100% cpu svchost

Zpráva

matus699 · #1 Příspěvek od **matus699** » 13 črc 2013 11:20

dobry den mam taky problem ze ako spustim pc po chvili sa mi vytazi cpu na 100% robi to program svchost.exe a pozeral som cez processhacker co to presne robi a zistil som ze to je wuaueng.dll
vedeli by ste mi pomoct?
antivirus som odinstaloval no problem pretrvava.. tu je log rsit

Logfile of random's system information tool 1.09 (written by random/random)
Run by Matus at 2013-09-11 12:16:13
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (50%) free of 41 GB
Total RAM: 511 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:16:21, on 11.9.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
F:\RSIT.exe
C:\Program Files\trend micro\Matus.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=wbst
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8822455828
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7276 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1644491937-1801674531-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1644491937-1801674531-1004UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.8.800.94 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\WINDOWS\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.7]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
NPOFF12.DLL
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
fcmdSrch.xml

C:\Documents and Settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default\extensions\
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]
AC-Pro - C:\Program Files\AutocompletePro\AutocompletePro.dll [2010-07-14 97760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-09-10 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-09-10 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-09-23 860160]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"Google Update"=C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-09-07 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnTBMon]
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
C:\Program Files\Cyberlink\Shared Files\brs.exe [2008-05-19 91432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe [2011-01-24 427008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-02-10 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Aggiorna ESET license.lnk]
C:\PROGRA~1\ESET\MINODL~1\launcher.exe [2013-05-19 96768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^BDARemote.lnk]
C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE [2007-06-26 81997]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ScanPanel.lnk]
C:\SCANPA~1\ScnPanel.exe [2002-01-23 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Matus^Nabídka Start^Programy^Po spuštění^GameRanger.lnk]
C:\DOCUME~1\Matus\DATAAP~1\GAMERA~1\GAMERA~2\GAMERA~1.EXE [2011-01-28 1257184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-02-11 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2009-05-30 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\_HRY\Counter-Strike Source\hl2.exe"="D:\_HRY\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"D:\_HRY\Counter Strike\Valve\hl.exe"="D:\_HRY\Counter Strike\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"D:\_HRY\Warcraft III\Warcraft III.exe"="D:\_HRY\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\_HRY\Warcraft III\War3.exe"="D:\_HRY\Warcraft III\War3.exe:*:Enabled:Warcraft III"
"C:\Documents and Settings\Matus\Data aplikací\GameRanger\GameRanger\GameRanger.exe"="C:\Documents and Settings\Matus\Data aplikací\GameRanger\GameRanger\GameRanger.exe:*:Enabled:GameRanger"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"midi"=wdmaud.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3filter"=ac3filter.acm
"VIDC.ACDV"=ACDV.dll
"VIDC.FMVC"=fmcodec.dll
"wave1"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-09-10 17:54:46 ----A---- C:\WINDOWS\system32\MRT.exe
2013-09-10 17:40:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2345886$
2013-09-10 17:40:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2631813$
2013-09-10 17:40:14 ----A---- C:\WINDOWS\imsins.BAK
2013-09-10 17:40:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2653956$
2013-09-10 17:27:17 ----D---- C:\Documents and Settings\Matus\Data aplikací\Process Hacker 2
2013-09-10 17:25:54 ----D---- C:\Program Files\Process Hacker 2
2013-09-10 17:15:23 ----D---- C:\Program Files\Common Files\Java
2013-09-10 17:15:06 ----A---- C:\WINDOWS\system32\javaws.exe
2013-09-10 17:14:55 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2013-09-10 17:14:54 ----A---- C:\WINDOWS\system32\javaw.exe
2013-09-10 17:14:54 ----A---- C:\WINDOWS\system32\java.exe
2013-09-10 16:58:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\APN
2013-09-10 16:56:58 ----D---- C:\Program Files\VideoLAN
2013-09-10 16:52:14 ----D---- C:\Program Files\Common Files\Skype
2013-09-10 15:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2712808$
2013-09-10 15:42:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2834904_WM11$
2013-09-10 15:40:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2479943$
2013-09-10 15:40:47 ----HDC---- C:\WINDOWS\$NtUninstallKB2659262$
2013-09-10 15:40:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2564958$
2013-09-10 15:39:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2758857$
2013-09-10 15:38:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2013-09-10 15:38:54 ----HDC---- C:\WINDOWS\$NtUninstallKB2834886$
