecesky-PC
Event Code: 1000
Message: Čítače výkonu pro službu WmiApRpl (WmiApRpl) byly úspěšně načteny. Data záznamu v datové části obsahují nové indexové hodnoty přiřazené této službě.
Record Number: 6573
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100630203308.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16536
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.178434-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16537
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.194034-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16538
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.225234-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16539
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.256434-000
Event Type: Selhání auditu
User:

Computer Name: Mojecesky-PC
Event Code: 5038
Message: Integrita kódu určila, že hodnota hash bitové kopie souboru není platná. Soubor může být poškozen z důvodu neoprávněné změny, nebo neplatná hodnota hash může ukazovat na potenciální chybu diskového zařízení.

Název souboru: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 16540
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100630205011.272034-000
Event Type: Selhání auditu
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------

[vyosek]

Ok, pozadavek na zmenu jsem zadal nasemu administratorovi, prepokladam ze jak se prihlasi na forum, tak zmenu provede. A my pokracujem v leceni

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Lionelka]

i kdyz jsem vypnul antivir a ostatni ochrany, presto mi CF hlasil ze jsou zaple a ze bude pokracovat na me nasledky dal v cinnosti. po dokonceni operace jsem se jiz nedostal na net zádným prohlizecem, vsechny mi hlasi Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni. totez hlasi i kdyz poklepam na ikonu cCleaneru. Asi CF smazal cestu k temto ikonam. prohlizec jsem nakonec otevrel pomoci ulozeneho odkazu na noviny iDNES.cz kde jsem prepsal webovou adresu na toto forum

ComboFix 11-12-19.01 - Moje cesky 19.12.2011 19:08:27.2.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.420.1029.18.2037.1000 [GMT 1:00]
Spuštěný z: f:\users\Moje cesky\Desktop\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Enabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\program files\FunWebProducts
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-19 do 2011-12-19 )))))))))))))))))))))))))))))))
.
.
2023-06-27 01:16 . 2023-06-27 01:16 -------- d-----w- f:\programdata\WindowsSearch
2011-12-19 18:16 . 2011-12-19 18:16 -------- d-----w- f:\users\Public\AppData\Local\temp
2011-12-19 18:16 . 2011-12-19 18:16 -------- d-----w- f:\users\Default\AppData\Local\temp
2011-12-08 11:10 . 2011-12-08 11:23 414368 ----a-w- f:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- f:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
2011-01-17 14:54 175912 ----a-w- f:\program files\MyAshampoo\prxtbMyA0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}"= "f:\program files\MyAshampoo\prxtbMyA0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="f:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="f:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"Skype"="f:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"swg"="f:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-30 39408]
"WMPNSCFG"="f:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="f:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="f:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="f:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"GrooveMonitor"="f:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"egui"="f:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"="f:\program files\TrustPort Disk Protection\bin\TDWatch.exe" [2009-06-12 155480]
"TrustPortTray"="f:\program files\Common Files\TrustPort\Bin\tptray.exe" [2009-06-12 835416]
"Windows Mobile Device Center"="f:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe Reader Speed Launcher"="f:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="f:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"HP Software Update"="f:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
.
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - f:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-237069233-1738439373-3822406637-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Služba Google Update (gupdate);f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
R3 gupdatem;Služba Google Update (gupdatem);f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;f:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S0 MEMLOCK;Secured Memory Driver;f:\windows\system32\drivers\memlock.sys [2009-06-12 14136]
S1 ehdrv;ehdrv;f:\windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
S2 ekrn;ESET Service;f:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
S2 EncDisk;EncDisk;f:\program files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
S2 epfwwfp;epfwwfp;f:\windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;f:\program files\Firebird\bin\fbguard.exe [2007-12-11 65536]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;f:\program files\Firebird\bin\fbserver.exe [2007-12-11 1531989]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 16:23 38400 ----a-w- f:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 09:50 30720 ----a-w- f:\windows\System32\soundschemes2.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2006-02-09 f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 09:05]
.
2011-12-19 f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- f:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 09:05]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - f:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - MyAshampoo Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - f:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-19 19:16
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2011-12-19 19:20:27
ComboFix-quarantined-files.txt 2011-12-19 18:20
.
Před spuštěním: 6 284 771 328
Po spuštění: 6 243 135 488
.
- - End Of File - - D78AC19B8EEDE6450180E8B5D27CDA41

[vyosek]

Restartujte PC a napiste ci restart pomohl, ale mel by

[Lionelka]

Ano, pomohlo to, ikony jsou uz funkcni. Po restartu se kupodivu aktivovaly samy bezpecnostni ochrany antiviru aniz bych je musel rucne nastavovat.

co mam delat dal?

