Využítí procesoru

[vadimek]

Mám problém s velkým využítím processoru pří spuštení jakýchkoliv aplikací používajícíh NET.Framework prosím o radu a příkladam log díky.
Logfile of random's system information tool 1.09 (written by random/random)
Run by Vadimek at 2012-03-23 23:01:35
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 2 GB (4%) free of 50 GB
Total RAM: 1534 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:01:40, on 23.3.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Vadimek\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Vadimek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.speedbit.com/?aff=105
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 46.28.105.63:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: ::1 localhost
O1 - Hosts: 81.0.254.162 L2authd.Lineage2.com
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\HyperCam Toolbar\tbcore3.dll
O3 - Toolbar: HyperCam Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\HyperCam Toolbar\tbcore3.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE -startup
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: (no name) - http://askluis.files.wordpress.com/2009 ... fare21.jpg

--
End of file - 7246 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-630328440-725345543-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-630328440-725345543-1004UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Vadimek\Data aplikací\Mozilla\Firefox\Profiles\ysce1obo.default

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-02-23 998560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-11-29 3844768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-01-24 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-01-24 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
SMTTB2009 Class - C:\Program Files\HyperCam Toolbar\tbcore3.dll [2010-02-16 2495488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{338B4DFE-2E2C-4338-9E41-E176D497299E} - HyperCam Toolbar - C:\Program Files\HyperCam Toolbar\tbcore3.dll [2010-02-16 2495488]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-02-23 998560]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2011-11-15 312376]
"PAC7302_Monitor"=C:\WINDOWS\PixArt\PAC7302\Monitor.exe [2006-11-03 319488]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-12-05 98304]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-12-05 20065384]
"ATICustomerCare"=C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe [2010-05-04 311296]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-02-23 4031368]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Vadimek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2012-01-24 136176]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-03-06 741240]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-10-13 17351304]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"PlayNC Launcher"= []