2013-09-10 15:38:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2013-09-10 15:38:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2850851$
2013-09-10 15:38:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2585542$
2013-09-10 15:38:22 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2013-09-10 15:37:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2691442$
2013-09-10 15:37:33 ----HDC---- C:\WINDOWS\$NtUninstallKB2779562$
2013-09-10 15:37:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2655992$
2013-09-10 15:37:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2802968$
2013-09-10 15:37:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2485663$
2013-09-10 15:37:07 ----HDC---- C:\WINDOWS\$NtUninstallKB2598479$
2013-09-10 15:37:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2686509$
2013-09-10 15:36:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2013-09-10 15:36:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2780091$
2013-09-10 15:36:15 ----HDC---- C:\WINDOWS\$NtUninstallKB2845187$
2013-09-10 15:36:07 ----HDC---- C:\WINDOWS\$NtUninstallKB2624667$
2013-09-10 15:35:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2719985$
2013-09-10 15:35:24 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
2013-09-10 15:35:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2753842-v2$
2013-09-10 15:35:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2770660$
2013-09-10 15:34:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2535512$
2013-09-10 15:34:11 ----HDC---- C:\WINDOWS\$NtUninstallKB2839229$
2013-09-10 15:33:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2807986$
2013-09-10 15:33:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2570947$
2013-09-10 15:33:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2820917$
2013-09-10 15:33:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2603381$
2013-09-10 15:33:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2757638$
2013-09-10 15:33:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2508429$
2013-09-10 15:33:07 ----HDC---- C:\WINDOWS\$NtUninstallKB2820197$
2013-09-10 15:33:00 ----HDC---- C:\WINDOWS\$NtUninstallKB2749655$
2013-09-10 15:32:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$
2013-09-10 15:32:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2506212$
2013-09-10 15:32:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2698365$
2013-09-10 15:32:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2619339$
2013-09-10 15:32:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2705219-v2$
2013-09-10 15:31:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2727528$
2013-09-10 15:31:33 ----HDC---- C:\WINDOWS\$NtUninstallKB2723135-v2$
2013-09-10 15:31:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2618451$
2013-09-10 15:30:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2661254-v2$
2013-09-10 15:28:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2509553$
2013-09-10 15:28:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2676562$
2013-09-10 15:26:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2620712$
2013-09-10 15:26:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2013-09-10 15:26:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2661637$
2013-09-10 15:26:03 ----HDC---- C:\WINDOWS\$NtUninstallKB2584146$
2013-09-10 15:21:12 ----N---- C:\WINDOWS\system32\browserchoice.exe
2013-09-10 15:09:13 ----N---- C:\WINDOWS\system32\iacenc.dll
2013-09-07 21:52:21 ----RA---- C:\WINDOWS\system32\48UMicro.dll
2013-09-07 21:52:21 ----RA---- C:\WINDOWS\GetKey.dll
2013-09-07 21:52:21 ----RA---- C:\WINDOWS\A4.dll
2013-09-07 17:46:01 ----D---- C:\Program Files\Common Files\Adobe
2013-09-07 17:46:01 ----D---- C:\Program Files\Adobe
2013-09-07 17:45:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2013-09-07 17:36:32 ----A---- C:\WINDOWS\system32\npDeployJava1.dll
2013-09-07 17:35:14 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-07 17:21:17 ----D---- C:\Program Files\Mozilla Firefox
2013-09-07 16:25:36 ----A---- C:\WINDOWS\system32\drivers\sisnic.sys
2013-09-07 16:23:17 ----A---- C:\WINDOWS\system32\ntsim.sys
2013-09-07 16:01:39 ----D---- C:\WINDOWS\SiS
2013-09-07 15:37:11 ----D---- C:\Program Files\Common Files\ATI Technologies
2013-09-07 15:36:56 ----D---- C:\Program Files\DIFX
2013-09-07 15:36:49 ----D---- C:\Program Files\USB TV
2013-09-07 15:12:36 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2013-09-07 15:01:32 ----A---- C:\WINDOWS\system32\VGAunistlog.ini
2013-09-07 14:59:45 ----A---- C:\WINDOWS\system32\drivers\MidiSyn.sys
2013-09-07 14:59:24 ----A---- C:\WINDOWS\system32\drivers\senfilt.sys
2013-09-07 14:59:24 ----A---- C:\WINDOWS\system32\drivers\aeaudio.sys
2013-09-07 14:59:24 ----A---- C:\WINDOWS\system32\a3d.dll
2013-09-07 14:59:22 ----A---- C:\WINDOWS\system32\wdmioctl.dll
2013-09-07 14:59:22 ----A---- C:\WINDOWS\system32\SMMedia.dll
2013-09-07 14:59:20 ----D---- C:\WINDOWS\VirtualEar
2013-09-07 14:59:20 ----A---- C:\WINDOWS\system32\virtear.dll
2013-09-07 14:59:20 ----A---- C:\WINDOWS\system32\drivers\smwdm.sys
2013-09-07 14:59:20 ----A---- C:\WINDOWS\system32\Audio3d.dll
2013-09-07 14:59:19 ----D---- C:\Program Files\Analog Devices
2013-09-07 14:59:19 ----A---- C:\WINDOWS\system32\DSndUp.exe
2013-09-07 14:59:19 ----A---- C:\WINDOWS\system32\CleanUp.exe

