Virus - Trace.Registry.Get.Styles (A)

[Kallerno]

Dobrý den, jeden známej má v PC havěť zvanou '' Trace.Registry.Get.Styles (A) '', projevuje se výrazným zpomalením PC, odpojováním i k internetu a přehazováním ikon na ploše, jak tuhle havěť zničit? K vytvoření logu jsem použil s4 jménem '' Emsisoft Anti-Malware - Verze 7.0 '', přikládám log:

Emsisoft Anti-Malware - Verze 7.0
Poslední aktualizace: 25.3.2013 15:48:22

Nastavení hledání:

Způsob hledání: Hledat rychle
Objekty: Rootkity, Paměť, Stopy malwaru

Detect Riskware: Vypnuto
Prohledávání archívů: Vypnuto
Hledání v ADS: Zapnuto
File extensions: Vypnuto
Advanced caching: Zapnuto
Direct disk access: Vypnuto

Začátek hledání: 25.3.2013 16:15:33

Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\csssaver detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\csssaver\defaulticon detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\csssaver\shell detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\csssaver\shell\open detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\csssaver\shell\open\command detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{5bcdc9e9-a980-4b53-b2e8-60cff484da61} detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{5bcdc9e9-a980-4b53-b2e8-60cff484da61}\iexplore detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531} detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3698461423-430329105-2185589858-500\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531} detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531}\iexplore detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3698461423-430329105-2185589858-500\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531}\iexplore detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{9b5fb65f-631e-4564-abf2-ad71845b28e0} detected: Trace.Registry.GetStyles (A)
Key: hkey_users\s-1-5-21-3253419295-1057850187-3427730892-1115\software\microsoft\windows\currentversion\ext\stats\{9b5fb65f-631e-4564-abf2-ad71845b28e0}\iexplore detected: Trace.Registry.GetStyles (A)

Prohledáno: 313508
Nalezeno 13

Konec hledání: 25.3.2013 16:16:56
Čas hledání: 0:01:23

[Rudy]

Zdravím!
Dejte log RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=105895 .

[Kallerno]

Přikládám log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by zubrovych at 2013-03-26 09:52:05
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 53 GB (39%) free of 138 GB
Total RAM: 1913 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:52:18, on 26.3.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17123)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Emsisoft Anti-Malware\a2service.exe
C:\WINDOWS\system32\TAMSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\All Users\Data aplikací\VKSaver\VKSaver.exe
C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2guard.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\zubrovych\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\zubrovych\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\zubrovych\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\zubrovych\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\zubrovych.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.jilova.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sou-jilova.cz
O17 - HKLM\Software\..\Telephony: DomainName = sou-jilova.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sou-jilova.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sou-jilova.cz
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Emsisoft Anti-Malware 7.0 - Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Authentec memory manager service (Authentec memory manager) - AuthenTec Inc. - C:\WINDOWS\system32\TAMSvr.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: Ochrana HDD TOSHIBA (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe
O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

--
End of file - 4867 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Antivirus Scheduled Scan.job
C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3253419295-1057850187-3427730892-4730Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3253419295-1057850187-3427730892-4730UA.job
C:\WINDOWS\tasks\HP Photo Creations Communicator.job
C:\WINDOWS\tasks\Uniblue SpeedUpMyPC Nag.job
C:\WINDOWS\tasks\Uniblue SpeedUpMyPC.job
C:\WINDOWS\tasks\VKSaverUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=C:\WINDOWS\system32\mobsync.exe [2008-04-14 143872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [2007-04-26 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
C:\Program Files\TOSHIBA\Nástroj TOSHIBA Zooming Utility\SmoothView.exe [2007-05-11 143360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UsbMonitor]
C:\Program Files\TrueSuite Access Manager\usbnotify.exe [2008-07-25 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FingerprintServer"=3

