SystemLook 30.07.11 by jpshortstuff
Log created at 20:13 on 28/12/2011 by mypc
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.
========== dir ==========
Tady je log ze SystemLook:
c:\program files (x86)\21EF3 - Parameters: "/s"
---Files---
None found.
No folders found.
c:\users\mypc\AppData\Roaming\E0621 - Parameters: "/s"
---Files---
1EF3.062 --a---- 11800 bytes [15:27 19/12/2011] [06:49 24/12/2011]
No folders found.
-= EOF =-
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
systém při pokusu o odstránění virů padá
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
chodnik74
- Přítel fóra
- Příspěvky: 4975
- Registrován: 13 zář 2010 21:30
- Bydliště: Napajedla
- Kontaktovat uživatele:
Re: systém při pokusu o odstránění virů padá
Obě složky dejte smazat 
Malwarebytes' Anti-Malware 
Jak se chová PC?
Malwarebytes' Anti-Malware
- Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
- Vybereme Úplná kontrola a klikneme na tlačítko Prohledat
- Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
- Objeví se vám log,který mi sem vložte
- NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci
Jak se chová PC?
Napiš mi: chodnik74@gmail.com nebo 
>RSIT<>MBAM<>VirusTotal
Doporučuji:
| 
Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. 
Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce!
Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce!
Jste s naší pomocí spokojeni 
Neváhejte a podpořte forum ZDE.
Pravidla fora: č.1 a č.2
>RSIT<>MBAM<>VirusTotal
Doporučuji:
| Postup si raději vícekrát přečtěte a v případě jakýchkoliv nejasností či pochybností se ptejte. Pokud máte infikovaný počítač nebo se nechová jako obvykle, tak si zálohujte všechny data a pozorně postupujte dle pokynů rádce! Nepoužívejte utilitu Combofix bez dohledu a doporučení rádce! Jste s naší pomocí spokojeni Neváhejte a podpořte forum ZDE.Pravidla fora: č.1 a č.2
Re: systém při pokusu o odstránění virů padá
Dobrý den, konečně jsem se dostal k odeslání logu (měl jsem problémy s win7, chtěl jsem udělat ještě nějaké pořádky ve spouštění systému a nějak jsem dovrzal spouštěcí soubory, tak jsem řešil akutně od silvestra jak to sprovoznit bez potřeby nové instalace). Teď posílám log z Malwarebytes a pro jistotu kontrolní log ze RSITu. S pozdravem M.
*****************************************************************
Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.60.0.1800
www.malwarebytes.org
Verze databáze: v2012.01.07.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
mypc :: MYPC-PC [administrátor]
Ochrana: Zakázána
8.1.2012 16:57:17
mbam-log-2012-01-08 (16-57-17).txt
Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 179033
Uplynulý čas: 2 minut, 6 sekund
Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)
(konec)
********************************************************************************************
Logfile of random's system information tool 1.09 (written by random/random)
Run by mypc at 2012-01-08 20:00:45
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 23 GB (29%) free of 80 GB
Total RAM: 4095 MB (31% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:01:00, on 8.1.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\mypc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ScreenManager Pro for LCD] C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R2880] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICXE.EXE /FU "C:\Users\mypc\AppData\Local\Temp\E_S821C.tmp" /EF "HKCU"
O4 - Startup: MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Global Startup: ColorMunki Gamma.lnk = C:\Program Files (x86)\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: X-Rite Device ColorMunki (ColorMunkiService) - X-Rite Inc. - C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\nlssrv32.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - e:\wamp64\bin\apache\apache2.2.17\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - e:\wamp64\bin\mysql\mysql5.1.53\bin\mysqld.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: X-Rite Device Manager (xritedeviced) - X-Rite Inc. - C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