C:\Documents and Settings\Vadimek\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wbsys.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2011-12-06 192512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll [2011-09-26 210224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Documents and Settings\Vadimek\Dokumenty\Downloads\Battlefield 2 full game MP - SP Fixed v_1.5 -=AviaRa=-\Battlefield 2\BF2.exe"="D:\Documents and Settings\Vadimek\Dokumenty\Downloads\Battlefield 2 full game MP - SP Fixed v_1.5 -=AviaRa=-\Battlefield 2\BF2.exe:*:Enabled:BF2"
"D:\Counter-Strike 1.6\csko.exe"="D:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Documents and Settings\Vadimek\Dokumenty\Downloads\Left 4 Dead full game v 1.0.2.6 -=AviaRa=-\Left4Dead\left4dead.exe"="D:\Documents and Settings\Vadimek\Dokumenty\Downloads\Left 4 Dead full game v 1.0.2.6 -=AviaRa=-\Left4Dead\left4dead.exe:*:Enabled:left4dead"
"D:\Counter-Strike 1.6\hlds.exe"="D:\Counter-Strike 1.6\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Documents and Settings\Vadimek\Plocha\winbox.exe"="C:\Documents and Settings\Vadimek\Plocha\winbox.exe:*:Enabled:winbox"
"D:\Program Files\QuadCoreM2\pack\core.bin"="D:\Program Files\QuadCoreM2\pack\core.bin:*:Enabled:core"
"D:\Program Files\bitComposer Games\S.T.A.L.K.E.R. - Call of Pripyat\bin\xrEngine.exe"="D:\Program Files\bitComposer Games\S.T.A.L.K.E.R. - Call of Pripyat\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Call of Pripyat (CLI)"
"D:\Program Files\bitComposer Games\S.T.A.L.K.E.R. - Call of Pripyat\bin\dedicated\xrEngine.exe"="D:\Program Files\bitComposer Games\S.T.A.L.K.E.R. - Call of Pripyat\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Call of Pripyat (SRV)"
"D:\Call of Duty 4\iw3mp.exe"="D:\Call of Duty 4\iw3mp.exe:*:Enabled:iw3mp"
"D:\Program Files\Ubisoft\Driver San Francisco\Driver.exe"="D:\Program Files\Ubisoft\Driver San Francisco\Driver.exe:*:Enabled:Driver San Francisco"
"D:\Program Files\Codemasters\Operation Flashpoint Red River\RedRiver.exe"="D:\Program Files\Codemasters\Operation Flashpoint Red River\RedRiver.exe:*:Enabled:Operation Flashpoint ®: Red River"
"D:\Program Files\Codemasters\Operation Flashpoint Red River\RedRiverLauncher.exe"="D:\Program Files\Codemasters\Operation Flashpoint Red River\RedRiverLauncher.exe:*:Enabled:Operation Flashpoint ®: Red River"
"C:\Documents and Settings\Vadimek\Dokumenty\Downloads\winbox.exe"="C:\Documents and Settings\Vadimek\Dokumenty\Downloads\winbox.exe:*:Enabled:winbox"
"D:\Program Files\Activision\Call of Duty - Black Ops\BlackOps.exe"="D:\Program Files\Activision\Call of Duty - Black Ops\BlackOps.exe:*:Enabled:BlackOps"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\1ClickDownload\1ClickDownload.exe"="C:\Program Files\1ClickDownload\1ClickDownload.exe:*:Enabled:1ClickDownload"
"D:\Program Files\Activision\Call of Duty - Black Ops\BlackOpsMP.exe"="D:\Program Files\Activision\Call of Duty - Black Ops\BlackOpsMP.exe:*:Disabled:BlackOpsMP"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"D:\Program Files\Disney Interactive Studios\Split Second\SplitSecond.exe"="D:\Program Files\Disney Interactive Studios\Split Second\SplitSecond.exe:*:Enabled:Split/Second"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-03-23 23:01:35 ----D---- C:\rsit
2012-03-23 23:01:35 ----D---- C:\Program Files\trend micro
2012-03-23 22:57:10 ----D---- C:\WINDOWS\LastGood
2012-03-23 19:35:28 ----D---- C:\Program Files\Metin2
2012-03-18 19:46:04 ----D---- C:\Program Files\NCsoft
2012-03-18 19:44:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2012-03-14 19:35:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2641653$
2012-03-14 19:33:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2621440$
2012-03-14 19:33:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2647518$
2012-03-12 11:20:14 ----A---- C:\WINDOWS\system32\wbsys.dll
2012-03-12 11:20:11 ----D---- C:\Program Files\Stardock
2012-03-10 19:34:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\NFS Underground
2012-03-10 19:33:49 ----D---- C:\Program Files\Common Files\DirectX
2012-03-10 19:23:59 ----D---- C:\WINDOWS\RegisteredPackages
2012-03-10 19:23:35 ----A---- C:\WINDOWS\system32\psisdecd.dll
2012-03-10 19:23:35 ----A---- C:\WINDOWS\system32\drivers\msdv.sys
2012-03-10 19:23:35 ----A---- C:\WINDOWS\system32\drivers\mpe.sys
2012-03-10 19:23:35 ----A---- C:\WINDOWS\system32\drivers\bdasup.sys
2012-03-10 19:23:29 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2012-03-08 10:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2012-03-08 10:48:59 ----D---- C:\WINDOWS\ie8updates
2012-03-08 10:48:19 ----A---- C:\WINDOWS\imsins.BAK
2012-03-08 10:48:11 ----D---- C:\WINDOWS\WBEM
2012-03-08 10:47:14 ----HDC---- C:\WINDOWS\ie8
2012-03-06 22:12:54 ----A---- C:\Dokument.txt
2012-03-05 15:59:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\McAfee
2012-03-05 15:57:26 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\Mozilla
2012-03-05 15:57:20 ----D---- C:\Program Files\Mozilla Firefox
2012-03-04 19:00:30 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\Toolbar4
2012-03-04 19:00:28 ----D---- C:\Program Files\HyperCam Toolbar
2012-03-04 19:00:20 ----D---- C:\Program Files\HyCam2
2012-03-01 23:49:07 ----A---- C:\Documents and Settings\Vadimek\Data aplikací\MPQEditor.ini
2012-02-28 18:54:17 ----A---- C:\regen.txt
2012-02-27 20:25:12 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-02-27 20:25:12 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-02-27 20:25:08 ----A---- C:\WINDOWS\system32\drivers\aswFW.sys
2012-02-27 20:24:45 ----A---- C:\WINDOWS\system32\drivers\aswNdis2.sys
2012-02-27 20:24:44 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-02-27 20:24:44 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-02-27 20:24:43 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-02-27 20:24:43 ----A---- C:\WINDOWS\system32\drivers\aswKbd.sys
2012-02-27 20:24:42 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-02-27 20:24:42 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-02-27 20:24:41 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-02-27 20:23:03 ----A---- C:\WINDOWS\system32\drivers\aswNdis.sys
2012-02-27 20:22:55 ----A---- C:\WINDOWS\avastSS.scr
2012-02-27 20:22:51 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-02-27 20:22:02 ----D---- C:\Program Files\AVAST Software
2012-02-27 20:22:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-02-27 20:20:15 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\Sereniti
2012-02-25 11:02:10 ----D---- C:\Program Files\CCleaner
2012-02-24 18:52:59 ----D---- C:\Program Files\IObit
2012-02-24 18:52:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\IObit