======List of files/folders modified in the last 1 month======

2013-09-11 12:16:21 ----D---- C:\WINDOWS\Prefetch
2013-09-11 12:16:18 ----D---- C:\Program Files\trend micro
2013-09-11 12:13:50 ----D---- C:\WINDOWS\Temp
2013-09-10 21:17:50 ----D---- C:\WINDOWS
2013-09-10 21:12:37 ----SHD---- C:\Config.Msi
2013-09-10 21:12:17 ----D---- C:\Program Files\ESET
2013-09-10 21:11:58 ----D---- C:\WINDOWS\inf
2013-09-10 21:11:57 ----D---- C:\WINDOWS\system32\drivers
2013-09-10 21:11:38 ----D---- C:\WINDOWS\system32\CatRoot2
2013-09-10 21:11:23 ----SHD---- C:\WINDOWS\Installer
2013-09-10 21:07:41 ----D---- C:\Program Files
2013-09-10 21:01:06 ----D---- C:\WINDOWS\Driver Cache
2013-09-10 19:58:16 ----D---- C:\WINDOWS\Microsoft.NET
2013-09-10 18:01:27 ----D---- C:\WINDOWS\system32
2013-09-10 17:51:29 ----D---- C:\WINDOWS\pss
2013-09-10 17:40:35 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-09-10 17:19:21 ----RSD---- C:\WINDOWS\assembly
2013-09-10 17:15:23 ----D---- C:\Program Files\Common Files
2013-09-10 17:13:07 ----A---- C:\WINDOWS\system32\deployJava1.dll
2013-09-10 17:11:38 ----D---- C:\Program Files\Java
2013-09-10 17:06:40 ----D---- C:\Program Files\Pando Networks
2013-09-10 16:59:49 ----D---- C:\Documents and Settings\Matus\Data aplikací\vlc
2013-09-10 16:58:29 ----D---- C:\Program Files\DsNET Corp
2013-09-10 16:57:09 ----D---- C:\Documents and Settings\Matus\Data aplikací\Skype
2013-09-10 16:52:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2013-09-10 16:52:15 ----RD---- C:\Program Files\Skype
2013-09-10 16:48:00 ----D---- C:\Documents and Settings\Matus\Data aplikací\skypePM
2013-09-10 16:14:41 ----SD---- C:\WINDOWS\Downloaded Program Files
2013-09-10 16:09:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-09-10 16:06:54 ----D---- C:\Program Files\Microsoft Silverlight
2013-09-10 15:40:48 ----D---- C:\WINDOWS\WinSxS
2013-09-10 15:38:43 ----HD---- C:\WINDOWS\$hf_mig$
2013-09-10 15:35:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2013-09-10 15:32:04 ----D---- C:\Program Files\Internet Explorer
2013-09-10 15:31:50 ----D---- C:\WINDOWS\ie8updates
2013-09-10 15:27:31 ----D---- C:\WINDOWS\system32\XPSViewer
2013-09-10 15:23:04 ----D---- C:\Program Files\Foxit Software
2013-09-07 21:47:45 ----A---- C:\WINDOWS\ScnPanel.ini
2013-09-07 21:47:22 ----D---- C:\ScanPanel
2013-09-07 19:59:22 ----A---- C:\WINDOWS\NeroDigital.ini
2013-09-07 18:47:05 ----D---- C:\WINDOWS\Help
2013-09-07 18:41:29 ----D---- C:\WINDOWS\system32\CatRoot
2013-09-07 18:39:45 ----D---- C:\WINDOWS\Network Diagnostic
2013-09-07 18:36:43 ----D---- C:\Documents and Settings\Matus\Data aplikací\Winamp
2013-09-07 18:36:43 ----D---- C:\Documents and Settings\Matus\Data aplikací\DAEMON Tools Lite
2013-09-07 18:36:34 ----D---- C:\WINDOWS\Logs
2013-09-07 18:34:04 ----D---- C:\Program Files\Hamachi
2013-09-07 18:33:57 ----D---- C:\Temp
2013-09-07 18:27:59 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-09-07 17:54:40 ----D---- C:\Program Files\CCleaner
2013-09-07 17:47:09 ----SD---- C:\Documents and Settings\Matus\Data aplikací\Microsoft
2013-09-07 17:47:09 ----D---- C:\Documents and Settings\Matus\Data aplikací\Adobe
2013-09-07 17:35:25 ----SD---- C:\WINDOWS\Tasks
2013-09-07 17:18:40 ----D---- C:\Program Files\WinRAR
2013-09-07 16:23:33 ----A---- C:\WINDOWS\AS_Debug.txt
2013-09-07 15:36:56 ----DC---- C:\WINDOWS\system32\DRVSTORE
2013-09-07 15:36:47 ----HD---- C:\Program Files\InstallShield Installation Information
2013-09-07 15:15:00 ----D---- C:\Program Files\ATI Technologies
2013-09-07 14:59:20 ----D---- C:\WINDOWS\system
2013-09-07 14:49:55 ----RD---- C:\WINDOWS\Web
