Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz


Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zpráva
Autor
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#16 Příspěvek od motji »

Tak jako předtím, uložíte text do poznámkového bloku a přetáhnete nad combofix :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Avatar uživatele
Mira
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 01 Bře 2012 19:00

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#17 Příspěvek od Mira »

Jo jo, nakonec jsem na to prisel, a vysedky jsou na predchozi strane :)

(Jsem si vubec nevsim ze vase odpoved uz je na druhe strance :( )

Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#18 Příspěvek od motji »

Co počítač?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Avatar uživatele
Mira
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 01 Bře 2012 19:00

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#19 Příspěvek od Mira »

Vypada to ze je vse v poradku :)

Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#20 Příspěvek od motji »

:arrow: Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


:arrow: Stáhněte T-Cleaner
http://tharifas.sweb.cz/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



:arrow: Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

:arrow: Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Avatar uživatele
Mira
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 01 Bře 2012 19:00

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#21 Příspěvek od Mira »

PC se chova v poradku, neni zadny problem. :thumbsup:

Log RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Mirek at 2012-03-11 18:49:59
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 543 GB (57%) free of 954 GB
Total RAM: 4095 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:50:10, on 11.3.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Mirek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\Mirek\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKCU\..\Run: [HTC Home] "C:\Users\Mirek\AppData\Roaming\Stealth Software\HTC Home\HTCHome (x64).exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout s Mipony - file://C:\Program Files (x86)\MiPony\Browser\IEContext.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8154 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /boot
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe /pipeName=7c363c6a-6a3b-4018-85ac-5d103d74db30 /coreSdkOptions=286 /logConfFile="C:\ProgramData\AVG2012\temp\5816f607-0ed0-4b0b-81be-f30a54632377-174-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2012\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg2012" /tempPath="C:\ProgramData\AVG2012\temp\"
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
taskeng.exe {EC2E80DA-2788-432A-B7FE-7BF2EC197231}
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"taskhost.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Users\Mirek\AppData\Roaming\Stealth Software\HTC Home\HTCHome (x64).exe"
"C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
"C:\Program Files (x86)\AVG Secure Search\vprot.exe"
"C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe"
"C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe"
C:\Windows\SysWOW64\IoctlSvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2560
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\AVG2012\avgemca.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=3168.153477a0.818013632 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 3168 "\\.\pipe\gecko-crash-server-pipe.3168" plugin
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\totalcmd\TOTALCMD64.EXE"
"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4142652493-215447543-3548880870-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4142652493-215447543-3548880870-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\001_____________MEDIA\Stazene DATA\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\x1yvrhx2.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "keyword.URL" - "http://isearch.avg.com/search?cid=%7Bbb ... &sap=ku&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
avg-secure-search.xml