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-05-21 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SetVisualStyle"=
"DisableLockWorkstation"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=1
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149
"NoSimpleStartMenu"=1
"NoDesktopCleanupWizard"=1
"NoWelcomeScreen"=1
"ForceStartMenuLogOff"=1
"NoThemesTab"=1
"NoTaskGrouping"=1
"Intellimenus"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\HP\HP Software Update\HPWUCli.exe"="C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe"
"C:\FTI program\Bin\ibserver.exe"="C:\FTI program\Bin\ibserver.exe:*:Enabled:InterBase Server"
"C:\Program Files\Borland\InterBase\Bin\ibserver.exe"="C:\Program Files\Borland\InterBase\Bin\ibserver.exe:*:Enabled:InterBase Server"
"C:\Program Files\FranklinTempleton\FTIS_AS_DBMain_IB.exe"="C:\Program Files\FranklinTempleton\FTIS_AS_DBMain_IB.exe:*:Enabled:FondsAnalyseTool Applikations-Server (DBMain)"
"C:\Program Files\FranklinTempleton\FTIS_AS_DBKunden.exe"="C:\Program Files\FranklinTempleton\FTIS_AS_DBKunden.exe:*:Enabled:FondsAnalyseTool Applikations-Server (DBKunden)"
"C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe"="C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe:*:Enabled:Media Player Classic - Homecinema"
"C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe"="C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP"
"C:\Games\Pro Evolution Soccer 2011\pes2011.exe"="C:\Games\Pro Evolution Soccer 2011\pes2011.exe:*:Enabled:Pro Evolution Soccer 2011"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgwdsvc.exe"="C:\Program Files\AVG\AVG2012\avgwdsvc.exe:*:Enabled:Vzdálená správa AVG"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
"C:\QGNA\qGNA.exe"="C:\QGNA\qGNA.exe:*:Enabled:GameNet Application"
"C:\Program Files\TeamViewer\Version8\TeamViewer.exe"="C:\Program Files\TeamViewer\Version8\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"
"C:\Program Files\HP\HP Software Update\HPWUCli.exe"="C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Games\Pro Evolution Soccer 2011\pes2011.exe"="C:\Games\Pro Evolution Soccer 2011\pes2011.exe:*:Enabled:Pro Evolution Soccer 2011"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgwdsvc.exe"="C:\Program Files\AVG\AVG2012\avgwdsvc.exe:*:Enabled:Vzdálená správa AVG"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
"C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe"="C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe:*:Disabled:Sony PC Companion"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"VIDC.MPG4"=mpg4c32.dll
"VIDC.MP42"=mpg4c32.dll
"VIDC.DIVX"=divx.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"Msacm.dvacm"=C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"=mpegacm.acm
"msacm.ulmp3acm"=ulmp3acm.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-03-26 09:52:06 ----D---- C:\Program Files\trend micro
2013-03-26 09:52:05 ----D---- C:\rsit
2013-03-26 08:39:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2510581$
2013-03-25 17:45:56 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2013-03-25 16:10:23 ----A---- C:\WINDOWS\imsins.BAK
2013-03-25 15:33:20 ----D---- C:\Program Files\VS Revo Group
2013-03-25 15:22:49 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\Malwarebytes
2013-03-25 15:22:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2013-03-25 15:22:35 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2013-03-25 15:22:35 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2013-03-22 21:36:45 ----D---- C:\Program Files\Emsisoft Anti-Malware
2013-03-22 19:15:48 ----A---- C:\WINDOWS\system32\msvcr70.dll
2013-03-22 19:15:48 ----A---- C:\WINDOWS\system32\msvcp70.dll
2013-03-22 19:15:48 ----A---- C:\WINDOWS\system32\mfc70.dll
2013-03-22 19:15:46 ----D---- C:\Program Files\AML Products
2013-03-22 18:58:05 ----D---- C:\Program Files\Enigma Software Group
2013-03-22 18:57:22 ----D---- C:\WINDOWS\46B04D534E344388B6EE80FAB66AEF9B.TMP
2013-03-22 17:06:52 ----A---- C:\WINDOWS\system32\drivers\PCTBD.sys
2013-03-22 17:06:49 ----A---- C:\WINDOWS\SGDetectionTool.dll
2013-03-22 17:06:49 ----A---- C:\WINDOWS\BDTSupport.dll
2013-03-22 17:06:48 ----A---- C:\WINDOWS\PCTBDRes.dll
2013-03-22 17:06:48 ----A---- C:\WINDOWS\PCTBDCore.dll
2013-03-22 17:05:09 ----D---- C:\Program Files\PC Tools
2013-03-22 17:01:45 ----A---- C:\WINDOWS\system32\drivers\Cat.DB
2013-03-22 17:01:31 ----D---- C:\Program Files\Common Files\PC Tools
2013-03-22 17:01:31 ----A---- C:\WINDOWS\system32\drivers\PCTSD.sys
2013-03-22 17:01:01 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2013-03-22 17:00:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Tools
2013-03-22 17:00:55 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\TestApp
2013-03-22 16:39:21 ----A---- C:\WINDOWS\wininit.ini
2013-03-22 16:00:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2013-03-22 16:00:27 ----D---- C:\Program Files\Spybot - Search & Destroy 2
2013-03-22 15:45:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\GFI Software
2013-03-22 10:13:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2013-03-22 10:13:31 ----D---- C:\Program Files\Ad-Aware Antivirus
2013-03-22 10:12:47 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\blekko
2013-03-22 10:11:48 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\Ad-Aware Antivirus
2013-03-21 22:46:35 ----D---- C:\5e275471431a5687c5cd4ac2034705
2013-03-21 20:43:19 ----D---- C:\Config.Msi
2013-03-21 17:08:25 ----A---- C:\Program Files\LZMA.dll
2013-03-21 17:08:25 ----A---- C:\Program Files\Log4Net.dll
2013-03-21 17:08:24 ----A---- C:\Program Files\GameLauncher.dll
2013-03-21 17:08:24 ----A---- C:\Program Files\DownloadAPIWrapper.dll
2013-03-21 15:40:25 ----D---- C:\Program Files\Need For Speed World
2013-03-19 21:41:44 ----D---- C:\Program Files\EA Games
2013-03-13 15:42:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2807986$
2013-02-28 10:09:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\KONAMI