2013-09-07 14:49:49 ----A---- C:\WINDOWS\WININIT.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2005-08-18 93568]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI NEC FireWarden; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2009-05-30 61824]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2008-08-20 44944]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-09-07 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-05-30 77568]
R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-05-08 35840]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2004-10-14 4962]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl []
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2011-03-06 281760]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2011-03-06 25888]
R2 rspndr;Odpovídající zařízení zjišťování topologie linkové vrstvy; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2008-05-29 62848]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-02-11 3565056]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-03-01 392704]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-28 220992]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS []
S3 almlg8e1;almlg8e1; C:\WINDOWS\system32\drivers\almlg8e1.sys []
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2009-05-30 60800]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-10-02 25280]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-14 88960]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
S3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2009-05-30 61824]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-12-21 34048]
S3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-12-21 13056]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1018bus.sys [2009-03-25 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys [2009-03-25 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1018mdm.sys [2009-03-25 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys [2009-03-25 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1018nd5.sys [2009-03-25 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1018obex.sys [2009-03-25 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1018unic.sys [2009-03-25 109864]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2008-04-13 32768]
S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2005-12-19 32768]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-22 32384]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbser;Sony Ericsson USB Serial Port; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-13 26112]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2009-05-30 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-05-30 82944]
S4 exFat;exFat; C:\WINDOWS\system32\drivers\exFat.sys [2008-09-29 133632]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-02-11 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-09-10 182184]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2007-06-05 177704]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2009-05-30 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2010-02-10 593920]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-06-21 162408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-07 256904]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-09-07 117144]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2010-10-26 155344]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2012-09-27 129632]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 13 črc 2013 11:31

Zdravim

Antivir nainstalujte zpatky, jaky tam davate? Ten za to nemuze

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Pockejte na dokonceni PreScanu
Zvolte moznost Prohledat (scan)
Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
Detailni postup vc. obrazku mate zde http://forum.viry.cz/viewtopic.php?f=24&t=120452

matus699 · #3 Příspěvek od **matus699** » 13 črc 2013 12:08

teraz tam je antivirus avira predtym tam bol nejaky stary eset...