babylon.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\x1yvrhx2.default\extensions\
{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
{77d2ed30-4cd2-11e0-b8af-0800200c9a66}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll [2011-11-11 1942368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll [2011-11-11 1378144]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-01-22 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Users\Mirek\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2011-10-06 142288]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll [2012-03-01 1811296]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-01-22 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll [2012-03-01 1811296]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HTC Home"=C:\Users\Mirek\AppData\Roaming\Stealth Software\HTC Home\HTCHome (x64).exe [2012-03-02 265216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-02-13 3481408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2012-01-13 460872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Finder]
C:\Program Files (x86)\Media Finder\MF.exe /opentotray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2008-11-14 305064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-12-05 343168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^{17314228-173E-4057-AC9F-E653543A20C7}.lnk]
C:\Users\Public\{17314228-173E-4057-AC9F-E653543A20C7}.dll,AppStartup CommonStartup []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"=C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2010-11-17 113288]
"AVG_TRAY"=C:\Program Files (x86)\AVG\AVG2012\avgtray.exe [2012-01-24 2416480]
"vProt"=C:\Program Files (x86)\AVG Secure Search\vprot.exe [2012-03-01 939872]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2012-01-14 249344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2012-03-11 18:49:59 ----D---- C:\rsit
2012-03-10 01:38:32 ----D---- C:\1. MEDIA
2012-03-04 23:24:25 ----D---- C:\Windows\temp
2012-03-04 23:21:06 ----D---- C:\$RECYCLE.BIN
2012-03-04 14:47:39 ----SHD---- C:\ProgramData\DSS
2012-03-04 14:47:39 ----D---- C:\ProgramData\Codemasters
2012-03-04 14:43:04 ----A---- C:\Windows\SYSWOW64\rapture3d_oal.dll
2012-03-04 14:43:04 ----A---- C:\Windows\SYSWOW64\mkl_blueripple.dll
2012-03-04 14:43:03 ----D---- C:\Program Files (x86)\BRS
2012-03-04 14:43:02 ----D---- C:\Program Files (x86)\OpenAL
2012-03-04 14:43:02 ----A---- C:\Windows\SYSWOW64\wrap_oal.dll
2012-03-04 14:43:02 ----A---- C:\Windows\SYSWOW64\OpenAL32.dll
2012-03-04 14:43:02 ----A---- C:\Windows\system32\wrap_oal.dll
2012-03-04 14:43:02 ----A---- C:\Windows\system32\OpenAL32.dll
2012-03-04 14:33:07 ----D---- C:\Program Files (x86)\Codemasters
2012-03-03 08:12:53 ----D---- C:\Users\Mirek\AppData\Roaming\Youtube Downloader HD
2012-03-03 08:12:44 ----D---- C:\Program Files (x86)\Youtube Downloader HD
2012-03-03 08:00:41 ----D---- C:\Users\Mirek\AppData\Roaming\vso
2012-03-02 15:33:22 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-03-02 15:33:22 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2012-03-01 21:26:07 ----D---- C:\$AVG
2012-03-01 20:53:08 ----D---- C:\Users\Mirek\AppData\Roaming\AVG2012
2012-03-01 20:19:01 ----D---- C:\ProgramData\AVG Secure Search
2012-03-01 20:18:59 ----D---- C:\Program Files (x86)\AVG Secure Search
2012-03-01 20:18:55 ----D---- C:\Windows\SYSWOW64\drivers\AVG
2012-03-01 20:18:36 ----D---- C:\Windows\system32\drivers\AVG
2012-03-01 20:18:36 ----D---- C:\ProgramData\AVG2012
2012-03-01 19:50:35 ----D---- C:\Users\Mirek\AppData\Roaming\TrueCrypt
2012-03-01 19:50:15 ----A---- C:\Windows\system32\drivers\truecrypt.sys
2012-03-01 19:50:07 ----D---- C:\Program Files\TrueCrypt
2012-03-01 18:06:44 ----D---- C:\Windows\ERDNT
2012-03-01 18:04:03 ----D---- C:\Program Files\trend micro
2012-03-01 01:40:56 ----A---- C:\Windows\system32\MRT.exe
2012-03-01 01:40:24 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-03-01 01:40:24 ----A---- C:\Windows\system32\mshtmled.dll
2012-03-01 01:40:23 ----A---- C:\Windows\system32\iertutil.dll
2012-03-01 01:40:22 ----A---- C:\Windows\SYSWOW64\url.dll