======List of files/folders modified in the last 1 month======

2013-03-26 09:52:09 ----D---- C:\WINDOWS\Temp
2013-03-26 09:52:06 ----RD---- C:\Program Files
2013-03-26 09:40:52 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\Skype
2013-03-26 09:31:22 ----AD---- C:\WINDOWS\system32
2013-03-26 09:31:22 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-03-26 09:28:52 ----D---- C:\WINDOWS\system32\CatRoot2
2013-03-26 09:25:20 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-03-26 09:16:58 ----D---- C:\WINDOWS\system32\drivers
2013-03-26 09:03:36 ----D---- C:\WINDOWS\Prefetch
2013-03-26 08:50:35 ----D---- C:\WINDOWS
2013-03-26 08:40:28 ----HD---- C:\WINDOWS\inf
2013-03-26 08:40:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-03-26 08:40:01 ----D---- C:\WINDOWS\system32\cs-cz
2013-03-26 08:40:00 ----D---- C:\Program Files\Internet Explorer
2013-03-26 08:39:44 ----D---- C:\WINDOWS\ie7updates
2013-03-26 08:39:35 ----HD---- C:\WINDOWS\$hf_mig$
2013-03-26 08:31:48 ----D---- C:\WINDOWS\security
2013-03-25 17:40:41 ----SHD---- C:\WINDOWS\CSC
2013-03-25 16:13:35 ----D---- C:\WINDOWS\Media
2013-03-25 16:13:35 ----D---- C:\WINDOWS\Help
2013-03-25 16:12:09 ----D---- C:\WINDOWS\ie8updates
2013-03-25 15:04:18 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\uTorrent
2013-03-25 14:53:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2013-03-25 12:27:46 ----D---- C:\Program Files\Google
2013-03-25 10:12:14 ----SHD---- C:\WINDOWS\Installer
2013-03-25 10:12:14 ----D---- C:\WINDOWS\system32\appmgmt
2013-03-25 10:12:04 ----DC---- C:\WINDOWS\system32\DRVSTORE
2013-03-25 10:06:51 ----SHD---- C:\RECYCLER
2013-03-25 10:02:26 ----D---- C:\WINDOWS\system32\drivers\AVG
2013-03-23 20:32:15 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\Get Styles for Opera
2013-03-23 18:00:28 ----RD---- C:\dokumenty
2013-03-23 17:32:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2012
2013-03-22 21:11:22 ----SD---- C:\Documents and Settings\zubrovych\Data aplikací\Microsoft
2013-03-22 19:43:55 ----AD---- C:\I386
2013-03-22 19:43:50 ----AD---- C:\VALUEADD
2013-03-22 18:57:11 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2013-03-22 18:34:51 ----SHD---- C:\System Volume Information
2013-03-22 18:34:33 ----D---- C:\WINDOWS\WinSxS
2013-03-22 17:01:31 ----D---- C:\Program Files\Common Files
2013-03-22 16:51:58 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2013-03-22 16:51:57 ----SD---- C:\WINDOWS\Tasks
2013-03-22 16:37:05 ----RASH---- C:\boot.ini
2013-03-22 16:00:44 ----D---- C:\WINDOWS\system32\config
2013-03-22 15:35:54 ----D---- C:\WINDOWS\system32\usmt
2013-03-22 15:35:54 ----D---- C:\Program Files\Outlook Express
2013-03-22 15:35:54 ----D---- C:\Program Files\Movie Maker
2013-03-22 15:16:50 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\Desktopicon
2013-03-22 10:13:31 ----D---- C:\Program Files\Common Files\Microsoft Shared
2013-03-22 09:55:37 ----D---- C:\Program Files\uTorrentBar
2013-03-22 09:55:04 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\PriceGong
2013-03-21 22:46:43 ----HD---- C:\WINDOWS\msdownld.tmp
2013-03-21 22:46:43 ----D---- C:\WINDOWS\system32\DirectX
2013-03-21 16:41:42 ----D---- C:\WINDOWS\Microsoft.NET
2013-03-21 16:26:31 ----D---- C:\WINDOWS\system32\XPSViewer
2013-03-21 16:26:30 ----RSD---- C:\WINDOWS\Fonts
2013-03-21 16:25:50 ----D---- C:\WINDOWS\system32\CatRoot
2013-03-21 16:24:42 ----RSD---- C:\WINDOWS\assembly
2013-03-21 13:06:13 ----HD---- C:\Program Files\InstallShield Installation Information
2013-03-21 13:06:13 ----D---- C:\Program Files\Akella Games
2013-03-20 18:34:35 ----D---- C:\WINDOWS\Minidump
2013-03-17 08:48:05 ----D---- C:\WINDOWS\Network Diagnostic
2013-03-14 12:58:28 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\vlc
2013-03-13 17:02:24 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-03-13 15:45:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2013-03-06 08:29:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2013-02-28 20:37:21 ----D---- C:\Documents and Settings\zubrovych\Data aplikací\U3