--
End of file - 6658 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\nlssrv32.exe
"C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe"
"C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Windows\System32\spool\drivers\x64\3\E_IATICXE.EXE" /FU "C:\Users\mypc\AppData\Local\Temp\E_S821C.tmp" /EF "HKCU"
"C:\Program Files (x86)\MagicDisc\MagicDisc.exe"
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2932.8ed1990.2128765548 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" Mozilla.Firefox.9.0.1 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 2932 "\\.\pipe\gecko-crash-server-pipe.2932" plugin
"F:\antivir\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe18_ Global\UsGthrCtrlFltPipeMssGthrPipe18 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
======Scheduled tasks folder======
C:\Windows\tasks\AdobeAAMUpdater-1.0-mypc-PC-mypc.job
C:\Windows\tasks\Launch 9480.job
C:\Windows\tasks\User_Feed_Synchronization-{1A5A5BAA-2825-4E15-926E-9109678007CC}.job
=========Mozilla firefox=========
ProfilePath - C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default
prefs.js - "browser.startup.homepage" - "http://www.google.cz/"
prefs.js - "extensions.enabledItems" - "firebug@software.joehewitt.com:1.6.2, {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2, adonis.cuhk@gmail.com:1.5, printpdf@pavlov.net:0.76, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@photodex.com/PhotodexPresenter]
"Description"=Photodex Presenter Plugin
"Path"=C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5]
"Description"=WebTablet Plugin API
"Path"=C:\Program Files (x86)\TabletPlugins\npwacom.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default\extensions\
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default\searchplugins\
conduit.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 688528]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15 499608]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-12-18 399736]
"EPSON Stylus Photo R2880"=C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICXE.EXE [2007-11-16 218112]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\0pzq0sdyu5]
C:\Users\mypc\0pzq0sdyu5.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regedit32]
C:\Windows\system32\regedit.exe []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"ScreenManager Pro for LCD"=C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe [2009-03-02 12080424]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-12-24 460872]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ColorMunki Gamma.lnk - C:\Program Files (x86)\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe
C:\Users\mypc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MagicDisc.lnk - C:\Program Files (x86)\MagicDisc\MagicDisc.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2010-11-20 290304]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SynchronousMachineGroupPolicy"=0
"SynchronousUserGroupPolicy"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HideSCAHealth"=1
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - C:\Windows\NOTEPAD.EXE %1
======List of files/folders created in the last 1 month======
2012-01-07 19:07:30 ----D---- C:\Users\mypc\AppData\Roaming\MediaMonkey
2012-01-07 19:07:27 ----D---- C:\ProgramData\MediaMonkey
2012-01-07 19:07:24 ----D---- C:\Program Files (x86)\MediaMonkey
2012-01-06 16:42:39 ----D---- C:\Program Files (x86)\JetAudio
2012-01-06 15:57:17 ----D---- C:\Users\mypc\AppData\Roaming\COWON
2012-01-01 16:21:51 ----D---- C:\Users\mypc\AppData\Roaming\EPSON
2012-01-01 14:14:15 ----A---- C:\Windows\OutLog.txt
2012-01-01 09:53:45 ----N---- C:\bootsqm.dat
2012-01-01 09:52:33 ----SHD---- C:\found.000
