Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Skype virus

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Skype virus

#1 Příspěvek od Yama »

Dobrý den, přítelkyně klikla na zprávu "hej je to vase skype profil fotku" od kamarádky, zkoušel jsem to projet Microsoft Security Essentials, pak zkušební verzí ESET NOD32 Antivirus 6, ale bez úspěchů. Děkuji za pomoc. Přikládám log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Lucie at 2012-11-07 19:53:43
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 3 GB (3%) free of 82 GB
Total RAM: 1014 MB (14% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:54:01, on 7.11.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
C:\Program Files\EeePC\CapsHook\CapsHook.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Elantech\ETDCtrlHelper.exe
C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\eInstruction\Device Manager\Launch.exe
C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Lucie.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.myplaycity.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto
O4 - HKLM\..\Run: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKLM\..\Run: [EeeSplendidAgent] C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CapsHook] C:\Program Files\EeePC\CapsHook\CapsHook.exe
O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [NVIDIA driver monitor] c:\windows\nvsvc32.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ETDWare] %ProgramFiles%\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [syshost32] C:\WINDOWS\Installer\{FA956D06-C224-9D12-B987-AA38994A6EA3}\syshost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [NVIDIA driver monitor] c:\windows\nvsvc32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PCSpeedUp] "C:\Program Files\Zrychleni Pocitace\PCSpeedUp.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Qmkyko] C:\Documents and Settings\Lucie\Data aplikací\Qmkyko.exe
O4 - HKCU\..\Run: [Microsoft DLL Registration] C:\Documents and Settings\Lucie\Data aplikací\regsrv64.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: eInstruction Device Manager.lnk = C:\Program Files\eInstruction\Device Manager\Launch.exe
O4 - Global Startup: SuperHybridEngine.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 11212 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1435307766-697870470-2021886438-1006Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1435307766-697870470-2021886438-1006UA.job
C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{4C726153-CAD8-42D6-A282-4C6C0AFD3417}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-08-13 4120256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-09-28 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-09-28 173592]
"LiveUpdate"=C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [2010-01-29 751592]
"SynAsusAcpi"=C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe []
"EeeSplendidAgent"=C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe []
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-14 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-14 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"CapsHook"=C:\Program Files\EeePC\CapsHook\CapsHook.exe [2010-05-28 445344]
"AsusTray"=C:\Program Files\EeePC\ACPI\AsTray.exe [2009-06-26 118784]
"AsusEPCMonitor"=C:\Program Files\EeePC\ACPI\AsEPCMon.exe [2009-05-08 98304]
"AsusACPIServer"=C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe [2010-05-17 1246632]
"NVIDIA driver monitor"=c:\windows\nvsvc32.exe []
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-04-21 18789408]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-06-10 548744]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-05-30 59280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2011-10-24 421888]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-09-12 947176]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2012-06-07 421776]
"syshost32"=C:\WINDOWS\Installer\{FA956D06-C224-9D12-B987-AA38994A6EA3}\syshost.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Eee Docking"=C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [2010-03-25 402096]
"Google Update"=C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-12-19 136176]
"NVIDIA driver monitor"=c:\windows\nvsvc32.exe []
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background []
"PCSpeedUp"=C:\Program Files\Zrychleni Pocitace\PCSpeedUp.exe []
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ICQ"=C:\Program Files\ICQ7.4\ICQ.exe silent loginmode=4 []
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Qmkyko"=C:\Documents and Settings\Lucie\Data aplikací\Qmkyko.exe []
"Microsoft DLL Registration"=C:\Documents and Settings\Lucie\Data aplikací\regsrv64.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe /background []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe [2009-09-28 141336]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
eInstruction Device Manager.lnk - C:\Program Files\eInstruction\Device Manager\Launch.exe
SuperHybridEngine.lnk - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe

C:\Documents and Settings\Lucie\Nabídka Start\Programy\Po spuštění
Dropbox.lnk - C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-09-24 205312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-19 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\worms reloaded\WormsReloaded.exe"="C:\Program Files\Steam\steamapps\common\worms reloaded\WormsReloaded.exe:*:Enabled:Worms Reloaded"
"C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe"="C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox"
"C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe"="C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe:*:Enabled:Plants vs. Zombies: Game of the Year"
"C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe"="C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\eInstruction\Device Manager\Launch.exe"="C:\Program Files\eInstruction\Device Manager\Launch.exe:*:Enabled:eIDeviceManager"
"C:\Program Files\eInstruction\Device Manager\jre\bin\java.exe"="C:\Program Files\eInstruction\Device Manager\jre\bin\java.exe:*:Enabled:eIDeviceManagerJava"
"C:\Program Files\eInstruction\Device Manager\jre\bin\javaw.exe"="C:\Program Files\eInstruction\Device Manager\jre\bin\javaw.exe:*:Enabled:eIDeviceManagerJavaw"
"C:\Documents and Settings\Lucie\Local Settings\Temp\TeamViewer\Version7\TeamViewer.exe"="C:\Documents and Settings\Lucie\Local Settings\Temp\TeamViewer\Version7\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.yv12"=yv12vfw.dll
"vidc.MPG4"=MPG4c32.dll
"vidc.MP42"=MPG4c32.dll
"vidc.MP43"=MPG4c32.dll
"vidc.tscc"=tsccvid.dll