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AlfaFF;AlfaFF mini-filter driver; C:\WINDOWS\system32\Drivers\AlfaFF.sys [2008-07-25 42608]
R0 AVGIDSHX;AVGIDSHX; C:\WINDOWS\system32\DRIVERS\avgidshx.sys [2012-04-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2012-01-31 31952]
R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2010-11-06 354840]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 risdptsk;risdptsk; C:\WINDOWS\system32\DRIVERS\risdptsk.sys [2005-07-14 27904]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-11-26 691696]
R0 Thpdrv;TOSHIBA HDD Protection Driver; C:\WINDOWS\system32\DRIVERS\thpdrv.sys [2008-01-11 21120]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver; C:\WINDOWS\system32\DRIVERS\Thpevm.SYS [2007-09-04 6528]
R0 tos_sps32;TOSHIBA tos_sps32 Service; C:\WINDOWS\system32\DRIVERS\tos_sps32.sys [2008-06-04 279376]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\WINDOWS\system32\DRIVERS\TVALZ.SYS [2007-02-15 16768]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-07-13 91904]
R1 A2DDA;A2 Direct Disk Access Support Driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys []
R1 a2injectiondriver;a2injectiondriver; \??\C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys []
R1 a2util;a-squared Malware-IDS utility driver; \??\C:\Program Files\Emsisoft Anti-Malware\a2util32.sys []
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2012-11-08 250080]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2012-08-24 301920]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R1 TMEI3E;TMEI3E; C:\WINDOWS\System32\Drivers\TMEI3E.SYS [2004-06-16 5888]
R1 Tosrfcom;Bluetooth RFCOMM; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2009-07-28 69480]
R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2009-06-26 48128]
R2 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2009-06-26 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2009-06-26 38400]
R2 tdudf;TOSHIBA UDF File System Driver; C:\WINDOWS\system32\DRIVERS\tdudf.sys [2007-03-26 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver; C:\WINDOWS\system32\DRIVERS\trudf.sys [2007-02-19 134016]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver; C:\WINDOWS\system32\DRIVERS\TVALZFL.sys [2008-04-30 4992]
R3 a2acc;a2acc; \??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys []
R3 AgereSoftModem;TOSHIBA V.92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2009-07-21 1161760]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-05-08 101833]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2011-05-24 1979328]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver; C:\WINDOWS\System32\Drivers\ATSwpWDF.sys [2010-04-07 540288]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver; C:\WINDOWS\system32\DRIVERS\e1y5132.sys [2011-10-20 250584]
R3 eppvad_simple;EPSON Projector UD Audio Device; C:\WINDOWS\system32\drivers\EMP_UDAU.sys [2008-05-14 17664]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-05-21 6018464]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2008-07-23 44800]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-04-06 6388328]
R3 L8042Kbd;SetPoint Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2010-08-24 20304]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2007-02-22 16128]
R3 tosporte;Bluetooth COM Port; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2009-06-17 46984]
R3 tosrfbd;Bluetooth RFBUS; C:\WINDOWS\system32\DRIVERS\tosrfbd.sys [2010-04-07 171240]
R3 tosrfbnp;Bluetooth RFBNEP; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2009-06-19 42472]
R3 tosrfec;Bluetooth ACPI; C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2010-06-18 15160]
R3 Tosrfhid;Bluetooth RFHID; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2009-06-19 79872]
R3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\system32\DRIVERS\tosrfusb.sys [2010-04-08 50936]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Chicony USB 2.0 Camera; C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
R3 UVCFTR;UVCFTR; C:\WINDOWS\System32\Drivers\UVCFTR_S.SYS [2007-12-17 18432]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2009-03-16 58208]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S1 SBRE;SBRE; C:\WINDOWS\system32\drivers\SBRE.sys []