tu je log
RogueKiller V8.6.2 [Jul 5 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operačný systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spustené v : Normálny režim
Užívateľ : Matus [Práva Správcu]
Režim : Kontrola -- Dátum : 09/11/2013 13:06:09
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy : 0 ¤¤¤

¤¤¤ Záznamy Registrov : 1 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NÁJDENÉ

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spustenie položky : 0 ¤¤¤

¤¤¤ webové prehliadače : 0 ¤¤¤

¤¤¤ Zvláštne súbory / Adresáre: ¤¤¤

¤¤¤ Ovládač : [NAHRATÉ] ¤¤¤
[Address] SSDT[25] : NtClose @ 0x805B1EA4 -> HOOKED (Unknown @ 0xF8BF089C)
[Address] SSDT[41] : NtCreateKey @ 0x8061AF8C -> HOOKED (Unknown @ 0xF8BF0856)
[Address] SSDT[50] : NtCreateSection @ 0x805A092C -> HOOKED (Unknown @ 0xF8BF08A6)
[Address] SSDT[53] : NtCreateThread @ 0x805C748E -> HOOKED (Unknown @ 0xF8BF084C)
[Address] SSDT[63] : NtDeleteKey @ 0x8061B428 -> HOOKED (Unknown @ 0xF8BF085B)
[Address] SSDT[65] : NtDeleteValueKey @ 0x8061B5F8 -> HOOKED (Unknown @ 0xF8BF0865)
[Address] SSDT[68] : NtDuplicateObject @ 0x805B3AB8 -> HOOKED (Unknown @ 0xF8BF0897)
[Address] SSDT[98] : NtLoadKey @ 0x8061D1B0 -> HOOKED (Unknown @ 0xF8BF086A)
[Address] SSDT[122] : NtOpenProcess @ 0x805C1512 -> HOOKED (Unknown @ 0xF8BF0838)
[Address] SSDT[128] : NtOpenThread @ 0x805C179E -> HOOKED (Unknown @ 0xF8BF083D)
[Address] SSDT[177] : NtQueryValueKey @ 0x806191B0 -> HOOKED (Unknown @ 0xF8BF08BF)
[Address] SSDT[193] : NtReplaceKey @ 0x8061D060 -> HOOKED (Unknown @ 0xF8BF0874)
[Address] SSDT[200] : NtRequestWaitReplyPort @ 0x805982D0 -> HOOKED (Unknown @ 0xF8BF08B0)
[Address] SSDT[204] : NtRestoreKey @ 0x8061C96C -> HOOKED (Unknown @ 0xF8BF086F)
[Address] SSDT[213] : NtSetContextThread @ 0x805C90E6 -> HOOKED (Unknown @ 0xF8BF08AB)
[Address] SSDT[237] : NtSetSecurityObject @ 0x805B622A -> HOOKED (Unknown @ 0xF8BF08B5)
[Address] SSDT[247] : NtSetValueKey @ 0x806194FE -> HOOKED (Unknown @ 0xF8BF0860)
[Address] SSDT[255] : NtSystemDebugControl @ 0x8060EED6 -> HOOKED (Unknown @ 0xF8BF08BA)
[Address] SSDT[257] : NtTerminateProcess @ 0x805C879A -> HOOKED (Unknown @ 0xF8BF0847)
[Address] Shadow SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0xF8BF08CE)
[Address] Shadow SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0xF8BF08D3)

¤¤¤ Vonkajšie Hives: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Súbor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: Maxtor 6L200P0 +++++
--- User ---
[MBR] f6160709069d80ec89738f9d88e1c53b
[BSP] 8d68cfe028c987550ab8c1866ad23d40 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 40986 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 83939625 | Size: 153480 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Maxtor 6L200P0 +++++
--- User ---
[MBR] 087404c3cfc323583d545291dbc0648a
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 8064 | Size: 14988 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Dokončené : << RKreport[0]_S_09112013_130609.txt >>