======List of files/folders modified in the last 1 month======

2012-03-23 23:01:35 ----RD---- C:\Program Files
2012-03-23 23:00:16 ----D---- C:\WINDOWS\Prefetch
2012-03-23 22:57:42 ----HD---- C:\WINDOWS\inf
2012-03-23 22:57:40 ----D---- C:\WINDOWS\system32
2012-03-23 22:57:40 ----D---- C:\WINDOWS
2012-03-23 22:57:08 ----D---- C:\WINDOWS\system32\CatRoot2
2012-03-23 22:44:19 ----D---- C:\WINDOWS\system32\drivers
2012-03-23 22:42:57 ----D---- C:\WINDOWS\Temp
2012-03-23 22:34:12 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\Skype
2012-03-23 21:00:43 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\uTorrent
2012-03-22 19:54:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-03-21 14:56:52 ----D---- C:\WINDOWS\system32\config
2012-03-20 20:48:13 ----D---- C:\WINDOWS\system32\DirectX
2012-03-20 20:48:12 ----D---- C:\WINDOWS\Logs
2012-03-20 20:22:30 ----HD---- C:\Program Files\InstallShield Installation Information
2012-03-19 17:13:02 ----D---- C:\WINDOWS\system32\drivers\etc
2012-03-18 19:43:22 ----SD---- C:\Documents and Settings\Vadimek\Data aplikací\Microsoft
2012-03-18 12:30:52 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2012-03-14 19:35:50 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-03-14 19:35:47 ----HD---- C:\WINDOWS\$hf_mig$
2012-03-14 19:35:44 ----SHD---- C:\WINDOWS\Installer
2012-03-14 19:33:31 ----A---- C:\WINDOWS\system32\MRT.exe
2012-03-12 11:40:58 ----A---- C:\WINDOWS\win.ini
2012-03-10 19:33:49 ----D---- C:\Program Files\Common Files
2012-03-10 19:27:56 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-03-10 19:27:54 ----D---- C:\WINDOWS\system32\drivers\umdf
2012-03-08 11:27:51 ----D---- C:\WINDOWS\system32\cs-cz
2012-03-08 11:27:51 ----D---- C:\WINDOWS\Help
2012-03-08 11:27:51 ----D---- C:\Program Files\Internet Explorer
2012-03-08 10:48:04 ----D---- C:\WINDOWS\Media
2012-03-08 10:45:24 ----D---- C:\WINDOWS\Debug
2012-03-07 23:27:11 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\vlc
2012-03-07 13:54:40 ----D---- C:\Program Files\uTorrent
2012-03-05 16:01:52 ----D---- C:\WINDOWS\system32\ReinstallBackups
2012-02-27 20:24:30 ----D---- C:\WINDOWS\WinSxS
2012-02-25 11:09:58 ----D---- C:\Program Files\RegClean Pro
2012-02-25 11:09:58 ----D---- C:\Documents and Settings\Vadimek\Data aplikací\Systweak
2012-02-25 11:06:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\SpeedBit
2012-02-25 11:05:49 ----SD---- C:\WINDOWS\Tasks
2012-02-25 11:05:46 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2012-02-25 11:03:05 ----D---- C:\WINDOWS\Minidump