2012-01-01 00:23:43 ----D---- C:\Windows\Minidump
2011-12-31 20:45:35 ----A---- C:\Windows\BcdLog.txt
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\setupempdrv03.exe
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\EuGdiDrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\EuEpmGdi.dll
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\epmntdrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\BootMan.exe
2011-12-31 19:34:52 ----A---- C:\Windows\system32\setupempdrvx64.exe
2011-12-31 19:34:52 ----A---- C:\Windows\system32\EuGdiDrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\system32\EuEpmGdi.dll
2011-12-31 19:34:52 ----A---- C:\Windows\system32\epmntdrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\system32\BootMan.exe
2011-12-31 19:34:49 ----D---- C:\Program Files (x86)\EASEUS
2011-12-29 19:12:19 ----SHD---- C:\Boot
2011-12-29 18:53:55 ----D---- C:\Program Files (x86)\NeoSmart Technologies
2011-12-28 20:37:17 ----D---- C:\Users\mypc\AppData\Roaming\Malwarebytes
2011-12-28 20:37:14 ----D---- C:\ProgramData\Malwarebytes
2011-12-28 20:37:14 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-12-28 20:37:14 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-12-28 17:03:02 ----D---- C:\Windows\temp
2011-12-28 17:02:57 ----A---- C:\ComboFix.txt
2011-12-28 16:54:16 ----D---- C:\$RECYCLE.BIN
2011-12-27 21:26:30 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-12-27 17:05:18 ----A---- C:\TDSSKiller.2.6.25.0_27.12.2011_17.05.18_log.txt
2011-12-24 09:14:02 ----A---- C:\Windows\zip.exe
2011-12-24 09:14:02 ----A---- C:\Windows\SWSC.exe
2011-12-24 09:14:02 ----A---- C:\Windows\SWREG.exe
2011-12-24 09:14:02 ----A---- C:\Windows\sed.exe
2011-12-24 09:14:02 ----A---- C:\Windows\PEV.exe
2011-12-24 09:14:02 ----A---- C:\Windows\NIRCMD.exe
2011-12-24 09:14:02 ----A---- C:\Windows\MBR.exe
2011-12-24 09:14:02 ----A---- C:\Windows\grep.exe
2011-12-24 09:13:56 ----D---- C:\Windows\ERDNT
2011-12-24 09:13:53 ----D---- C:\Qoobox
2011-12-24 07:57:44 ----D---- C:\Users\mypc\AppData\Roaming\SUPERAntiSpyware.com
2011-12-24 07:57:18 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2011-12-24 07:57:18 ----D---- C:\Program Files\SUPERAntiSpyware
2011-12-23 20:57:40 ----D---- C:\Program Files\trend micro
2011-12-23 20:57:39 ----D---- C:\rsit
2011-12-23 20:30:29 ----A---- C:\Windows\ntbtlog.txt
2011-12-18 07:32:52 ----D---- C:\Program Files (x86)\uTorrent
2011-12-18 07:32:19 ----D---- C:\Users\mypc\AppData\Roaming\uTorrent
2011-12-13 17:08:20 ----D---- C:\Windows\system64
2011-12-13 16:32:33 ----D---- C:\Program Files (x86)\Ontrack
2011-12-12 17:48:58 ----D---- C:\Program Files (x86)\Wondershare
2011-12-12 14:33:21 ----D---- C:\Program Files (x86)\Essential Data Tools
======List of files/folders modified in the last 1 month======
2012-01-08 10:29:25 ----D---- C:\ProgramData\NVIDIA
2012-01-07 19:07:27 ----D---- C:\ProgramData
2012-01-07 19:07:24 ----RD---- C:\Program Files (x86)
2012-01-06 16:42:40 ----D---- C:\Program Files (x86)\Common Files
2012-01-06 16:42:39 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-01-06 16:42:35 ----SHD---- C:\System Volume Information
2012-01-05 18:50:51 ----D---- C:\mytest
2012-01-03 16:39:45 ----D---- C:\Windows\System32
2012-01-03 16:39:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-03 16:39:44 ----D---- C:\Windows\inf
2012-01-01 17:33:19 ----D---- C:\Users\mypc\AppData\Roaming\FileZilla
2012-01-01 14:14:15 ----AD---- C:\Windows
2011-12-31 19:34:52 ----D---- C:\Windows\SysWOW64
2011-12-31 19:05:29 ----D---- C:\Windows\system32\catroot2
2011-12-29 19:12:20 ----D---- C:\Windows\system32\config
2011-12-29 18:54:00 ----D---- C:\Windows\Tasks
2011-12-29 18:31:22 ----SHD---- C:\Windows\Installer
2011-12-29 18:30:00 ----RD---- C:\Program Files
2011-12-28 20:37:14 ----D---- C:\Windows\system32\drivers
2011-12-28 17:55:28 ----D---- C:\Windows\system32\drivers\etc