======List of files/folders created in the last 1 month======

2012-11-07 19:53:44 ----D---- C:\Program Files\trend micro
2012-11-07 19:53:43 ----D---- C:\rsit
2012-11-07 17:15:44 ----A---- C:\Documents and Settings\Lucie\Data aplikací\4.exe
2012-11-07 14:05:45 ----A---- C:\Documents and Settings\Lucie\Data aplikací\6DD.exe
2012-11-07 14:05:42 ----A---- C:\Documents and Settings\Lucie\Data aplikací\6DC.exe
2012-11-07 12:52:51 ----A---- C:\Documents and Settings\Lucie\Data aplikací\558.exe
2012-11-07 12:16:28 ----A---- C:\Documents and Settings\Lucie\Data aplikací\4A3.exe
2012-11-07 10:22:32 ----A---- C:\Documents and Settings\Lucie\Data aplikací\4E.exe
2012-11-07 09:34:21 ----A---- C:\Documents and Settings\Lucie\Data aplikací\4B.exe
2012-11-07 09:19:05 ----A---- C:\Documents and Settings\Lucie\Data aplikací\4A.exe
2012-11-07 08:22:19 ----A---- C:\Documents and Settings\Lucie\Data aplikací\45.exe
2012-11-07 07:59:11 ----A---- C:\Documents and Settings\Lucie\Data aplikací\27.exe
2012-11-07 07:23:52 ----A---- C:\Documents and Settings\Lucie\Data aplikací\2.exe
2012-11-07 07:02:38 ----A---- C:\Documents and Settings\Lucie\Data aplikací\A.exe
2012-11-07 06:29:33 ----A---- C:\Documents and Settings\Lucie\Data aplikací\9.exe
2012-11-07 05:42:00 ----A---- C:\Documents and Settings\Lucie\Data aplikací\7.exe
2012-11-06 23:32:26 ----A---- C:\Documents and Settings\Lucie\Data aplikací\2EA.exe
2012-11-06 21:59:06 ----A---- C:\Documents and Settings\Lucie\Data aplikací\2E6.exe
2012-11-06 21:30:57 ----A---- C:\Documents and Settings\Lucie\Data aplikací\2D8.exe
2012-11-06 21:07:38 ----A---- C:\Documents and Settings\Lucie\Data aplikací\2B4.exe
2012-11-06 19:32:58 ----D---- C:\WINDOWS\system32\NtmsData
2012-11-06 18:00:00 ----A---- C:\Documents and Settings\Lucie\Data aplikací\20C.exe
2012-11-06 17:17:58 ----A---- C:\Documents and Settings\Lucie\Data aplikací\1A6.exe
2012-10-14 13:25:44 ----D---- C:\Documents and Settings\Lucie\Data aplikací\GTCO CalComp
2012-10-14 13:21:45 ----D---- C:\Documents and Settings\Lucie\Data aplikací\eInstruction
2012-10-14 13:16:38 ----A---- C:\WINDOWS\system32\tsccvid.dll
2012-10-14 13:13:15 ----A---- C:\Program Files\Common Files\eInstruction.ini
2012-10-14 13:07:47 ----D---- C:\Program Files\eInstruction
2012-10-11 17:57:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2724197$
2012-10-11 17:49:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2756822$
2012-10-11 17:49:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2749655$
2012-10-11 17:48:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2661254-v2$

======List of files/folders modified in the last 1 month======

2012-11-07 19:53:44 ----RD---- C:\Program Files
2012-11-07 19:53:33 ----D---- C:\WINDOWS\Prefetch
2012-11-07 19:52:25 ----D---- C:\WINDOWS\Temp
2012-11-07 19:49:42 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Dropbox
2012-11-07 19:49:37 ----RD---- C:\My Dropbox
2012-11-07 19:46:47 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-07 19:46:46 ----D---- C:\WINDOWS
2012-11-07 19:44:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-11-07 19:43:34 ----SHD---- C:\WINDOWS\Installer
2012-11-07 19:39:49 ----HD---- C:\WINDOWS\inf
2012-11-07 19:39:46 ----D---- C:\WINDOWS\system32\drivers
2012-11-07 18:52:54 ----SD---- C:\WINDOWS\Tasks
2012-11-07 07:19:19 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-11-07 07:19:19 ----D---- C:\Program Files\Microsoft
2012-11-07 06:57:53 ----D---- C:\WINDOWS\Registration
2012-11-07 03:02:20 ----D---- C:\WINDOWS\system32
2012-11-07 02:42:38 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Skype
2012-11-06 19:32:57 ----D---- C:\WINDOWS\repair
2012-11-06 19:18:46 ----D---- C:\WINDOWS\system32\CatRoot
2012-11-03 19:31:24 ----D---- C:\Documents and Settings\Lucie\Data aplikací\U3
2012-11-02 19:10:43 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Mozilla
2012-10-31 21:58:09 ----D---- C:\Documents and Settings\Lucie\Data aplikací\SoftGrid Client
2012-10-31 16:55:09 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-10-14 13:14:03 ----D---- C:\WINDOWS\WinSxS
2012-10-14 13:13:31 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-10-14 13:13:15 ----D---- C:\Program Files\Common Files
2012-10-11 17:58:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2012-10-11 17:57:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-10-11 17:50:10 ----A---- C:\WINDOWS\system32\MRT.exe
2012-10-11 17:49:58 ----A---- C:\WINDOWS\imsins.BAK
2012-10-10 20:38:13 ----HD---- C:\WINDOWS\$hf_mig$
2012-10-08 20:21:25 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2009-06-04 330264]
R0 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2012-08-30 193552]
R1 AsUpIO;AsUpIO; C:\WINDOWS\system32\drivers\AsUpIO.sys [2010-03-31 11520]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2009-08-12 1582624]
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2008-04-08 10752]
R3 ETD;ELAN PS/2 Port Input Device; C:\WINDOWS\system32\DRIVERS\ETD.sys [2010-07-21 102912]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-09-24 6301696]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-04-21 5956608]
R3 kbfiltr;Keyboard Filter; C:\WINDOWS\system32\DRIVERS\kbfiltr.sys [2008-11-03 13880]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-07-27 44032]
R3 rtsuvc;Realtek USB2.0 PC Camera; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2010-02-04 73088]
R3 Sftfs;Sftfs; C:\WINDOWS\system32\DRIVERS\Sftfsxp.sys [2011-10-01 584680]
R3 Sftplay;Sftplay; C:\WINDOWS\system32\DRIVERS\Sftplayxp.sys [2011-10-01 209512]
R3 Sftredir;Sftredir; C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys [2011-10-01 20584]
R3 Sftvol;Sftvol; C:\WINDOWS\system32\DRIVERS\Sftvolxp.sys [2011-10-01 18280]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2011-04-21 1684736]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys []
S3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys []
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys []
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2011-04-21 1389056]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-29 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-29 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-05-24 55184]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-09-12 20472]
R2 sftlist;Application Virtualization Client; C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
R2 Skype C2C Service;Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-06-07 821648]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-13 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-06-07 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-13 116648]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-06-11 136120]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-03-16 407336]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-06 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#2 Příspěvek od Rudy »

Zdravím!
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#3 Příspěvek od Yama »

Posílám log z ComboFix:

ComboFix 12-11-06.03 - Lucie 07.11.2012 22:18:07.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.602 [GMT 1:00]
Spuštěný z: c:\documents and settings\Lucie\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\Lucie\LOCALS~1\Temp\abt96500\BTCheckMS.dll
c:\documents and settings\All Users\FullRemove.exe
c:\documents and settings\Lucie\Data aplikací\1A6.exe
c:\documents and settings\Lucie\Data aplikací\20C.exe
c:\documents and settings\Lucie\Data aplikací\2B4.exe
c:\documents and settings\Lucie\Data aplikací\4.exe
c:\documents and settings\Lucie\Data aplikací\4B.exe
c:\documents and settings\Lucie\Data aplikací\558.exe
c:\documents and settings\Lucie\Data aplikací\6DD.exe
c:\documents and settings\Lucie\Local Settings\Temp\abt96500\BTCheckMS.dll
C:\install.exe
c:\windows\EventSystem.log
c:\windows\system32\service
c:\windows\system32\service\12052010_TIS17_PccScan.log
c:\windows\system32\Thumbs.db
c:\windows\system32\TZLog.log
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-07 do 2012-11-07 )))))))))))))))))))))))))))))))
.
.
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- c:\program files\trend micro
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- C:\rsit
2012-11-07 16:25 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{956806A4-977F-4C41-9813-4C6BC983D3DB}\mpengine.dll
2012-11-07 13:05 . 2012-11-07 13:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2012-11-07 13:05 . 2012-11-07 13:05 49056 ----a-w- c:\documents and settings\Lucie\Data aplikací\6DC.exe
2012-11-07 10:54 . 2012-11-07 10:54 -------- d-----w- c:\documents and settings\Lucie\Local Settings\Data aplikací\ESET
2012-11-07 09:22 . 2012-11-07 09:22 56320 ----a-w- c:\documents and settings\Lucie\Data aplikací\4E.exe
2012-11-07 06:02 . 2012-11-07 06:02 56320 ----a-w- c:\documents and settings\Lucie\Data aplikací\A.exe
2012-11-07 05:29 . 2012-11-07 05:29 56320 ----a-w- c:\documents and settings\Lucie\Data aplikací\9.exe
2012-11-07 04:42 . 2012-11-07 04:42 56320 ----a-w- c:\documents and settings\Lucie\Data aplikací\7.exe
2012-11-06 18:32 . 2012-11-06 18:33 -------- d-----w- c:\windows\system32\NtmsData
2012-11-06 13:40 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-14 12:25 . 2012-10-14 12:25 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\GTCO CalComp
2012-10-14 12:21 . 2012-10-14 12:21 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\eInstruction
2012-10-14 12:16 . 2007-03-08 02:53 102400 ----a-w- c:\windows\system32\tsccvid.dll
2012-10-14 12:07 . 2012-10-14 12:15 -------- d-----w- c:\program files\eInstruction
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 19:21 . 2012-04-10 12:55 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 19:21 . 2011-06-14 09:30 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-30 20:03 . 2010-10-24 20:25 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:18 . 2009-12-23 18:07 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:18 . 2009-12-23 18:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:18 . 2009-12-23 18:07 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2009-12-23 18:07 385024 ----a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2009-12-23 18:07 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-23 06:27 . 2008-04-14 08:06 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-23 06:27 . 2008-04-14 08:06 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-03-28 17:44 . 2011-03-28 17:44 16409960 ----a-w- c:\program files\spybotsd162.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2010-03-25 402096]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-28 173592]
"LiveUpdate"="c:\program files\Asus\LiveUpdate\LiveUpdate.exe" [2010-01-29 751592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"CapsHook"="c:\program files\EeePC\CapsHook\CapsHook.exe" [2010-05-28 445344]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-06-26 118784]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-05-08 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2010-05-17 1246632]
"RTHDCPL"="RTHDCPL.EXE" [2011-04-21 18789408]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2010-06-10 548744]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
c:\documents and settings\Lucie\Nabídka Start\Programy\Po spuštění\
Dropbox.lnk - c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
eInstruction Device Manager.lnk - c:\program files\eInstruction\Device Manager\Launch.exe [2012-10-14 4910904]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2010-3-18 385024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-28 13:59 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\worms reloaded\\WormsReloaded.exe"=
"c:\\Documents and Settings\\Lucie\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Documents and Settings\\Lucie\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\Launch.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\java.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\javaw.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [18.3.2010 0:51 11520]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [4.1.2012 14:22 822624]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [1.10.2011 8:30 508776]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13.8.2012 12:33 3064000]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [27.5.2011 20:40 102912]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [3.11.2009 9:34 44032]
R3 rtsuvc;Realtek USB2.0 PC Camera;c:\windows\system32\drivers\rtsuvc.sys [13.11.2010 23:52 73088]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [2.12.2009 22:23 584680]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [2.12.2009 22:23 209512]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [2.12.2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [2.12.2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [1.10.2011 8:30 219496]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7.6.2012 18:12 160944]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [21.4.2011 20:16 1684736]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:21]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-07 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 15:25]
.
2012-11-07 c:\windows\Tasks\User_Feed_Synchronization-{4C726153-CAD8-42D6-A282-4C6C0AFD3417}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.myplaycity.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 212.65.193.157
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-PCSpeedUp - c:\program files\Zrychleni Pocitace\PCSpeedUp.exe
HKCU-Run-ICQ - c:\program files\ICQ7.4\ICQ.exe
HKCU-Run-Qmkyko - c:\documents and settings\Lucie\Data aplikací\Qmkyko.exe
HKLM-Run-SynAsusAcpi - c:\program files\Synaptics\SynTP\SynAsusAcpi.exe
HKLM-Run-EeeSplendidAgent - c:\program files\ASUS\EPC\EeeSplendid\AsAgent.exe
HKLM-Run-syshost32 - c:\windows\Installer\{FA956D06-C224-9D12-B987-AA38994A6EA3}\syshost.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-07 22:33
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2492)
c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxext.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2012-11-07 22:43:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-07 21:42
.
Před spuštěním: 3 092 099 072
Po spuštění: 4 750 553 088
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 37B80E40B729D5DF235B59691D14CE39
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#4 Příspěvek od Rudy »

Ještě dočistíme.Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Collect::
c:\documents and settings\Lucie\Data aplikací\4E.exe
c:\documents and settings\Lucie\Data aplikací\A.exe
c:\documents and settings\Lucie\Data aplikací\9.exe
c:\documents and settings\Lucie\Data aplikací\7.exe

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nadf ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#5 Příspěvek od Yama »

Nejsem z toho moc moudrý, dle příkazů by měl být zastaven Google update v tasku a on tam pořád je.