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswNdis;avast! Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\aswNdis.sys [2012-02-23 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service; C:\WINDOWS\system32\drivers\aswNdis2.sys [2012-02-23 196440]
R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2008-04-13 46464]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 9728]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R0 xfilt;VIA SATA IDE Hot-plug Driver; C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 11264]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-02-23 24920]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 aswFW;avast! TDI Firewall driver; C:\WINDOWS\system32\drivers\aswFW.sys [2012-02-23 112984]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2012-02-23 24408]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-02-23 35672]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-02-23 610648]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-02-23 337112]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-02-23 53848]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 oreans32;oreans32; \??\C:\WINDOWS\system32\drivers\oreans32.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2011-11-15 112096]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-02-23 20696]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-02-23 95704]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2011-12-06 7490560]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdXP3.sys [2011-12-20 100368]
R3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-12-06 7067752]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt []
S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2004-04-15 42496]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 MSICPL;MSICPL; \??\E:\install4\MSICPL.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 PAC7302;e-Messenger 310; C:\WINDOWS\system32\DRIVERS\PAC7302.SYS [2007-06-14 457856]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 VIAudio;Zvukový řadič VIA AC'97 (WDM); C:\WINDOWS\system32\drivers\ac97via.sys [2004-08-03 84480]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-02-23 44768]
R2 avast! Firewall;avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [2012-02-23 131288]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-01-24 153376]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-12-06 643072]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2012-02-03 75136]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Vidím tam rootkit. Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[vadimek]