#4 Příspěvek od **vyosek** » 13 črc 2013 12:18

Neleglni zastaraly ESET co

Uz jednou jste tu byl za to pokaran, a nedate si rict a nedate

Stahnete SecurityCheck http://screen317.spywareinfoforum.org/SecurityCheck.exe

Ulozte nejlepe na Plochu
Spustte tradicne dvouklikem a postupujte dle pokynu utility
Po dokonceni skenu se vytvori a otevre log, ten mi sem vlozte

matus699 · #5 Příspěvek od **matus699** » 13 črc 2013 13:03

fuha ja som aj zabudol ze som mal podobny problem

teraz sa citim divne

tu je log
Results of screen317's Security Check version 0.99.69
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (22.0)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C::
````````````````````End of Log``````````````````````

#6 Příspěvek od **vyosek** » 13 črc 2013 16:34

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

matus699 · #7 Příspěvek od **matus699** » 13 črc 2013 17:18

log z rkill
Rkill 2.5.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 09/11/2013 05:50:37 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\WINDOWS\system32\Ati2evxx.exe (PID: 772) [WD-HEUR]
* C:\WINDOWS\system32\Ati2evxx.exe (PID: 1028) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\sfcfiles.dll : 1 571 840 : 05/30/2009 01:24 PM : 1e603ea2a3fdbae9e5b88a8cb3c03124 [NoSig]

Checking HOSTS File:

* Cannot edit the HOSTS file.
* Permissions could not be fixed. Use Hosts-perm.bat to fix permissions: http://www.bleepingcomputer.com/download/hosts-permbat/

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 09/11/2013 05:51:35 PM
Execution time: 0 hours(s), 0 minute(s), and 58 seconds(s)

teraz log z combofix

ComboFix 13-07-13.01 - Matus 11.09.2013 18:02:21.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.511.222 [GMT 2:00]
Running from: c:\documents and settings\Matus\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\windows\system32\TZLog.log
.
.
((((((((((((((((((((((((( Files Created from 2013-08-11 to 2013-09-11 )))))))))))))))))))))))))))))))
.
.
2013-09-11 10:55 . 2013-09-11 10:55 -------- d-----w- c:\documents and settings\Matus\Data aplikací\Avira
2013-09-11 10:53 . 2013-09-11 10:53 -------- d-----w- c:\program files\AskPartnerNetwork
2013-09-11 10:53 . 2013-09-11 10:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AskPartnerNetwork
2013-09-11 10:49 . 2013-09-11 10:48 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-11 10:49 . 2013-09-11 10:48 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-09-11 10:49 . 2013-09-11 10:48 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-11 10:49 . 2013-09-11 10:49 -------- d-----w- c:\program files\Avira
2013-09-10 15:50 . 2013-09-10 15:50 -------- d-----w- c:\documents and settings\Matus\Local Settings\Data aplikací\Sun
2013-09-10 15:27 . 2013-09-10 15:27 -------- d-----w- c:\documents and settings\Matus\Data aplikací\Process Hacker 2
2013-09-10 15:25 . 2013-09-10 15:25 -------- d-----w- c:\program files\Process Hacker 2
2013-09-10 15:15 . 2013-09-10 15:15 -------- d-----w- c:\program files\Common Files\Java
2013-09-10 15:15 . 2013-09-10 15:13 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-09-10 15:14 . 2013-09-10 15:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-09-10 14:58 . 2013-09-10 14:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\APN
2013-09-10 14:56 . 2013-09-10 14:56 -------- d-----w- c:\program files\VideoLAN
2013-09-10 14:52 . 2013-09-10 14:52 -------- d-----w- c:\program files\Common Files\Skype
2013-09-10 13:21 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2013-09-10 13:13 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-09-10 13:12 . 2013-06-07 21:53 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-09-10 13:09 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2013-09-10 13:09 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
2013-09-07 19:52 . 2002-01-11 09:54 167936 ----a-r- c:\windows\A4.dll
2013-09-07 19:52 . 2002-01-06 03:57 7168 ----a-r- c:\windows\system32\48UMicro.dll
2013-09-07 19:52 . 2001-10-18 10:01 45056 ----a-r- c:\windows\GetKey.dll
2013-09-07 15:46 . 2013-09-07 15:46 -------- d-----w- c:\program files\Common Files\Adobe
2013-09-07 15:36 . 2013-09-10 15:13 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-09-07 15:35 . 2013-09-07 18:25 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-07 15:31 . 2013-09-07 15:47 -------- d-----w- c:\documents and settings\Matus\Local Settings\Data aplikací\Adobe
2013-09-07 14:25 . 2008-04-13 18:05 32768 -c--a-w- c:\windows\system32\dllcache\sisnic.sys
2013-09-07 14:25 . 2008-04-13 18:05 32768 ----a-w- c:\windows\system32\drivers\sisnic.sys
2013-09-07 14:23 . 2003-07-17 14:10 7040 ----a-w- c:\windows\system32\ntsim.sys