2011-12-28 16:54:35 ----A---- C:\Windows\system.ini
2011-12-28 16:46:26 ----D---- C:\Windows\SYSWOW64\drivers
2011-12-28 16:46:26 ----D---- C:\Windows\AppPatch
2011-12-28 16:46:22 ----D---- C:\Program Files\Common Files
2011-12-28 16:37:14 ----D---- C:\ProgramData\Kaspersky Lab
2011-12-28 16:37:13 ----D---- C:\Garmin
2011-12-24 08:09:54 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2011-12-24 07:54:19 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-12-21 20:55:56 ----D---- C:\Users\mypc\AppData\Roaming\Media Player Classic
2011-12-18 11:11:02 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2011-12-09 15:05:00 ----HD---- C:\Windows\system32\GroupPolicy
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 255552]
R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\system32\DRIVERS\PdiPorts.sys [2006-11-16 19248]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S1 uzg4nda5;AVZ-RK Kernel Driver; \??\C:\Windows\system32\Drivers\uzg4nda5.sys []
S1 vdg4nda5;AVZ-BC Kernel Driver; \??\C:\Windows\system32\Drivers\vdg4nda5.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 colormunki;colormunki; C:\Windows\System32\Drivers\colormunki_x64.sys [2007-10-02 51600]
S3 epmntdrv;epmntdrv; \??\C:\Windows\syswow64\epmntdrv.sys [2011-07-29 14216]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\syswow64\EuGdiDrv.sys [2011-07-29 8456]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 utg4nda5;AVZ Kernel Driver; \??\C:\Windows\system32\Drivers\utg4nda5.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 wacmoumonitor;Wacom Mode Helper; C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2010-11-02 13312]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-12 140672]
R2 ColorMunkiService;X-Rite Device ColorMunki; C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe [2009-10-21 147968]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\Windows\syswow64\nlssrv32.exe [2010-12-07 66560]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-01-07 1005160]
R2 ScsiAccess;ScsiAccess; C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe [2011-03-21 186760]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
R2 xritedeviced;X-Rite Device Manager; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [2009-10-21 130048]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 wampapache;wampapache; e:\wamp64\bin\apache\apache2.2.17\bin\httpd.exe [2010-10-24 21504]
S3 wampmysqld;wampmysqld; e:\wamp64\bin\mysql\mysql5.1.53\bin\mysqld.exe [2010-11-24 7669760]
-----------------EOF-----------------
*****************************************************************
Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.60.0.1800
www.malwarebytes.org
Verze databáze: v2012.01.07.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
mypc :: MYPC-PC [administrátor]
Ochrana: Zakázána
8.1.2012 16:57:17
mbam-log-2012-01-08 (16-57-17).txt
Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 179033
Uplynulý čas: 2 minut, 6 sekund
Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)
Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)
(konec)
********************************************************************************************
Logfile of random's system information tool 1.09 (written by random/random)
Run by mypc at 2012-01-08 20:00:45
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 23 GB (29%) free of 80 GB
Total RAM: 4095 MB (31% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:01:00, on 8.1.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\mypc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ScreenManager Pro for LCD] C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R2880] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICXE.EXE /FU "C:\Users\mypc\AppData\Local\Temp\E_S821C.tmp" /EF "HKCU"