ComboFix 12-03-22.01 - Vadimek 24.03.2012 20:21:45.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1534.1030 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vadimek\Plocha\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Vadimek\Dokumenty\clip0003.exe.tmp
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\dllcache\dlimport.exe
D:\install.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-24 do 2012-03-24 )))))))))))))))))))))))))))))))
.
.
2012-03-23 22:35 . 2012-03-24 09:53 -------- d-----w- c:\documents and settings\Vadimek\M2Fish
2012-03-23 22:33 . 2012-03-24 09:53 12288 ----a-w- c:\documents and settings\Vadimek\Data aplikací\ProInject.exe
2012-03-23 22:01 . 2012-03-23 22:01 -------- d-----w- C:\rsit
2012-03-23 22:01 . 2012-03-23 22:01 -------- d-----w- c:\program files\trend micro
2012-03-23 18:35 . 2012-03-23 22:43 -------- d-----w- c:\program files\Metin2
2012-03-20 18:53 . 2012-03-20 18:53 -------- d-----w- c:\documents and settings\Vadimek\output
2012-03-20 18:25 . 2012-03-20 18:25 -------- d-----w- c:\documents and settings\Vadimek\Source
2012-03-18 18:46 . 2012-03-23 22:18 -------- d-----w- c:\program files\NCsoft
2012-03-18 18:44 . 2012-03-18 18:44 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\Pando_Temp
2012-03-18 18:43 . 2012-03-18 18:43 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\assembly
2012-03-12 10:20 . 2011-06-11 14:37 42672 ------w- c:\windows\system32\wbsys.dll
2012-03-12 10:20 . 2012-03-12 10:20 -------- d-----w- c:\program files\Stardock
2012-03-10 18:34 . 2012-03-10 18:34 -------- d-----w- c:\documents and settings\All Users\Data aplikací\NFS Underground
2012-03-10 18:33 . 2012-03-10 18:33 -------- d-----w- c:\program files\Common Files\DirectX
2012-03-09 12:05 . 2012-03-09 12:05 -------- d-sh--w- c:\documents and settings\Vadimek\PrivacIE
2012-03-08 10:28 . 2012-03-08 10:28 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2012-03-08 10:28 . 2012-03-08 10:28 -------- d-sh--w- c:\documents and settings\Vadimek\IETldCache
2012-03-08 09:49 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2012-03-08 09:48 . 2011-12-17 19:42 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2012-03-08 09:48 . 2011-12-17 19:42 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2012-03-08 09:48 . 2011-12-17 19:42 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2012-03-08 09:48 . 2011-12-17 19:42 2000384 -c----w- c:\windows\system32\dllcache\iertutil.dll
2012-03-08 09:48 . 2011-12-18 13:42 11082240 -c----w- c:\windows\system32\dllcache\ieframe.dll
2012-03-08 09:48 . 2011-12-17 19:42 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2012-03-08 09:48 . 2011-12-17 19:42 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2012-03-08 09:47 . 2012-03-08 09:47 -------- dc-h--w- c:\windows\ie8
2012-03-05 14:59 . 2012-03-05 14:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\McAfee
2012-03-05 14:57 . 2012-03-05 14:57 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\Mozilla
2012-03-04 18:00 . 2012-03-23 22:17 -------- d-----w- c:\documents and settings\Vadimek\Data aplikací\Toolbar4
2012-03-04 12:36 . 2012-03-05 15:00 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-27 19:25 . 2012-02-23 16:12 337112 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-02-27 19:25 . 2012-02-23 16:10 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-27 19:25 . 2012-02-23 16:13 112984 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-02-27 19:24 . 2012-02-23 16:12 196440 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-02-27 19:24 . 2012-02-23 16:10 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-02-27 19:24 . 2012-02-23 16:10 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-02-27 19:24 . 2012-02-23 16:12 610648 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-02-27 19:24 . 2012-02-23 16:11 24408 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-02-27 19:24 . 2012-02-23 16:10 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-02-27 19:24 . 2012-02-23 16:10 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-02-27 19:24 . 2012-02-23 16:07 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-27 19:23 . 2012-02-23 15:54 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2012-02-27 19:22 . 2012-02-23 16:23 41184 ----a-w- c:\windows\avastSS.scr
2012-02-27 19:22 . 2012-02-23 16:23 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-02-27 19:22 . 2012-02-27 19:22 -------- d-----w- c:\program files\AVAST Software
2012-02-27 19:22 . 2012-02-27 19:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-27 19:20 . 2012-02-27 19:20 -------- d-----w- c:\documents and settings\Vadimek\Data aplikací\Sereniti
2012-02-25 10:02 . 2012-02-25 10:02 -------- d-----w- c:\program files\CCleaner