ComboFix 12-11-06.03 - Lucie 08.11.2012 22:10:29.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.482 [GMT 1:00]
Spuštěný z: c:\documents and settings\Lucie\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lucie\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-08 do 2012-11-08 )))))))))))))))))))))))))))))))
.
.
2012-11-08 21:07 . 2012-11-08 21:07 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{6608DFD6-CA96-4AD2-B4FE-FEBC00D95BD5}\MpKsl3e91c15c.sys
2012-11-08 20:59 . 2012-11-08 20:59 56200 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{6608DFD6-CA96-4AD2-B4FE-FEBC00D95BD5}\offreg.dll
2012-11-08 17:18 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{6608DFD6-CA96-4AD2-B4FE-FEBC00D95BD5}\mpengine.dll
2012-11-07 21:51 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- c:\program files\trend micro
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- C:\rsit
2012-11-07 13:05 . 2012-11-07 13:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2012-11-07 13:05 . 2012-11-07 13:05 49056 ----a-w- c:\documents and settings\Lucie\Data aplikací\6DC.exe
2012-11-07 10:54 . 2012-11-07 10:54 -------- d-----w- c:\documents and settings\Lucie\Local Settings\Data aplikací\ESET
2012-11-06 18:32 . 2012-11-06 18:33 -------- d-----w- c:\windows\system32\NtmsData
2012-10-14 12:25 . 2012-10-14 12:25 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\GTCO CalComp
2012-10-14 12:21 . 2012-10-14 12:21 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\eInstruction
2012-10-14 12:16 . 2007-03-08 02:53 102400 ----a-w- c:\windows\system32\tsccvid.dll
2012-10-14 12:07 . 2012-10-14 12:15 -------- d-----w- c:\program files\eInstruction
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 19:21 . 2012-04-10 12:55 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 19:21 . 2011-06-14 09:30 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-30 20:03 . 2010-10-24 20:25 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:18 . 2009-12-23 18:07 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:18 . 2009-12-23 18:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:18 . 2009-12-23 18:07 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2009-12-23 18:07 385024 ----a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2009-12-23 18:07 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-23 06:27 . 2008-04-14 08:06 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-23 06:27 . 2008-04-14 08:06 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-03-28 17:44 . 2011-03-28 17:44 16409960 ----a-w- c:\program files\spybotsd162.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2010-03-25 402096]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-28 173592]
"LiveUpdate"="c:\program files\Asus\LiveUpdate\LiveUpdate.exe" [2010-01-29 751592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"CapsHook"="c:\program files\EeePC\CapsHook\CapsHook.exe" [2010-05-28 445344]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-06-26 118784]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-05-08 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2010-05-17 1246632]
"RTHDCPL"="RTHDCPL.EXE" [2011-04-21 18789408]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2010-06-10 548744]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
c:\documents and settings\Lucie\Nabídka Start\Programy\Po spuštění\
Dropbox.lnk - c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
eInstruction Device Manager.lnk - c:\program files\eInstruction\Device Manager\Launch.exe [2012-10-14 4910904]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2010-3-18 385024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-28 13:59 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\worms reloaded\\WormsReloaded.exe"=
"c:\\Documents and Settings\\Lucie\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Documents and Settings\\Lucie\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\Launch.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\java.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\javaw.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [18.3.2010 0:51 11520]
R1 MpKsl3e91c15c;MpKsl3e91c15c;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{6608DFD6-CA96-4AD2-B4FE-FEBC00D95BD5}\MpKsl3e91c15c.sys [8.11.2012 22:07 29904]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [4.1.2012 14:22 822624]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [1.10.2011 8:30 508776]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13.8.2012 12:33 3064000]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [27.5.2011 20:40 102912]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [3.11.2009 9:34 44032]
R3 rtsuvc;Realtek USB2.0 PC Camera;c:\windows\system32\drivers\rtsuvc.sys [13.11.2010 23:52 73088]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [2.12.2009 22:23 584680]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [2.12.2009 22:23 209512]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [2.12.2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [2.12.2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [1.10.2011 8:30 219496]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7.6.2012 18:12 160944]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [21.4.2011 20:16 1684736]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:21]
.
2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-08 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 15:25]
.
2012-11-08 c:\windows\Tasks\User_Feed_Synchronization-{4C726153-CAD8-42D6-A282-4C6C0AFD3417}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.myplaycity.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 212.65.193.157
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-08 22:24
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2340)
c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxext.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2012-11-08 22:33:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-08 21:33
ComboFix2.txt 2012-11-07 21:43
.
Před spuštěním: 4 813 815 808
Po spuštění: 4 847 452 160
.
- - End Of File - - 3EC9D11FE1C58A0D59B14D313E6194FD
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#6 Příspěvek od Rudy »

Ještě jednou spusťte CF tímto skriptem:
KillAll::

Collect::
c:\documents and settings\Lucie\Data aplikací\6DC.exe

Reboot::
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#7 Příspěvek od Yama »

Další log:

ComboFix 12-11-06.03 - Lucie 08.11.2012 23:04:24.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.412 [GMT 1:00]
Spuštěný z: c:\documents and settings\Lucie\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lucie\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
file zipped: c:\documents and settings\Lucie\Data aplikací\6DC.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-10-08 do 2012-11-08 )))))))))))))))))))))))))))))))
.
.
2012-11-08 21:53 . 2012-11-08 21:53 56200 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{114BB84B-46D0-4F4A-8444-79ED81DD17F7}\offreg.dll
2012-11-08 21:53 . 2012-11-08 21:53 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{114BB84B-46D0-4F4A-8444-79ED81DD17F7}\MpKsl80b325d8.sys
2012-11-08 21:50 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{114BB84B-46D0-4F4A-8444-79ED81DD17F7}\mpengine.dll
2012-11-08 21:48 . 2012-10-12 05:56 6918632 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- c:\program files\trend micro
2012-11-07 18:53 . 2012-11-07 18:54 -------- d-----w- C:\rsit
2012-11-07 13:05 . 2012-11-07 13:05 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2012-11-07 13:05 . 2012-11-07 13:05 49056 ----a-w- c:\documents and settings\Lucie\Data aplikací\6DC.exe
2012-11-07 10:54 . 2012-11-07 10:54 -------- d-----w- c:\documents and settings\Lucie\Local Settings\Data aplikací\ESET
2012-11-06 18:32 . 2012-11-06 18:33 -------- d-----w- c:\windows\system32\NtmsData
2012-10-14 12:25 . 2012-10-14 12:25 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\GTCO CalComp
2012-10-14 12:21 . 2012-10-14 12:21 -------- d-----w- c:\documents and settings\Lucie\Data aplikací\eInstruction
2012-10-14 12:16 . 2007-03-08 02:53 102400 ----a-w- c:\windows\system32\tsccvid.dll
2012-10-14 12:07 . 2012-10-14 12:15 -------- d-----w- c:\program files\eInstruction
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 19:21 . 2012-04-10 12:55 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 19:21 . 2011-06-14 09:30 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-30 20:03 . 2010-10-24 20:25 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:18 . 2009-12-23 18:07 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:18 . 2009-12-23 18:07 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:18 . 2009-12-23 18:07 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2009-12-23 18:07 385024 ----a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2009-12-23 18:07 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-23 06:27 . 2008-04-14 08:06 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-23 06:27 . 2008-04-14 08:06 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-03-28 17:44 . 2011-03-28 17:44 16409960 ----a-w- c:\program files\spybotsd162.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2010-03-25 402096]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-28 173592]
"LiveUpdate"="c:\program files\Asus\LiveUpdate\LiveUpdate.exe" [2010-01-29 751592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"CapsHook"="c:\program files\EeePC\CapsHook\CapsHook.exe" [2010-05-28 445344]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-06-26 118784]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-05-08 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2010-05-17 1246632]
"RTHDCPL"="RTHDCPL.EXE" [2011-04-21 18789408]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2010-06-10 548744]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
c:\documents and settings\Lucie\Nabídka Start\Programy\Po spuštění\
Dropbox.lnk - c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
eInstruction Device Manager.lnk - c:\program files\eInstruction\Device Manager\Launch.exe [2012-10-14 4910904]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2010-3-18 385024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-28 13:59 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\worms reloaded\\WormsReloaded.exe"=
"c:\\Documents and Settings\\Lucie\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Documents and Settings\\Lucie\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\Launch.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\java.exe"=
"c:\\Program Files\\eInstruction\\Device Manager\\jre\\bin\\javaw.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [18.3.2010 0:51 11520]
R1 MpKsl80b325d8;MpKsl80b325d8;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{114BB84B-46D0-4F4A-8444-79ED81DD17F7}\MpKsl80b325d8.sys [8.11.2012 22:53 29904]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [4.1.2012 14:22 822624]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [1.10.2011 8:30 508776]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13.8.2012 12:33 3064000]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [27.5.2011 20:40 102912]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [3.11.2009 9:34 44032]
R3 rtsuvc;Realtek USB2.0 PC Camera;c:\windows\system32\drivers\rtsuvc.sys [13.11.2010 23:52 73088]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [2.12.2009 22:23 584680]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [2.12.2009 22:23 209512]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [2.12.2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [2.12.2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [1.10.2011 8:30 219496]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7.6.2012 18:12 160944]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [21.4.2011 20:16 1684736]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:21]
.
2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 18:52]
.
2012-11-08 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 15:25]
.
2012-11-08 c:\windows\Tasks\User_Feed_Synchronization-{4C726153-CAD8-42D6-A282-4C6C0AFD3417}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.myplaycity.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 212.65.193.157
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-08 23:17
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3264)
c:\documents and settings\Lucie\Data aplikací\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\RTHDCPL.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2012-11-08 23:26:41 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-11-08 22:26
ComboFix2.txt 2012-11-08 21:33
ComboFix3.txt 2012-11-07 21:43
.
Před spuštěním: 4 787 814 400
Po spuštění: 4 782 993 408
.
- - End Of File - - 9CA0BF79590E9FFEC2ADA3F631B18AD4
Nahr nˇ probŘhlo ŁspŘçnŘ
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#8 Příspěvek od Rudy »