O4 - Startup: MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Global Startup: ColorMunki Gamma.lnk = C:\Program Files (x86)\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: X-Rite Device ColorMunki (ColorMunkiService) - X-Rite Inc. - C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\nlssrv32.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - e:\wamp64\bin\apache\apache2.2.17\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - e:\wamp64\bin\mysql\mysql5.1.53\bin\mysqld.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: X-Rite Device Manager (xritedeviced) - X-Rite Inc. - C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
--
End of file - 6658 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\nlssrv32.exe
"C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe"
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe"
"C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Windows\System32\spool\drivers\x64\3\E_IATICXE.EXE" /FU "C:\Users\mypc\AppData\Local\Temp\E_S821C.tmp" /EF "HKCU"
"C:\Program Files (x86)\MagicDisc\MagicDisc.exe"
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2932.8ed1990.2128765548 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" Mozilla.Firefox.9.0.1 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 2932 "\\.\pipe\gecko-crash-server-pipe.2932" plugin
"F:\antivir\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe18_ Global\UsGthrCtrlFltPipeMssGthrPipe18 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
======Scheduled tasks folder======
C:\Windows\tasks\AdobeAAMUpdater-1.0-mypc-PC-mypc.job
C:\Windows\tasks\Launch 9480.job
C:\Windows\tasks\User_Feed_Synchronization-{1A5A5BAA-2825-4E15-926E-9109678007CC}.job
=========Mozilla firefox=========
ProfilePath - C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default
prefs.js - "browser.startup.homepage" - "http://www.google.cz/"
prefs.js - "extensions.enabledItems" - "firebug@software.joehewitt.com:1.6.2, {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2, adonis.cuhk@gmail.com:1.5, printpdf@pavlov.net:0.76, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@photodex.com/PhotodexPresenter]
"Description"=Photodex Presenter Plugin
"Path"=C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5]
"Description"=WebTablet Plugin API
"Path"=C:\Program Files (x86)\TabletPlugins\npwacom.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default\extensions\
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
C:\Users\mypc\AppData\Roaming\Mozilla\Firefox\Profiles\wo5k4pty.default\searchplugins\
conduit.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 688528]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15 499608]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-12-18 399736]
"EPSON Stylus Photo R2880"=C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICXE.EXE [2007-11-16 218112]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\0pzq0sdyu5]
C:\Users\mypc\0pzq0sdyu5.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Regedit32]
C:\Windows\system32\regedit.exe []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"ScreenManager Pro for LCD"=C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe [2009-03-02 12080424]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2011-12-24 460872]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ColorMunki Gamma.lnk - C:\Program Files (x86)\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe
C:\Users\mypc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MagicDisc.lnk - C:\Program Files (x86)\MagicDisc\MagicDisc.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2010-11-20 290304]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SynchronousMachineGroupPolicy"=0
"SynchronousUserGroupPolicy"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HideSCAHealth"=1
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - C:\Windows\NOTEPAD.EXE %1
======List of files/folders created in the last 1 month======
2012-01-07 19:07:30 ----D---- C:\Users\mypc\AppData\Roaming\MediaMonkey