2012-02-24 17:52 . 2012-02-24 17:52 -------- d-----w- c:\program files\IObit
2012-02-24 17:52 . 2012-02-24 17:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-24 10:21 . 2012-01-29 16:32 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-03-24 10:21 . 2012-02-04 22:59 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-03-24 10:21 . 2012-01-29 16:31 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-03-18 11:30 . 2012-01-29 16:31 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-02-16 20:10 . 2012-02-16 20:10 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys
2012-02-08 14:32 . 2012-02-08 19:16 122880 ----a-w- c:\windows\system32\steam_api.dll
2012-02-03 15:50 . 2012-01-29 16:31 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-02-03 09:57 . 2006-03-02 12:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-02-01 03:56 . 2012-01-29 15:29 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-01-24 21:15 . 2012-01-24 21:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-01-24 21:15 . 2012-01-24 21:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-24 20:46 . 2012-01-24 20:46 84480 ----a-w- c:\windows\system32\EasyHook32.dll
2012-01-24 20:46 . 2012-01-24 20:46 109216 ----a-w- c:\windows\system32\EasyHook64.dll
2012-01-11 19:07 . 2012-02-16 04:56 3072 ------w- c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2012-01-24 20:02 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-16 14:53 . 2012-03-05 14:57 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-02-23 16:23 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-03-06 741240]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-11-15 312376]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 98304]
"RTHDCPL"="RTHDCPL.EXE" [2011-12-05 20065384]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-02-23 4031368]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Vadimek\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Counter-Strike 1.6\\csko.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Counter-Strike 1.6\\hlds.exe"=
"d:\\Program Files\\QuadCoreM2\\pack\\core.bin"=
"d:\\Program Files\\bitComposer Games\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\xrEngine.exe"=
"d:\\Program Files\\bitComposer Games\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\dedicated\\xrEngine.exe"=
"d:\\Call of Duty 4\\iw3mp.exe"=
"d:\\Program Files\\Disney Interactive Studios\\Split Second\\SplitSecond.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58072:TCP"= 58072:TCP:Pando Media Booster
"58072:UDP"= 58072:UDP:Pando Media Booster
"56155:TCP"= 56155:TCP:Pando Media Booster
"56155:UDP"= 56155:UDP:Pando Media Booster
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [27.2.2012 20:23 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [27.2.2012 20:24 196440]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [27.2.2012 20:25 112984]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [27.2.2012 20:24 24408]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [27.2.2012 20:24 610648]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [27.2.2012 20:25 337112]
R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [16.2.2012 21:10 33824]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2012 20:25 20696]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [27.2.2012 20:22 131288]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [6.2.2012 16:06 100368]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8.2.2012 22:33 1691480]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt --> c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - PNKBSTRB
*NewlyCreated* - PNKBSTRK
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://home.speedbit.com/?aff=105
uInternet Settings,ProxyServer = 46.28.105.63:80
TCP: DhcpNameServer = 10.0.0.138 192.168.11.1 212.80.66.7
FF - ProfilePath - c:\documents and settings\Vadimek\Data aplikací\Mozilla\Firefox\Profiles\ysce1obo.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-24 20:26
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-57989841-630328440-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:41,e6,50,c1,59,7a,2f,ef,3c,58,ab,00,68,ac,73,da,e2,da,a2,22,a4,
cb,2f,3d,cd,1b,50,ba,c0,3b,d0,bc,98,14,96,44,55,f3,01,da,40,a2,e8,81,d2,37,\
"rkeysecu"=hex:fc,b0,87,5a,46,04,35,93,13,74,9f,65,af,ae,0e,06
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1216)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2012-03-24 20:28:26
ComboFix-quarantined-files.txt 2012-03-24 19:28
.
Před spuštěním: Volných bajtů: 15 349 641 216
Po spuštění: Volných bajtů: 15 414 292 480
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 9CF27AF22C88C3317B2A32CD16503C60