Šmejd se nám stále obnovuje. Udělejte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#9 Příspěvek od Yama »

Log z AVPTool: (program mám nadále spuštěný)

Status: Deleted (events: 120)
10.11.2012 13:16:53 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{0ED1A7B0-F9F1-39A0-1C75-8F74E1F3B608}-4E.exe High
10.11.2012 13:16:46 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{1BC1120F-3E33-68ED-6CCA-AB312F55DCD5}-2.exe High
10.11.2012 13:16:57 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{128F1DAE-A66F-489B-0DB0-841E01FFE25F}-49.exe High
10.11.2012 13:16:53 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{0ED1A7B0-F9F1-39A0-1C75-8F74E1F3B608}-4E.exe//PE-Crypt.XorPE High
10.11.2012 13:16:46 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{1BC1120F-3E33-68ED-6CCA-AB312F55DCD5}-2.exe//PE-Crypt.XorPE High
10.11.2012 13:16:57 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{128F1DAE-A66F-489B-0DB0-841E01FFE25F}-49.exe//PE-Crypt.XorPE High
10.11.2012 13:17:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{1D2B631A-C87F-584C-E461-D0BFA0A06731}-2.exe High
10.11.2012 13:17:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{1D2B631A-C87F-584C-E461-D0BFA0A06731}-2.exe//PE-Crypt.XorPE High
10.11.2012 13:17:05 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{29FCE7D2-1066-0D58-9348-B8CED2C5C06D}-2E6.exe High
10.11.2012 13:17:04 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{29FCE7D2-1066-0D58-9348-B8CED2C5C06D}-2E6.exe//PE-Crypt.XorPE High
10.11.2012 13:17:12 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{2D19A8A0-F296-3850-F670-9438032D5FFD}-2E6.exe High
10.11.2012 13:17:12 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{2D19A8A0-F296-3850-F670-9438032D5FFD}-2E6.exe//PE-Crypt.XorPE High
10.11.2012 13:17:19 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{36FF5FCE-7ACF-9451-A76E-A89514D7DA0F}-2.exe High
10.11.2012 13:17:19 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{36FF5FCE-7ACF-9451-A76E-A89514D7DA0F}-2.exe//PE-Crypt.XorPE High
10.11.2012 13:17:26 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{411FA3AA-8D8F-77C2-F88A-485A277AA829}-25.exe High
10.11.2012 13:17:26 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{411FA3AA-8D8F-77C2-F88A-485A277AA829}-25.exe//PE-Crypt.XorPE High
10.11.2012 13:17:30 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{4FBD608F-AF30-E857-6022-51BC123FE36B}-9.exe High
10.11.2012 13:17:30 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{4FBD608F-AF30-E857-6022-51BC123FE36B}-9.exe//PE-Crypt.XorPE High
10.11.2012 13:17:33 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5752D99B-EBDB-4E6A-E493-F0262A394636}-2.exe High
10.11.2012 13:17:33 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5752D99B-EBDB-4E6A-E493-F0262A394636}-2.exe//PE-Crypt.XorPE High
10.11.2012 13:17:40 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{599D0BA8-C69E-EB1D-1CE2-FC717442FA70}-2D8.exe High
10.11.2012 13:17:40 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{599D0BA8-C69E-EB1D-1CE2-FC717442FA70}-2D8.exe//PE-Crypt.XorPE High
10.11.2012 13:17:43 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5B577D11-2CE3-DFC2-1190-6522BAB1A333}-2E6.exe High
10.11.2012 13:17:43 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5B577D11-2CE3-DFC2-1190-6522BAB1A333}-2E6.exe//PE-Crypt.XorPE High
10.11.2012 13:17:47 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5E6423DB-E99A-1205-C0D5-2263F7B1C0C2}-2EA.exe High
10.11.2012 13:17:47 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5E6423DB-E99A-1205-C0D5-2263F7B1C0C2}-2EA.exe//PE-Crypt.XorPE High
10.11.2012 13:18:23 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{643B1FFA-E1DF-0C26-B457-1AF677B3205C}-248.exe High
10.11.2012 13:18:23 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{643B1FFA-E1DF-0C26-B457-1AF677B3205C}-248.exe//PE-Crypt.XorPE High
10.11.2012 13:18:26 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{689978F6-28F1-D202-75C3-1EF32487F7C7}-2D8.exe High
10.11.2012 13:18:26 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{689978F6-28F1-D202-75C3-1EF32487F7C7}-2D8.exe//PE-Crypt.XorPE High
10.11.2012 13:18:32 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{6C0FCF56-77EC-14AB-4C61-EB3176C77E7B}-2E6.exe High
10.11.2012 13:18:32 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{6C0FCF56-77EC-14AB-4C61-EB3176C77E7B}-2E6.exe//PE-Crypt.XorPE High
10.11.2012 13:18:35 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{6E22DC3B-033A-5C3B-3F11-EA72DD4BFB75}-45.exe High
10.11.2012 13:18:35 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{6E22DC3B-033A-5C3B-3F11-EA72DD4BFB75}-45.exe//PE-Crypt.XorPE High
10.11.2012 13:18:38 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{8556019D-48F0-6072-4788-1B83A39F3B19}-7.exe High
10.11.2012 13:18:38 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{8556019D-48F0-6072-4788-1B83A39F3B19}-7.exe//PE-Crypt.XorPE High
10.11.2012 13:18:41 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{9E2BD2E7-DCF5-A129-088A-91E2CD45047E}-4A.exe High
10.11.2012 13:18:41 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{9E2BD2E7-DCF5-A129-088A-91E2CD45047E}-4A.exe//PE-Crypt.XorPE High
10.11.2012 13:18:44 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{9EE4F8AF-43DD-026B-47B0-C088841551C9}-A.exe High
10.11.2012 13:18:44 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{9EE4F8AF-43DD-026B-47B0-C088841551C9}-A.exe//PE-Crypt.XorPE High
10.11.2012 13:18:48 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{A70B6FB2-261B-CEE1-DF2D-44AFD2B2EA32}-25.exe High
10.11.2012 13:18:48 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{A70B6FB2-261B-CEE1-DF2D-44AFD2B2EA32}-25.exe//PE-Crypt.XorPE High
10.11.2012 13:18:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{BA279778-7FAC-82F1-32C5-6B0271A150BC}-45.exe High
10.11.2012 13:18:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{BA279778-7FAC-82F1-32C5-6B0271A150BC}-45.exe//PE-Crypt.XorPE High
10.11.2012 13:18:55 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{BFE38650-7147-ED1A-82E8-CB0417F413D5}-4A3.exe High
10.11.2012 13:18:55 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{BFE38650-7147-ED1A-82E8-CB0417F413D5}-4A3.exe//PE-Crypt.XorPE High
10.11.2012 13:18:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C53BCF65-6B6F-BA10-8725-A5A121097A3D}-4A.exe High
10.11.2012 13:18:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C53BCF65-6B6F-BA10-8725-A5A121097A3D}-4A.exe//PE-Crypt.XorPE High
10.11.2012 13:19:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C6B6B847-D1AE-C51A-36F3-F4CC4F7B03C9}-2EA.exe High
10.11.2012 13:19:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C6B6B847-D1AE-C51A-36F3-F4CC4F7B03C9}-2EA.exe//PE-Crypt.XorPE High
10.11.2012 13:19:04 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C89952D0-FCF3-70A1-DDC6-7708A48375D9}-45.exe High
10.11.2012 13:19:04 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{C89952D0-FCF3-70A1-DDC6-7708A48375D9}-45.exe//PE-Crypt.XorPE High
10.11.2012 13:19:07 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{CA856109-CFA8-6E48-54ED-D1A7261A1155}-27.exe High
10.11.2012 13:19:07 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{CA856109-CFA8-6E48-54ED-D1A7261A1155}-27.exe//PE-Crypt.XorPE High
10.11.2012 13:19:10 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{D7878BC4-5A32-6DF8-B6E2-EA85D0BA7AB5}-27.exe High
10.11.2012 13:19:10 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{D7878BC4-5A32-6DF8-B6E2-EA85D0BA7AB5}-27.exe//PE-Crypt.XorPE High
10.11.2012 13:19:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{FC2D7AD3-32EE-A175-B4E9-735457307D17}-2EA.exe High
10.11.2012 13:19:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{FC2D7AD3-32EE-A175-B4E9-735457307D17}-2EA.exe//PE-Crypt.XorPE High
10.11.2012 13:19:43 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{FC358D43-5E0B-A9D2-0313-21C9D91B960A}-2.exe High