2012-01-07 19:07:27 ----D---- C:\ProgramData\MediaMonkey
2012-01-07 19:07:24 ----D---- C:\Program Files (x86)\MediaMonkey
2012-01-06 16:42:39 ----D---- C:\Program Files (x86)\JetAudio
2012-01-06 15:57:17 ----D---- C:\Users\mypc\AppData\Roaming\COWON
2012-01-01 16:21:51 ----D---- C:\Users\mypc\AppData\Roaming\EPSON
2012-01-01 14:14:15 ----A---- C:\Windows\OutLog.txt
2012-01-01 09:53:45 ----N---- C:\bootsqm.dat
2012-01-01 09:52:33 ----SHD---- C:\found.000
2012-01-01 00:23:43 ----D---- C:\Windows\Minidump
2011-12-31 20:45:35 ----A---- C:\Windows\BcdLog.txt
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\setupempdrv03.exe
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\EuGdiDrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\EuEpmGdi.dll
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\epmntdrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\SYSWOW64\BootMan.exe
2011-12-31 19:34:52 ----A---- C:\Windows\system32\setupempdrvx64.exe
2011-12-31 19:34:52 ----A---- C:\Windows\system32\EuGdiDrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\system32\EuEpmGdi.dll
2011-12-31 19:34:52 ----A---- C:\Windows\system32\epmntdrv.sys
2011-12-31 19:34:52 ----A---- C:\Windows\system32\BootMan.exe
2011-12-31 19:34:49 ----D---- C:\Program Files (x86)\EASEUS
2011-12-29 19:12:19 ----SHD---- C:\Boot
2011-12-29 18:53:55 ----D---- C:\Program Files (x86)\NeoSmart Technologies
2011-12-28 20:37:17 ----D---- C:\Users\mypc\AppData\Roaming\Malwarebytes
2011-12-28 20:37:14 ----D---- C:\ProgramData\Malwarebytes
2011-12-28 20:37:14 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-12-28 20:37:14 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-12-28 17:03:02 ----D---- C:\Windows\temp
2011-12-28 17:02:57 ----A---- C:\ComboFix.txt
2011-12-28 16:54:16 ----D---- C:\$RECYCLE.BIN
2011-12-27 21:26:30 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-12-27 17:05:18 ----A---- C:\TDSSKiller.2.6.25.0_27.12.2011_17.05.18_log.txt
2011-12-24 09:14:02 ----A---- C:\Windows\zip.exe
2011-12-24 09:14:02 ----A---- C:\Windows\SWSC.exe
2011-12-24 09:14:02 ----A---- C:\Windows\SWREG.exe
2011-12-24 09:14:02 ----A---- C:\Windows\sed.exe
2011-12-24 09:14:02 ----A---- C:\Windows\PEV.exe
2011-12-24 09:14:02 ----A---- C:\Windows\NIRCMD.exe
2011-12-24 09:14:02 ----A---- C:\Windows\MBR.exe
2011-12-24 09:14:02 ----A---- C:\Windows\grep.exe
2011-12-24 09:13:56 ----D---- C:\Windows\ERDNT
2011-12-24 09:13:53 ----D---- C:\Qoobox
2011-12-24 07:57:44 ----D---- C:\Users\mypc\AppData\Roaming\SUPERAntiSpyware.com
2011-12-24 07:57:18 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2011-12-24 07:57:18 ----D---- C:\Program Files\SUPERAntiSpyware
2011-12-23 20:57:40 ----D---- C:\Program Files\trend micro
2011-12-23 20:57:39 ----D---- C:\rsit
2011-12-23 20:30:29 ----A---- C:\Windows\ntbtlog.txt
2011-12-18 07:32:52 ----D---- C:\Program Files (x86)\uTorrent
2011-12-18 07:32:19 ----D---- C:\Users\mypc\AppData\Roaming\uTorrent
2011-12-13 17:08:20 ----D---- C:\Windows\system64
2011-12-13 16:32:33 ----D---- C:\Program Files (x86)\Ontrack
2011-12-12 17:48:58 ----D---- C:\Program Files (x86)\Wondershare
2011-12-12 14:33:21 ----D---- C:\Program Files (x86)\Essential Data Tools
======List of files/folders modified in the last 1 month======
2012-01-08 10:29:25 ----D---- C:\ProgramData\NVIDIA
2012-01-07 19:07:27 ----D---- C:\ProgramData
2012-01-07 19:07:24 ----RD---- C:\Program Files (x86)
2012-01-06 16:42:40 ----D---- C:\Program Files (x86)\Common Files
2012-01-06 16:42:39 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-01-06 16:42:35 ----SHD---- C:\System Volume Information
2012-01-05 18:50:51 ----D---- C:\mytest
2012-01-03 16:39:45 ----D---- C:\Windows\System32
2012-01-03 16:39:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-01-03 16:39:44 ----D---- C:\Windows\inf
2012-01-01 17:33:19 ----D---- C:\Users\mypc\AppData\Roaming\FileZilla
2012-01-01 14:14:15 ----AD---- C:\Windows