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\system32\drivers\oreans32.sys

Driver::
oreans32

Regnull::
[HKEY_USERS\S-1-5-21-57989841-630328440-725345543-1004\Software\SecuROM\License information*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[vadimek]

ComboFix 12-03-22.01 - Vadimek 25.03.2012 10:33:24.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1534.852 [GMT 2:00]
Spuštěný z: c:\documents and settings\Vadimek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vadimek\Plocha\CFScript.txt
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.
file zipped: c:\windows\system32\drivers\oreans32.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\oreans32.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_OREANS32
-------\Service_oreans32
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-25 do 2012-03-25 )))))))))))))))))))))))))))))))
.
.
2012-03-23 22:35 . 2012-03-24 09:53 -------- d-----w- c:\documents and settings\Vadimek\M2Fish
2012-03-23 22:33 . 2012-03-24 09:53 12288 ----a-w- c:\documents and settings\Vadimek\Data aplikací\ProInject.exe
2012-03-23 22:01 . 2012-03-23 22:01 -------- d-----w- C:\rsit
2012-03-23 22:01 . 2012-03-23 22:01 -------- d-----w- c:\program files\trend micro
2012-03-23 18:35 . 2012-03-23 22:43 -------- d-----w- c:\program files\Metin2
2012-03-20 18:53 . 2012-03-20 18:53 -------- d-----w- c:\documents and settings\Vadimek\output
2012-03-20 18:25 . 2012-03-20 18:25 -------- d-----w- c:\documents and settings\Vadimek\Source
2012-03-18 18:46 . 2012-03-23 22:18 -------- d-----w- c:\program files\NCsoft
2012-03-18 18:44 . 2012-03-18 18:44 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\Pando_Temp
2012-03-18 18:43 . 2012-03-18 18:43 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\assembly
2012-03-12 10:20 . 2011-06-11 14:37 42672 ------w- c:\windows\system32\wbsys.dll
2012-03-12 10:20 . 2012-03-12 10:20 -------- d-----w- c:\program files\Stardock
2012-03-10 18:34 . 2012-03-10 18:34 -------- d-----w- c:\documents and settings\All Users\Data aplikací\NFS Underground
2012-03-10 18:33 . 2012-03-10 18:33 -------- d-----w- c:\program files\Common Files\DirectX
2012-03-09 12:05 . 2012-03-09 12:05 -------- d-sh--w- c:\documents and settings\Vadimek\PrivacIE
2012-03-08 10:28 . 2012-03-08 10:28 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2012-03-08 10:28 . 2012-03-08 10:28 -------- d-sh--w- c:\documents and settings\Vadimek\IETldCache
2012-03-08 09:49 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2012-03-08 09:48 . 2011-12-17 19:42 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2012-03-08 09:48 . 2011-12-17 19:42 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2012-03-08 09:48 . 2011-12-17 19:42 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2012-03-08 09:48 . 2011-12-17 19:42 2000384 -c----w- c:\windows\system32\dllcache\iertutil.dll
2012-03-08 09:48 . 2011-12-18 13:42 11082240 -c----w- c:\windows\system32\dllcache\ieframe.dll
2012-03-08 09:48 . 2011-12-17 19:42 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2012-03-08 09:48 . 2011-12-17 19:42 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2012-03-08 09:47 . 2012-03-08 09:47 -------- dc-h--w- c:\windows\ie8
2012-03-05 14:59 . 2012-03-05 14:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\McAfee
2012-03-05 14:57 . 2012-03-05 14:57 -------- d-----w- c:\documents and settings\Vadimek\Local Settings\Data aplikací\Mozilla
2012-03-04 18:00 . 2012-03-23 22:17 -------- d-----w- c:\documents and settings\Vadimek\Data aplikací\Toolbar4
2012-03-04 12:36 . 2012-03-05 15:00 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-27 19:25 . 2012-02-23 16:12 337112 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-02-27 19:25 . 2012-02-23 16:10 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-27 19:25 . 2012-02-23 16:13 112984 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-02-27 19:24 . 2012-02-23 16:12 196440 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-02-27 19:24 . 2012-02-23 16:10 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-02-27 19:24 . 2012-02-23 16:10 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-02-27 19:24 . 2012-02-23 16:12 610648 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-02-27 19:24 . 2012-02-23 16:11 24408 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-02-27 19:24 . 2012-02-23 16:10 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-02-27 19:24 . 2012-02-23 16:10 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-02-27 19:24 . 2012-02-23 16:07 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-02-27 19:23 . 2012-02-23 15:54 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2012-02-27 19:22 . 2012-02-23 16:23 41184 ----a-w- c:\windows\avastSS.scr
2012-02-27 19:22 . 2012-02-23 16:23 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-02-27 19:22 . 2012-02-27 19:22 -------- d-----w- c:\program files\AVAST Software
2012-02-27 19:22 . 2012-02-27 19:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVAST Software