10.11.2012 13:19:43 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{FC358D43-5E0B-A9D2-0313-21C9D91B960A}-2.exe//PE-Crypt.XorPE High
10.11.2012 14:11:59 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149960.exe High
10.11.2012 14:11:59 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149960.exe//PE-Crypt.XorPE High
10.11.2012 14:12:05 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149959.exe High
10.11.2012 14:12:05 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149959.exe//PE-Crypt.XorPE High
10.11.2012 14:12:09 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149961.exe High
10.11.2012 14:12:09 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149961.exe//PE-Crypt.XorPE High
10.11.2012 14:12:13 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149962.exe High
10.11.2012 14:12:13 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149962.exe//PE-Crypt.XorPE High
10.11.2012 14:12:16 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149963.exe High
10.11.2012 14:12:16 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149963.exe//PE-Crypt.XorPE High
10.11.2012 14:12:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149964.exe High
10.11.2012 14:12:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149964.exe//PE-Crypt.XorPE High
10.11.2012 14:12:24 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149965.exe High
10.11.2012 14:12:24 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149965.exe//PE-Crypt.XorPE High
10.11.2012 14:12:29 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149966.exe High
10.11.2012 14:12:29 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149966.exe//PE-Crypt.XorPE High
10.11.2012 14:12:33 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149967.exe High
10.11.2012 14:12:33 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149967.exe//PE-Crypt.XorPE High
10.11.2012 14:12:42 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149968.exe High
10.11.2012 14:12:42 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149968.exe//PE-Crypt.XorPE High
10.11.2012 14:12:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149970.exe High
10.11.2012 14:12:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149970.exe//PE-Crypt.XorPE High
10.11.2012 14:12:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149971.exe High
10.11.2012 14:12:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149971.exe//PE-Crypt.XorPE High
10.11.2012 14:13:40 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149972.exe High
10.11.2012 14:13:40 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149972.exe//PE-Crypt.XorPE High
10.11.2012 14:13:44 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149973.exe High
10.11.2012 14:13:44 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149973.exe//PE-Crypt.XorPE High
10.11.2012 14:13:47 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149974.exe High
10.11.2012 14:13:47 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149974.exe//PE-Crypt.XorPE High
10.11.2012 14:13:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149976.exe High
10.11.2012 14:13:51 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149976.exe//PE-Crypt.XorPE High
10.11.2012 14:13:55 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149977.exe High
10.11.2012 14:13:55 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149977.exe//PE-Crypt.XorPE High
10.11.2012 14:13:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149978.exe High
10.11.2012 14:13:58 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149978.exe//PE-Crypt.XorPE High
10.11.2012 14:14:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149979.exe High
10.11.2012 14:14:01 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149979.exe//PE-Crypt.XorPE High
10.11.2012 14:14:08 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149980.exe High
10.11.2012 14:14:08 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149980.exe//PE-Crypt.XorPE High
10.11.2012 14:14:11 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149981.exe High
10.11.2012 14:14:11 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149981.exe//PE-Crypt.XorPE High
10.11.2012 14:14:15 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149982.exe High
10.11.2012 14:14:15 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149982.exe//PE-Crypt.XorPE High
10.11.2012 14:14:18 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149983.exe High
10.11.2012 14:14:18 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149983.exe//PE-Crypt.XorPE High
10.11.2012 14:14:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149984.exe High
10.11.2012 14:14:21 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149984.exe//PE-Crypt.XorPE High
10.11.2012 14:14:25 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149985.exe High
10.11.2012 14:14:25 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149985.exe//PE-Crypt.XorPE High
10.11.2012 14:14:28 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149986.exe High
10.11.2012 14:14:28 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149986.exe//PE-Crypt.XorPE High
10.11.2012 14:14:31 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149987.exe High
10.11.2012 14:14:31 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149987.exe//PE-Crypt.XorPE High
10.11.2012 14:14:35 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149988.exe High
10.11.2012 14:14:35 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149988.exe//PE-Crypt.XorPE High
10.11.2012 14:14:42 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149989.exe High
10.11.2012 14:14:42 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bcus C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149989.exe//PE-Crypt.XorPE High
10.11.2012 14:16:20 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149990.exe High
10.11.2012 14:16:20 Deleted Trojan program Trojan-Ransom.Win32.PornoAsset.bdlz C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149990.exe//PE-Crypt.XorPE High
Status: Quarantined (events: 12)
10.11.2012 13:17:36 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{3ECA2C6B-FEE3-C016-77A7-9232643D8324}-12A.exe High
10.11.2012 13:17:36 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{3ECA2C6B-FEE3-C016-77A7-9232643D8324}-12A.exe//PE-Crypt.XorPE High
10.11.2012 13:17:36 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{3ECA2C6B-FEE3-C016-77A7-9232643D8324}-12A.exe//PE-Crypt.XorPE High
10.11.2012 13:18:29 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5C13DF79-328D-C425-515E-5FBC75567730}-12A.exe High
10.11.2012 13:18:29 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5C13DF79-328D-C425-515E-5FBC75567730}-12A.exe//PE-Crypt.XorPE High
10.11.2012 13:18:29 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\LocalCopy\{5C13DF79-328D-C425-515E-5FBC75567730}-12A.exe//PE-Crypt.XorPE High
10.11.2012 14:13:01 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149969.exe High
10.11.2012 14:13:01 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149969.exe//PE-Crypt.XorPE High
10.11.2012 14:13:01 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149969.exe//PE-Crypt.XorPE High
10.11.2012 14:14:05 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149975.exe High
10.11.2012 14:14:05 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149975.exe//PE-Crypt.XorPE High
10.11.2012 14:14:05 Quarantined Trojan program HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{C0194EA1-9818-4AE4-8921-D214FAF0968C}\RP605\A0149975.exe//PE-Crypt.XorPE High
Status: Detected (events: 1)
10.11.2012 13:26:59 Detected Trojan program Trojan-Ransom.Win32.PornoAsset.bcjs C:\Documents and Settings\Lucie\Local Settings\Data aplikací\PCHealth\ErrorRep\QSignoff\6D8E43.cab//{93C6DFFE_56FB_AB6A_6796_58636A729395}_4D.exe//PE-Crypt.XorPE High
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#10 Příspěvek od Rudy »