S1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys [2008-08-14 146944]
S3 b57w2k;BCM5701 Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2001-10-24 97120]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-14 206976]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 esgiguard;esgiguard; C:\WINDOWS\system32\drivers\esgiguard.sys []
S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2012-12-02 12400]
S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2012-12-02 25200]
S3 guardian2;guardian2; C:\WINDOWS\System32\Drivers\oz776.sys [2007-12-24 68696]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2008-10-28 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2008-10-28 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2009-02-26 21568]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 PCTBD;PC Tools Browser Defender Driver; C:\WINDOWS\System32\Drivers\PCTBD.sys [2012-10-23 62688]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2008-04-14 5888]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 teamviewervpn;TeamViewer VPN Adapter; C:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2012-11-28 25088]
S3 TEchoCan;Toshiba Audio Effect; C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2007-02-21 435072]
S3 tosrfnds;Bluetooth Personal Area Network; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2009-07-24 21608]
S3 TosRfSnd;Bluetooth Audio; C:\WINDOWS\system32\drivers\tosrfsnd.sys [2008-01-22 54144]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys []
S3 WinUSB;Sony Ericsson USB Device sa0101 Driver; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2009-07-13 34944]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-07-13 132224]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 a2AntiMalware;Emsisoft Anti-Malware 7.0 - Service; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [2013-03-22 3089320]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2006-10-05 9216]
R2 Authentec memory manager;Authentec memory manager service; C:\WINDOWS\system32\TAMSvr.exe [2008-09-02 49152]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-17 40960]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 TeamViewer8;TeamViewer 8; C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
R2 Thpsrv;Ochrana HDD TOSHIBA; C:\WINDOWS\system32\ThpSrv.exe [2008-05-05 552312]
R2 Tmesrv;Tmesrv3; C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe [2006-01-27 118784]
R2 TNaviSrv;TOSHIBA Navi Support Service; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [2008-06-04 83312]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\WINDOWS\system32\TODDSrv.exe [2007-11-21 129632]
R2 TPCHSrv;TPCH Service; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2008-05-27 628072]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-01-08 161536]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-13 253656]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 Browser Defender Update Service;Browser Defender Update Service; C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-10-23 580728]
S4 EMP_UDSA;EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [2010-11-02 98304]
S4 FingerprintServer;Fingerprint Server; C:\WINDOWS\system32\FpLogonServ.exe [2008-09-03 131072]
S4 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\WINDOWS\system32\IProsetMonitor.exe [2011-11-09 132768]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-04-15 75064]
S4 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S4 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S4 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2008-04-11 124264]

-----------------EOF-----------------

[Kallerno]

Vůbec netuším, jak se této havěti zbavit.Co s tím?

[Rudy]

Poprosím o log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Kallerno]

Přikládám log z Combofixu (obsahuje 732343 znaků)

http://www22.zippyshare.com/v/73006108/file.html

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\windows\46B04D534E344388B6EE80FAB66AEF9B.TMP

File::
c:\windows\Tasks\At1.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[Kallerno]

Zítra se do toho pustím.

[Rudy]

OK.

[Kallerno]

Vyřešeno, díky

[Rudy]

Rád bych viděl log CF, obvykle se ještě dočišťuje.