2013-09-07 14:01 . 2013-09-07 14:01 -------- d-----w- c:\windows\SiS
2013-09-07 13:37 . 2013-09-07 13:37 -------- d-----w- c:\program files\Common Files\ATI Technologies
2013-09-07 13:36 . 2013-09-07 13:36 -------- d-----w- c:\program files\DIFX
2013-09-07 13:36 . 2013-09-07 13:36 -------- d-----w- c:\program files\USB TV
2013-09-07 13:12 . 2010-02-10 19:20 593920 ------w- c:\windows\system32\ati2sgag.exe
2013-09-07 13:00 . 2013-09-07 13:00 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-09-07 13:00 . 2013-09-07 13:00 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-09-07 13:00 . 2002-12-05 12:12 692224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-09-07 13:00 . 2002-12-05 12:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-09-07 13:00 . 2002-12-02 13:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-09-07 13:00 . 2002-12-02 11:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-09-07 13:00 . 2002-12-02 11:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-09-07 12:58 . 2004-04-18 21:42 733184 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll
2013-09-07 12:58 . 2004-04-18 21:40 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll
2013-09-07 12:58 . 2004-04-18 21:39 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll
2013-09-07 12:58 . 2004-04-18 21:39 172032 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
2013-09-07 12:58 . 2004-04-18 21:39 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe
2013-09-07 12:58 . 2013-09-07 12:58 180356 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll
2013-09-07 12:58 . 2013-09-07 12:58 303236 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-10 15:13 . 2010-09-07 16:26 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-09-07 18:25 . 2011-09-13 11:01 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-30 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-07-02 22:41 12240 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-07-02 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-09-11 345144]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-07-02 1558480]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Aggiorna ESET license.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Aggiorna ESET license.lnk
backup=c:\windows\pss\Aggiorna ESET license.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^BDARemote.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\BDARemote.lnk
backup=c:\windows\pss\BDARemote.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ScanPanel.lnk]
backup=c:\windows\pss\ScanPanel.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Matus^Nabídka Start^Programy^Po spuštění^GameRanger.lnk]
backup=c:\windows\pss\GameRanger.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnTBMon]
2013-07-02 22:41 1558480 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2008-05-19 10:54 91432 ----a-w- c:\program files\CyberLink\Shared Files\brs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 22:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 12:01 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
2007-12-14 07:06 50472 ------w- c:\program files\CyberLink\PowerDVD8\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
2008-03-20 15:53 83240 ------w- c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2011-01-24 10:42 427008 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-02-10 21:32 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\_HRY\\Counter-Strike Source\\hl2.exe"=
"d:\\_HRY\\Counter Strike\\Valve\\hl.exe"=
"d:\\_HRY\\Warcraft III\\Warcraft III.exe"=
"d:\\_HRY\\Warcraft III\\War3.exe"=
"c:\\Documents and Settings\\Matus\\Data aplikací\\GameRanger\\GameRanger\\GameRanger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"58639:TCP"= 58639:TCP:Pando Media Booster
"58639:UDP"= 58639:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.9.2010 17:31 691696]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11.9.2013 12:49 37352]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [15.5.2008 9:37 61424]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.9.2013 12:49 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [11.9.2013 12:49 589368]
R2 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [3.7.2013 0:41 168400]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [1.3.2011 21:58 90112]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [21.6.2013 9:53 162408]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [1.3.2011 21:27 89256]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [1.3.2011 21:27 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [1.3.2011 21:27 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [1.3.2011 21:27 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [1.3.2011 21:27 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [1.3.2011 21:27 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [1.3.2011 21:27 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [1.3.2011 21:27 109864]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [1.3.2011 21:32 155344]