Máte zaplevelenou zálohu systému. Odtud se šmejd obnovuje. Po ukončení skenu by měl být PC čistý.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#11 Příspěvek od Yama »

Mám kliknout na "Disinfect all"?

Obrázek

Čím to mám dál zkontrolovat, jestli je virus opravdu pryč?
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#12 Příspěvek od Rudy »

Ano, dejte vše "Disinfected". Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#13 Příspěvek od Yama »

Při disinfect all mi naskočilo okno od KVRT
Obrázek

Nejradši bych dal delete archive, i když mi program doporučuje přeskočit. Jaký je tvůj názor?
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119520
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Skype virus

#14 Příspěvek od Rudy »

Já bych ho klidně smazal. Název souboru _4D.exe neodpovídá ničemu známému.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Yama
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 07 lis 2012 19:59

Re: Skype virus

#15 Příspěvek od Yama »

Log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Lucie at 2012-11-10 20:50:52
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 5 GB (6%) free of 82 GB
Total RAM: 1014 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:50:59, on 10.11.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\EeePC\CapsHook\CapsHook.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
C:\Program Files\Elantech\ETDCtrlHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\eInstruction\Device Manager\Launch.exe
C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lucie\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Lucie.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.myplaycity.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CapsHook] C:\Program Files\EeePC\CapsHook\CapsHook.exe
O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ETDWare] %ProgramFiles%\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dropbox.lnk = ?
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: eInstruction Device Manager.lnk = C:\Program Files\eInstruction\Device Manager\Launch.exe
O4 - Global Startup: SuperHybridEngine.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 10100 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{4C726153-CAD8-42D6-A282-4C6C0AFD3417}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-08-13 4120256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-09-28 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-09-28 173592]
"LiveUpdate"=C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [2010-01-29 751592]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-14 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-14 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"CapsHook"=C:\Program Files\EeePC\CapsHook\CapsHook.exe [2010-05-28 445344]
"AsusTray"=C:\Program Files\EeePC\ACPI\AsTray.exe [2009-06-26 118784]
"AsusEPCMonitor"=C:\Program Files\EeePC\ACPI\AsEPCMon.exe [2009-05-08 98304]
"AsusACPIServer"=C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe [2010-05-17 1246632]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-04-21 18789408]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-06-10 548744]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-05-30 59280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2011-10-24 421888]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-09-12 947176]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2012-06-07 421776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Eee Docking"=C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [2010-03-25 402096]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe [2009-09-28 141336]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
eInstruction Device Manager.lnk - C:\Program Files\eInstruction\Device Manager\Launch.exe
SuperHybridEngine.lnk - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe

C:\Documents and Settings\Lucie\Nabídka Start\Programy\Po spuštění
Dropbox.lnk - C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-09-24 205312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-19 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\worms reloaded\WormsReloaded.exe"="C:\Program Files\Steam\steamapps\common\worms reloaded\WormsReloaded.exe:*:Enabled:Worms Reloaded"
"C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe"="C:\Documents and Settings\Lucie\Data aplikací\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox"
"C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe"="C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe:*:Enabled:Plants vs. Zombies: Game of the Year"
"C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Lucie\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe"="C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\eInstruction\Device Manager\Launch.exe"="C:\Program Files\eInstruction\Device Manager\Launch.exe:*:Enabled:eIDeviceManager"
"C:\Program Files\eInstruction\Device Manager\jre\bin\java.exe"="C:\Program Files\eInstruction\Device Manager\jre\bin\java.exe:*:Enabled:eIDeviceManagerJava"
"C:\Program Files\eInstruction\Device Manager\jre\bin\javaw.exe"="C:\Program Files\eInstruction\Device Manager\jre\bin\javaw.exe:*:Enabled:eIDeviceManagerJavaw"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.yv12"=yv12vfw.dll
"vidc.MPG4"=MPG4c32.dll
"vidc.MP42"=MPG4c32.dll
"vidc.MP43"=MPG4c32.dll
"vidc.tscc"=tsccvid.dll