2012-03-01 01:40:22 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-03-01 01:40:22 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-03-01 01:40:22 ----A---- C:\Windows\system32\url.dll
2012-03-01 01:40:22 ----A---- C:\Windows\system32\jscript9.dll
2012-03-01 01:40:21 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-03-01 01:40:21 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-03-01 01:40:21 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-03-01 01:40:21 ----A---- C:\Windows\system32\jscript.dll
2012-03-01 01:40:21 ----A---- C:\Windows\system32\ieui.dll
2012-03-01 01:40:20 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-03-01 01:40:20 ----A---- C:\Windows\system32\urlmon.dll
2012-03-01 01:40:20 ----A---- C:\Windows\system32\jsproxy.dll
2012-03-01 01:40:19 ----A---- C:\Windows\system32\wininet.dll
2012-03-01 01:40:18 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-03-01 01:40:17 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-03-01 01:40:16 ----A---- C:\Windows\system32\mshtml.dll
2012-03-01 01:40:15 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-03-01 01:40:14 ----A---- C:\Windows\system32\ieframe.dll
2012-03-01 01:33:08 ----A---- C:\Windows\SYSWOW64\msvcrt.dll
2012-03-01 01:33:08 ----A---- C:\Windows\system32\msvcrt.dll
2012-03-01 01:33:07 ----A---- C:\Windows\system32\win32k.sys
2012-03-01 01:33:07 ----A---- C:\Windows\system32\drivers\afd.sys
2012-02-29 23:03:22 ----A---- C:\Windows\system32\aswBoot.exe
2012-02-29 23:03:02 ----D---- C:\ProgramData\AVAST Software
2012-02-29 22:43:54 ----A---- C:\Windows\SYSWOW64\drivers\GRD.sys
2012-02-29 22:41:15 ----A---- C:\Windows\system32\drivers\MiniIcpt.sys
2012-02-29 22:40:47 ----A---- C:\Windows\system32\GEARASpi64.dll
2012-02-29 22:40:47 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2012-02-29 22:40:44 ----A---- C:\Windows\system32\drivers\GDBehave.sys
2012-02-29 22:40:43 ----D---- C:\ProgramData\G DATA
2012-02-29 22:40:43 ----A---- C:\Windows\system32\drivers\gdwfpcd64.sys
2012-02-29 22:38:46 ----D---- C:\Windows\pss
2012-02-29 14:22:46 ----D---- C:\Users\Mirek\AppData\Roaming\ESET
2012-02-27 21:50:33 ----D---- C:\Program Files\Recuva
2012-02-25 15:18:04 ----D---- C:\Users\Mirek\AppData\Roaming\Hamachi
2012-02-25 15:17:51 ----A---- C:\Windows\system32\drivers\hamachi.sys
2012-02-25 15:17:50 ----D---- C:\Program Files (x86)\Hamachi
2012-02-24 00:27:47 ----D---- C:\Users\Mirek\AppData\Roaming\foobar2000
2012-02-23 16:14:20 ----A---- C:\Windows\SYSWOW64\NCTAudioInformation2.dll
2012-02-23 16:14:20 ----A---- C:\Windows\SYSWOW64\NCTAudioFile2.dll
2012-02-23 16:14:20 ----A---- C:\Windows\SYSWOW64\ebCrypt.dll
2012-02-22 23:49:17 ----D---- C:\Users\Mirek\AppData\Roaming\Stealth Software
2012-02-22 22:54:28 ----D---- C:\Program Files (x86)\Microsoft.NET
2012-02-22 22:07:19 ----D---- C:\ProgramData\eMule
2012-02-22 21:35:58 ----D---- C:\Users\Mirek\AppData\Roaming\Malwarebytes
2012-02-22 21:35:55 ----D---- C:\ProgramData\Malwarebytes
2012-02-22 21:35:55 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-22 21:35:55 ----A---- C:\Windows\system32\drivers\mbam.sys
2012-02-22 17:22:13 ----D---- C:\Program Files\CCleaner
2012-02-17 14:34:44 ----D---- C:\Users\Mirek\AppData\Roaming\Media Finder
2012-02-17 14:33:57 ----A---- C:\user.js
2012-02-16 18:03:36 ----D---- C:\Users\Mirek\AppData\Roaming\Shareaza
2012-02-16 15:41:36 ----D---- C:\Program Files (x86)\EA Games
2012-02-16 15:26:19 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2012-02-16 15:25:58 ----RHD---- C:\Users\Mirek\AppData\Roaming\SecuROM
2012-02-16 15:25:58 ----D---- C:\Windows\SYSWOW64\URTTEMP
2012-02-16 15:24:58 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2012-02-16 15:24:57 ----A---- C:\Windows\SYSWOW64\PnkBstrA.exe
2012-02-16 15:24:57 ----A---- C:\Windows\SYSWOW64\pbsvc.exe
2012-02-13 19:59:43 ----D---- C:\Program Files (x86)\Need for Speed The Run
2012-02-13 19:57:03 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2012-02-13 19:56:58 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2012-02-12 13:49:04 ----A---- C:\Windows\SYSWOW64\CmdLineExt_x64.dll
2012-02-12 13:43:06 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2012-02-12 13:22:44 ----D---- C:\Program Files (x86)\Rockstar Games