[vyosek]

Super ze pomohlo, tak jeste docistime

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  File::
  f:\program files\MyAshampoo\prxtbMyA0.dll
  f:\program files\ConduitEngine\prxConduitEngine.dll
  f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}"=-
  [-HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Skype"=-
  "swg"=-
  "WMPNSCFG"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "HP Software Update"=-
  
  Driver::
  gupdate
  gupdatem
  
  Firefox::
  FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
  FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
  FF - prefs.js: browser.search.selectedEngine - MyAshampoo Customized Web Search
  FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT24750 ... hSource=13
  FF - Ext: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[Lionelka]

opet se mi i po vypnuti bezpectnostnich ochran baliku Smart security ESET ozval CF, ze nejsou vypnuty a ze bude pokracovat dal na me nebezpeci.

ComboFix 11-12-19.03 - Moje cesky 20.12.2011 7:51.3.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.420.1029.18.2037.1185 [GMT 1:00]
Spuštěný z: f:\users\Moje cesky\Desktop\ComboFix.exe
Použité ovládací přepínače :: f:\users\Moje cesky\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Enabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"f:\program files\ConduitEngine\prxConduitEngine.dll"
"f:\program files\MyAshampoo\prxtbMyA0.dll"
"f:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"f:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
f:\program files\ConduitEngine\prxConduitEngine.dll
f:\program files\MyAshampoo\prxtbMyA0.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitAutoCompleteSearch.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitAutoCompleteSearch.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.idl
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\ConduitToolbar.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\FFExternalAlert.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.dll
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components\RadioWMPCore.xpt
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults\default_radio_skin.xml
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults\fbAlert.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome.manifest
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome\myashampoo.jar
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\install.rdf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\lib\xpcom.js
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\manifest.mf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\zigbert.rsa
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF\zigbert.sf
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.gif
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.ico
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.PNG
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.src
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin\conduit.xml
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\setup.ini
f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\version.txt
f:\windows\iun6002.exe
f:\windows\Tasks\GoogleUpdateTaskMachineCore.job
f:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-20 do 2011-12-20 )))))))))))))))))))))))))))))))
.
.
2023-06-27 01:16 . 2023-06-27 01:16 -------- d-----w- f:\programdata\WindowsSearch
2011-12-20 06:57 . 2011-12-20 07:00 -------- d-----w- f:\users\Moje cesky\AppData\Local\temp
2011-12-08 11:10 . 2011-12-08 11:23 414368 ----a-w- f:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="f:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="f:\windows\ehome\ehTray.exe" [2008-01-18 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="f:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="f:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="f:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"GrooveMonitor"="f:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"egui"="f:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TrustPortDiskProtectionWatchDog"="f:\program files\TrustPort Disk Protection\bin\TDWatch.exe" [2009-06-12 155480]
"TrustPortTray"="f:\program files\Common Files\TrustPort\Bin\tptray.exe" [2009-06-12 835416]
"Windows Mobile Device Center"="f:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
.
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - f:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-237069233-1738439373-3822406637-1000]
"EnableNotificationsRef"=dword:00000001
.
R3 McComponentHostService;McAfee Security Scan Component Host Service;f:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S0 MEMLOCK;Secured Memory Driver;f:\windows\system32\drivers\memlock.sys [2009-06-12 14136]
S1 ehdrv;ehdrv;f:\windows\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
S2 ekrn;ESET Service;f:\program files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
S2 EncDisk;EncDisk;f:\program files\TrustPort Disk Protection\bin\EncDsk.sys [2009-06-12 55128]
S2 epfwwfp;epfwwfp;f:\windows\system32\DRIVERS\epfwwfp.sys [2009-05-14 38240]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;f:\program files\Firebird\bin\fbguard.exe [2007-12-11 65536]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;f:\program files\Firebird\bin\fbserver.exe [2007-12-11 1531989]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 16:23 38400 ----a-w- f:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 09:50 30720 ----a-w- f:\windows\System32\soundschemes2.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - f:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - f:\users\Moje cesky\AppData\Roaming\Mozilla\Firefox\Profiles\p2fu6rbt.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - f:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - f:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Cool's_Codec_pack_4.12 - f:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-20 08:01
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
f:\program files\Google\Update\GoogleUpdate.exe
f:\windows\system32\conime.exe
f:\windows\system32\igfxsrvc.exe
f:\windows\ehome\ehmsas.exe
f:\windows\system32\wbem\unsecapp.exe
f:\\?\f:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2011-12-20 08:06:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-20 07:06
ComboFix2.txt 2011-12-19 18:20
.
Před spuštěním: 6 258 376 704
Po spuštění: 6 085 566 464
.
- - End Of File - - 5FC9A744FEEEE0E7B1EC4CBAD40661C6

[vyosek]

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ehTray.exe"=-
  
  :files
  f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[Lionelka]

behem dne notebook stale zamrzal


All processes killed
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ehTray.exe deleted successfully.
========== FILES ==========
f:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk moved successfully.
File/Folder F:\Windows\system32\*.tmp.dll not found.
File/Folder F:\Windows\system32\SET*.tmp not found.
File/Folder F:\Windows\*.tmp not found.
========== COMMANDS ==========
F:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Moje cesky
->Temp folder emptied: 60532 bytes
->Temporary Internet Files folder emptied: 12658633 bytes
->FireFox cache emptied: 42428036 bytes
->Google Chrome cache emptied: 34123417 bytes
->Flash cache emptied: 1013 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 296612 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 85,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Moje cesky
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 12202011_232855