2012-02-27 19:20 . 2012-02-27 19:20 -------- d-----w- c:\documents and settings\Vadimek\Data aplikací\Sereniti
2012-02-25 10:02 . 2012-02-25 10:02 -------- d-----w- c:\program files\CCleaner
2012-02-24 17:52 . 2012-02-24 17:52 -------- d-----w- c:\program files\IObit
2012-02-24 17:52 . 2012-02-24 17:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-24 10:21 . 2012-01-29 16:32 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-03-24 10:21 . 2012-02-04 22:59 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-03-24 10:21 . 2012-01-29 16:31 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-03-18 11:30 . 2012-01-29 16:31 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-02-08 14:32 . 2012-02-08 19:16 122880 ----a-w- c:\windows\system32\steam_api.dll
2012-02-03 15:50 . 2012-01-29 16:31 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-02-03 09:57 . 2006-03-02 12:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-02-01 03:56 . 2012-01-29 15:29 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2012-01-24 21:15 . 2012-01-24 21:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-01-24 21:15 . 2012-01-24 21:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-24 20:46 . 2012-01-24 20:46 84480 ----a-w- c:\windows\system32\EasyHook32.dll
2012-01-24 20:46 . 2012-01-24 20:46 109216 ----a-w- c:\windows\system32\EasyHook64.dll
2012-01-11 19:07 . 2012-02-16 04:56 3072 ------w- c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2012-01-24 20:02 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-16 14:53 . 2012-03-05 14:57 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-24_19.26.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-25 08:40 . 2012-03-25 08:40 16384 c:\windows\temp\Perflib_Perfdata_16c.dat
+ 2006-03-02 12:00 . 2012-03-25 08:29 67436 c:\windows\system32\perfc009.dat
+ 2006-03-02 12:00 . 2012-03-25 08:29 78048 c:\windows\system32\perfc005.dat
+ 2006-03-02 12:00 . 2012-03-25 08:29 431826 c:\windows\system32\perfh009.dat
+ 2006-03-02 12:00 . 2012-03-25 08:29 428338 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-02-23 16:23 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-03-06 741240]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-11-15 312376]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 98304]
"RTHDCPL"="RTHDCPL.EXE" [2011-12-05 20065384]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-02-23 4031368]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Vadimek\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Counter-Strike 1.6\\csko.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Counter-Strike 1.6\\hlds.exe"=
"d:\\Program Files\\QuadCoreM2\\pack\\core.bin"=
"d:\\Program Files\\bitComposer Games\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\xrEngine.exe"=
"d:\\Program Files\\bitComposer Games\\S.T.A.L.K.E.R. - Call of Pripyat\\bin\\dedicated\\xrEngine.exe"=
"d:\\Call of Duty 4\\iw3mp.exe"=
"d:\\Program Files\\Disney Interactive Studios\\Split Second\\SplitSecond.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58072:TCP"= 58072:TCP:Pando Media Booster
"58072:UDP"= 58072:UDP:Pando Media Booster
"56155:TCP"= 56155:TCP:Pando Media Booster
"56155:UDP"= 56155:UDP:Pando Media Booster
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [27.2.2012 21:23 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [27.2.2012 21:24 196440]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [27.2.2012 21:25 112984]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [27.2.2012 21:24 24408]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [27.2.2012 21:24 610648]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [27.2.2012 21:25 337112]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.2.2012 21:25 20696]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [27.2.2012 21:22 131288]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [6.2.2012 17:06 100368]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8.2.2012 23:33 1691480]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt --> c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://home.speedbit.com/?aff=105
uInternet Settings,ProxyServer = 46.28.105.63:80
TCP: DhcpNameServer = 10.0.0.138 192.168.11.1 212.80.66.7
FF - ProfilePath - c:\documents and settings\Vadimek\Data aplikací\Mozilla\Firefox\Profiles\ysce1obo.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-25 10:40
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1220)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2860)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2012-03-25 10:43:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-25 08:43
ComboFix2.txt 2012-03-24 19:28
.
Před spuštěním: Volných bajtů: 15 706 787 840
Po spuštění: Volných bajtů: 15 637 405 696
.
- - End Of File - - 6DB8B4CF992EEF068BD5B9BCE0D0625D

[Rudy]

Log již vypadá čistý. Nastala nějaká změna?

[vadimek]

Nepatrná ale i tak díky

[Rudy]

Zkuste přeinstalovat .NET Framework.

[vadimek]

Pokusím se

[Rudy]

OK.