2011-12-31 19:34:52 ----D---- C:\Windows\SysWOW64
2011-12-31 19:05:29 ----D---- C:\Windows\system32\catroot2
2011-12-29 19:12:20 ----D---- C:\Windows\system32\config
2011-12-29 18:54:00 ----D---- C:\Windows\Tasks
2011-12-29 18:31:22 ----SHD---- C:\Windows\Installer
2011-12-29 18:30:00 ----RD---- C:\Program Files
2011-12-28 20:37:14 ----D---- C:\Windows\system32\drivers
2011-12-28 17:55:28 ----D---- C:\Windows\system32\drivers\etc
2011-12-28 16:54:35 ----A---- C:\Windows\system.ini
2011-12-28 16:46:26 ----D---- C:\Windows\SYSWOW64\drivers
2011-12-28 16:46:26 ----D---- C:\Windows\AppPatch
2011-12-28 16:46:22 ----D---- C:\Program Files\Common Files
2011-12-28 16:37:14 ----D---- C:\ProgramData\Kaspersky Lab
2011-12-28 16:37:13 ----D---- C:\Garmin
2011-12-24 08:09:54 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2011-12-24 07:54:19 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-12-21 20:55:56 ----D---- C:\Users\mypc\AppData\Roaming\Media Player Classic
2011-12-18 11:11:02 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2011-12-09 15:05:00 ----HD---- C:\Windows\system32\GroupPolicy
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 255552]
R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\system32\DRIVERS\PdiPorts.sys [2006-11-16 19248]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S1 uzg4nda5;AVZ-RK Kernel Driver; \??\C:\Windows\system32\Drivers\uzg4nda5.sys []
S1 vdg4nda5;AVZ-BC Kernel Driver; \??\C:\Windows\system32\Drivers\vdg4nda5.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 colormunki;colormunki; C:\Windows\System32\Drivers\colormunki_x64.sys [2007-10-02 51600]
S3 epmntdrv;epmntdrv; \??\C:\Windows\syswow64\epmntdrv.sys [2011-07-29 14216]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\syswow64\EuGdiDrv.sys [2011-07-29 8456]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 utg4nda5;AVZ Kernel Driver; \??\C:\Windows\system32\Drivers\utg4nda5.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 wacmoumonitor;Wacom Mode Helper; C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2010-11-02 13312]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-12 140672]
R2 ColorMunkiService;X-Rite Device ColorMunki; C:\Program Files (x86)\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe [2009-10-21 147968]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\Windows\syswow64\nlssrv32.exe [2010-12-07 66560]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-01-07 1005160]
R2 ScsiAccess;ScsiAccess; C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe [2011-03-21 186760]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
R2 xritedeviced;X-Rite Device Manager; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [2009-10-21 130048]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 wampapache;wampapache; e:\wamp64\bin\apache\apache2.2.17\bin\httpd.exe [2010-10-24 21504]
S3 wampmysqld;wampmysqld; e:\wamp64\bin\mysql\mysql5.1.53\bin\mysqld.exe [2010-11-24 7669760]
-----------------EOF-----------------
-
Rudy
- Site Admin
- Příspěvky: 119495
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: systém při pokusu o odstránění virů padá
Log vypadá OK. Už je vše v pořádku?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: systém při pokusu o odstránění virů padá
Myslím že je to v pořádku. Proxy ve Firefoxu přepínal některý doplněk (zásuvný modul), který zblbnul při odvirovacích pokusech. Vypnul jsem je všechny a postupně zapínal. Nakonec jsem jeden nebo dva smazal, už si nepamatuju které, ale jednalo se o nějaký PDF downloader a MS Word wiever nebo tak něco. Děkuji za spolupráci a posílám 200 Kč přes PayPal.
S pozdravem M.G.
S pozdravem M.G.
-
Rudy
- Site Admin
- Příspěvky: 119495
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: systém při pokusu o odstránění virů padá
Nemáte zač a my děkujeme za příspěvek!
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?