[vyosek]

Otestujte HD pomoci HD Tune http://www.stahuj.centrum.cz/utility_a_ ... g/hd-tune/

• Udelejte testy Benchmark a Error Scan - dejte screeny
• Dejte screen ze zalozky Health
• Scree udelate kdyz klilknete na tu modrou disketku a pak jej sem dejte dle tohoto navdou http://www.viry.cz/forum/viewtopic.php?f=15&t=14114 - zajima Vas jen cast "zaslani na forum" samozrejme

[Lionelka]

Zdravím, byl jsem teď nějakou dobu mimo počítač, můžeme prosím pokračovat?

zde posílám odkaz: http://imageshack.us/g/832/hdtunebenchmarkwdcwd120.png/

[vyosek]

No vypada to, ze disk nam sel do kyticek, jeste na to mrknem

stáhněte
http://www.slunecnice.cz/sw/crystaldiskinfo/
- spusťte ho a v nabídce zvolte Kopírovat.
-Data ze schránky sem pak vložte pomocí Ctrl+V

[Lionelka]

----------------------------------------------------------------------------
CrystalDiskInfo 4.1.3 (C) 2008-2011 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows Vista Ultimate Edition SP1 [6.0 Build 6001] (x86)
Date : 2012/01/08 12:58:00

-- Controller Map ----------------------------------------------------------
- Ricoh MMC Host Controller [ATA]
- Ricoh Memory Stick Host Controller [ATA]
- Ricoh xD-Picture Card Controller [ATA]
+ Řadiče úložiště Intel(R) 82801G (řada ICH7) v režimu Ultra ATA - 27DF [ATA]
+ Kanál IDE (0)
- Slimtype DVD A DS8AZH ATA Device
+ Standardní řadič AHCI 1.0 s rozhraním Serial ATA [ATA]
+ Kanál IDE (0)
- WDC WD1200BEVS-60LAT0 ATA Device
- Kanál IDE (2)
- Iniciátor iSCSI společnosti Microsoft [SCSI]

-- Disk List ---------------------------------------------------------------
(1) WDC WD1200BEVS-60LAT0 : 120.0 GB [0-1-0, pd1]

----------------------------------------------------------------------------
(1) WDC WD1200BEVS-60LAT0
----------------------------------------------------------------------------
Model : WDC WD1200BEVS-60LAT0
Firmware : 01.06M01
Serial Number : WD-WXE406684421
Disk Size : 120.0 GB (8.4/120.0/120.0)
Buffer Size : 8192 KB
Queue Depth : 1
# of Sectors : 234441648
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA/ATAPI-7
Minor Version : ----
Transfer Mode : SATA/150
Power On Hours : 10354 hod.
Power On Count : 4278 krát
Temparature : 44 C (111 F)
Health Status : Pozor
Features : S.M.A.R.T., APM, 48bit LBA
APM Level : 0080h [ON]
AAM Level : ----

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 198 194 _51 000000003294 Počet chyb čtení
03 192 184 _21 000000000556 Čas na roztočení ploten
04 _95 _95 __0 0000000013C6 Počet spuštění/zastavení
05 169 169 140 0000000000F2 Počet přemapovaných sektorů
07 100 253 _51 000000000000 Počet chybných hledání
09 _86 _86 __0 000000002872 Hodin v činnosti
0A 100 100 _51 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 _51 000000000000 Počet pokusů o překalibrování
0C _96 _96 __0 0000000010B6 Počet cyklů zapnutí zařízení
C0 195 195 __0 000000001088 Počet vypnutí disku
C1 110 110 __0 000000041FB1 Počet cyklů načítání/vymazání
C2 103 _61 __0 00000000002C Teplota
C4 165 165 __0 000000000023 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000001 Počet podezřelých sektorů
C6 100 253 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 100 253 _51 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 42 7A 3F FF C8 37 00 10 00 00 00 00 00 3F 00 00
010: 00 00 00 00 20 20 20 20 20 57 44 2D 57 58 45 34
020: 30 36 36 38 34 34 32 31 00 00 40 00 00 32 30 31
030: 2E 30 36 4D 30 31 57 44 43 20 57 44 31 32 30 30
040: 42 45 56 53 2D 36 30 4C 41 54 30 20 20 20 20 20
050: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 80 10
060: 00 00 2F 00 40 01 00 00 00 00 00 07 3F FF 00 10
070: 00 3F FC 10 00 FB 01 10 4B B0 0D F9 00 00 00 07
080: 00 03 00 78 00 78 00 78 00 78 00 00 00 00 00 00
090: 00 00 00 00 00 00 00 00 04 02 00 00 00 48 00 40
0A0: 00 FE 00 00 70 69 7C 09 60 23 70 69 3C 09 60 23
0B0: 20 3F 00 00 00 00 00 80 FF FE 00 00 00 00 00 00
0C0: 00 00 00 00 00 00 00 00 4B B0 0D F9 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 16 73 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 10 3F 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E1 A5