======List of files/folders created in the last 1 month======

2012-11-10 12:19:57 ----SHD---- C:\RECYCLER
2012-11-10 12:16:56 ----D---- C:\Program Files\CCleaner
2012-11-08 23:27:58 ----D---- C:\WINDOWS\temp
2012-11-08 23:26:42 ----A---- C:\ComboFix.txt
2012-11-07 23:05:17 ----A---- C:\log combofix.txt
2012-11-07 22:13:50 ----A---- C:\Boot.bak
2012-11-07 22:13:40 ----RASHD---- C:\cmdcons
2012-11-07 22:11:32 ----A---- C:\WINDOWS\zip.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\SWSC.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\SWREG.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\sed.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\PEV.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\NIRCMD.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\MBR.exe
2012-11-07 22:11:32 ----A---- C:\WINDOWS\grep.exe
2012-11-07 22:11:06 ----D---- C:\Qoobox
2012-11-07 22:10:37 ----D---- C:\WINDOWS\erdnt
2012-11-07 19:53:44 ----D---- C:\Program Files\trend micro
2012-11-07 19:53:43 ----D---- C:\rsit
2012-11-07 14:05:42 ----A---- C:\Documents and Settings\Lucie\Data aplikací\6DC.exe
2012-11-06 19:32:58 ----D---- C:\WINDOWS\system32\NtmsData
2012-10-14 13:25:44 ----D---- C:\Documents and Settings\Lucie\Data aplikací\GTCO CalComp
2012-10-14 13:21:45 ----D---- C:\Documents and Settings\Lucie\Data aplikací\eInstruction
2012-10-14 13:16:38 ----A---- C:\WINDOWS\system32\tsccvid.dll
2012-10-14 13:13:15 ----A---- C:\Program Files\Common Files\eInstruction.ini
2012-10-14 13:07:47 ----D---- C:\Program Files\eInstruction
2012-10-11 17:57:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2724197$
2012-10-11 17:49:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2756822$
2012-10-11 17:49:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2749655$
2012-10-11 17:48:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2661254-v2$

======List of files/folders modified in the last 1 month======

2012-11-10 20:44:39 ----RD---- C:\My Dropbox
2012-11-10 20:44:11 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Dropbox
2012-11-10 20:43:46 ----D---- C:\WINDOWS
2012-11-10 20:42:26 ----D---- C:\WINDOWS\system32\drivers
2012-11-10 20:41:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-11-10 18:56:33 ----D---- C:\WINDOWS\Prefetch
2012-11-10 12:54:51 ----SHD---- C:\WINDOWS\Installer
2012-11-10 12:30:05 ----SHD---- C:\System Volume Information
2012-11-10 12:28:40 ----HD---- C:\WINDOWS\inf
2012-11-10 12:28:24 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-10 12:21:12 ----D---- C:\Program Files\Steam
2012-11-10 12:21:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2012-11-10 12:21:08 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Skype
2012-11-10 12:19:59 ----D---- C:\WINDOWS\Logs
2012-11-10 12:19:59 ----D---- C:\WINDOWS\Debug
2012-11-10 12:19:57 ----D---- C:\WINDOWS\Minidump
2012-11-10 12:16:56 ----RD---- C:\Program Files
2012-11-10 11:58:08 ----SD---- C:\WINDOWS\Tasks
2012-11-08 23:18:02 ----A---- C:\WINDOWS\system.ini
2012-11-08 23:17:12 ----D---- C:\WINDOWS\system32\drivers\etc
2012-11-08 23:11:44 ----D---- C:\WINDOWS\system32
2012-11-08 23:11:43 ----D---- C:\WINDOWS\AppPatch
2012-11-08 23:11:41 ----D---- C:\Program Files\Common Files
2012-11-07 22:13:50 ----RASH---- C:\boot.ini
2012-11-07 07:19:19 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-11-07 07:19:19 ----D---- C:\Program Files\Microsoft
2012-11-07 06:57:53 ----D---- C:\WINDOWS\Registration
2012-11-06 19:32:57 ----D---- C:\WINDOWS\repair
2012-11-06 19:18:46 ----D---- C:\WINDOWS\system32\CatRoot
2012-11-03 19:31:24 ----D---- C:\Documents and Settings\Lucie\Data aplikací\U3
2012-11-02 19:10:43 ----D---- C:\Documents and Settings\Lucie\Data aplikací\Mozilla
2012-10-31 21:58:09 ----D---- C:\Documents and Settings\Lucie\Data aplikací\SoftGrid Client
2012-10-31 16:55:09 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-10-14 13:14:03 ----D---- C:\WINDOWS\WinSxS
2012-10-14 13:13:31 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-10-11 17:58:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2012-10-11 17:57:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-10-11 17:50:10 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2009-06-04 330264]
R0 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2012-08-30 193552]
R1 AsUpIO;AsUpIO; C:\WINDOWS\system32\drivers\AsUpIO.sys [2010-03-31 11520]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2009-08-12 1582624]
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2008-04-08 10752]
R3 ETD;ELAN PS/2 Port Input Device; C:\WINDOWS\system32\DRIVERS\ETD.sys [2010-07-21 102912]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-09-24 6301696]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-04-21 5956608]
R3 kbfiltr;Keyboard Filter; C:\WINDOWS\system32\DRIVERS\kbfiltr.sys [2008-11-03 13880]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-07-27 44032]
R3 rtsuvc;Realtek USB2.0 PC Camera; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2010-02-04 73088]
R3 Sftfs;Sftfs; C:\WINDOWS\system32\DRIVERS\Sftfsxp.sys [2011-10-01 584680]
R3 Sftplay;Sftplay; C:\WINDOWS\system32\DRIVERS\Sftplayxp.sys [2011-10-01 209512]
R3 Sftredir;Sftredir; C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys [2011-10-01 20584]
R3 Sftvol;Sftvol; C:\WINDOWS\system32\DRIVERS\Sftvolxp.sys [2011-10-01 18280]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2011-04-21 1684736]
S3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys []
S3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys []
S3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys []
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2011-04-21 1389056]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-29 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-29 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-05-24 55184]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-09-12 20472]
R2 sftlist;Application Virtualization Client; C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
R2 Skype C2C Service;Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-06-07 821648]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-13 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-06-07 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-13 116648]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-06-11 136120]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-03-16 407336]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-06 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“