======List of files/folders modified in the last 1 month======

2012-03-11 18:50:10 ----D---- C:\Windows\Prefetch
2012-03-11 18:45:16 ----D---- C:\Windows\system32\config
2012-03-11 18:44:58 ----D---- C:\Windows
2012-03-11 18:42:13 ----D---- C:\Windows\inf
2012-03-11 18:35:41 ----SHD---- C:\System Volume Information
2012-03-11 18:34:32 ----D---- C:\Windows\system32\drivers
2012-03-11 18:34:29 ----D---- C:\Windows\SYSWOW64\drivers
2012-03-11 17:07:15 ----D---- C:\ProgramData\MFAData
2012-03-11 01:41:31 ----D---- C:\Windows\System32
2012-03-11 01:41:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-03-10 01:55:57 ----D---- C:\Users\Mirek\AppData\Roaming\Mipony
2012-03-09 17:33:17 ----D---- C:\Users\Mirek\AppData\Roaming\DAEMON Tools Lite
2012-03-09 17:33:03 ----D---- C:\Windows\Logs
2012-03-09 17:29:03 ----SD---- C:\Users\Mirek\AppData\Roaming\Microsoft
2012-03-07 14:27:23 ----RD---- C:\Program Files (x86)
2012-03-04 23:21:10 ----A---- C:\Windows\system.ini
2012-03-04 23:21:05 ----D---- C:\Windows\system32\drivers\etc
2012-03-04 23:19:40 ----D---- C:\Windows\SysWOW64
2012-03-04 23:18:03 ----D---- C:\Windows\AppPatch
2012-03-04 23:18:02 ----D---- C:\Program Files\Common Files
2012-03-04 23:18:02 ----D---- C:\Program Files (x86)\Common Files
2012-03-04 14:53:26 ----D---- C:\Windows\winsxs
2012-03-04 14:48:33 ----SHD---- C:\Windows\Installer
2012-03-04 14:47:44 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-03-04 14:47:39 ----D---- C:\ProgramData
2012-03-04 14:31:42 ----SD---- C:\ProgramData\Microsoft
2012-03-04 03:10:23 ----A---- C:\Windows\NeroDigital.ini
2012-03-03 08:11:06 ----RD---- C:\Program Files
2012-03-01 20:18:01 ----D---- C:\Windows\system32\catroot2
2012-03-01 19:46:47 ----D---- C:\Windows\debug
2012-03-01 19:32:02 ----D---- C:\Windows\system32\Tasks
2012-03-01 18:03:49 ----D---- C:\Work
2012-03-01 14:04:18 ----D---- C:\Windows\Microsoft.NET
2012-03-01 14:04:17 ----RSD---- C:\Windows\assembly
2012-03-01 01:52:48 ----D---- C:\Program Files (x86)\Internet Explorer
2012-03-01 01:52:47 ----D---- C:\Windows\SYSWOW64\migration
2012-03-01 01:52:47 ----D---- C:\Windows\system32\migration
2012-03-01 01:52:47 ----D---- C:\Program Files\Internet Explorer
2012-03-01 01:40:34 ----D---- C:\Windows\system32\catroot
2012-02-29 23:02:36 ----D---- C:\Windows\system32\appmgmt
2012-02-29 22:32:45 ----SH---- C:\Program Files (x86)\desktop.ini
2012-02-29 22:30:05 ----D---- C:\Windows\system32\DriverStore
2012-02-29 14:46:50 ----D---- C:\Windows\system32\NDF
2012-02-28 14:54:31 ----D---- C:\001_____________MEDIA
2012-02-25 16:22:54 ----D---- C:\Users\Mirek\AppData\Roaming\Skype
2012-02-25 15:17:25 ----D---- C:\Temp
2012-02-24 00:27:41 ----D---- C:\Program Files (x86)\foobar2000
2012-02-22 22:54:29 ----D---- C:\Windows\SYSWOW64\en-US
2012-02-22 22:54:29 ----D---- C:\Windows\system32\en-US
2012-02-22 17:33:28 ----D---- C:\Windows\Panther
2012-02-20 18:05:34 ----D---- C:\Program Files (x86)\Battlefield 3
2012-02-18 20:37:23 ----D---- C:\Users\Mirek\AppData\Roaming\vlc
2012-02-18 03:43:45 ----D---- C:\Program Files (x86)\Mozilla Firefox
2012-02-18 03:11:42 ----D---- C:\Program Files (x86)\Electronic Arts
2012-02-16 21:38:03 ----D---- C:\Program Files (x86)\The KMPlayer
2012-02-16 15:46:33 ----D---- C:\ProgramData\Electronic Arts
2012-02-16 15:26:40 ----D---- C:\Windows\Registration
2012-02-16 15:24:57 ----D---- C:\Windows\system32\LogFiles
2012-02-12 19:23:55 ----D---- C:\Windows\system32\wdi
2012-02-12 13:23:30 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2011-10-04 80000]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2011-10-04 40576]
R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 26704]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2011-09-13 37456]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2011-10-07 283728]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2011-08-08 46672]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2011-07-11 375376]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-02-13 283200]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2012-03-01 231376]
R2 AODDriver4.01;AODDriver4.01; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-12-06 10720256]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-12-06 327168]
R3 GearAspiWDM;GEARAspiWDM; C:\Windows\System32\drivers\GEARAspiWDM.sys [2008-02-22 19496]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2012-02-25 33344]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2011-12-10 23152]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 82432]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 181760]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2009-04-14 208672]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2011-08-17 53376]
S3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 120400]
S3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 29776]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 cpuz130;cpuz130; \??\C:\Users\Mirek\AppData\Local\Temp\cpuz130\cpuz_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [2010-05-09 33592]
S3 NTIOLib_1_0_4;NTIOLib_1_0_4; \??\C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [2010-10-21 14136]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-12-06 235520]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-12-05 361984]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [2006-12-19 81920]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-02-16 66872]
R2 vToolbarUpdater;vToolbarUpdater; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe [2012-03-01 909152]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
S3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-01-14 1255736]

-----------------EOF-----------------

Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#22 Příspěvek od motji »

Log je v pořádku, kdyby byly problémy, ozvěte se :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Avatar uživatele
Mira
Návštěvník
Návštěvník
Příspěvky: 13
Registrován: 01 Bře 2012 19:00

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#23 Příspěvek od Mira »

Ok. Děkuji, měj te se hezky :)

Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Jak se zbavit Downloader.Agent.2 a TR/Crypt.XPACK.Gen

#24 Příspěvek od motji »

Není zač :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.

Odpovědět