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-07 18:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.facemoods.com/?a=wbst
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default\
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-11 18:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(548)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'lsass.exe'(604)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
Completion time: 2013-09-11 18:11:11
ComboFix-quarantined-files.txt 2013-09-11 16:11
.
Pre-Run: Volných bajtů: 20 886 872 064
Post-Run: Volných bajtů: 20 994 613 248
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 693A9715917187FE1AAB2830BDAAC7CB
413FC2A0C716421B3158746D63736515

#8 Příspěvek od **vyosek** » 13 črc 2013 17:20

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Prohledat
Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

matus699 · #9 Příspěvek od **matus699** » 13 črc 2013 17:27

log z adwcleaner

# AdwCleaner v2.305 - Log vytvooen 11/09/2013 v 18:26:02
# Aktualizováno 11/07/2013 Xplode
# Operaení systém : Microsoft Windows XP Service Pack 3 (32 bits)
# Uživatel : Matus - MATUS-6282F6A45
# Spuštin systém : Normální
# Spuštino z : C:\Documents and Settings\Matus\Plocha\adwcleaner.exe
# Volba [Prohledat]

***** [Služby] *****

Nalezeno : APNMCP

***** [Soubory / Složky] *****

Složka Nalezeno : C:\Documents and Settings\All Users\Data aplikací\APN
Složka Nalezeno : C:\Documents and Settings\All Users\Data aplikací\AskPartnerNetwork
Složka Nalezeno : C:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Složka Nalezeno : C:\Documents and Settings\All Users\Data aplikací\PC Optimizer Pro
Složka Nalezeno : C:\Documents and Settings\All Users\Nabídka Start\Programy\PC Optimizer Pro
Složka Nalezeno : C:\Documents and Settings\Matus\Data aplikací\facemoods.com
Složka Nalezeno : C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\defdhglnppeioeflggkmglipcecffkhk
Složka Nalezeno : C:\Program Files\AskPartnerNetwork
Složka Nalezeno : C:\Program Files\ICQ6Toolbar
Složka Nalezeno : C:\Program Files\PC Optimizer Pro
Soubor Nalezeno : C:\Documents and Settings\All Users\Plocha\PC Optimizer Pro.lnk
Soubor Nalezeno : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml

***** [Registry] *****

Hodnota Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Klíe Nalezeno : HKCU\Software\AskPartnerNetwork
Klíe Nalezeno : HKCU\Software\AutocompleteProBHO
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\ICQ\ICQToolbar
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Nalezeno : HKCU\Software\pc optimizer pro
Klíe Nalezeno : HKCU\Software\Softonic
Klíe Nalezeno : HKCU\Software\YahooPartnerToolbar
Klíe Nalezeno : HKLM\Software\AskPartnerNetwork
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{442F13BC-2031-42D5-9520-437F65271153}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\AutocompletePro.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Klíe Nalezeno : HKLM\SOFTWARE\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk
Klíe Nalezeno : HKLM\Software\ICQ\ICQToolbar
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AutocompletePro3_is1
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\pc optimizer pro
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc optimizer pro
Klíe Nalezeno : HKLM\Software\pc optimizer pro
Klíe Nalezeno : HKU\S-1-5-21-299502267-1644491937-1801674531-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Klíe Nalezeno : HKU\S-1-5-21-299502267-1644491937-1801674531-1004\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v8.0.6001.18702

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.facemoods.com/?a=wbst
[HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

-\\ Mozilla Firefox v22.0 (sk)

Soubor : C:\Documents and Settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default\prefs.js

[OK] Soubor je eistý.

-\\ Google Chrome v28.0.1500.71

Soubor : C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Preferences

Nalezeno [l.2185] : homepage = "hxxp://start.facemoods.com/?a=wbst",

*************************

AdwCleaner[R1].txt - [5667 octets] - [11/09/2013 18:26:02]

########## EOF - C:\AdwCleaner[R1].txt - [5727 octets] ##########

#10 Příspěvek od **vyosek** » 13 črc 2013 17:36

Spustte znovu AdwCleaner

Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
Kliknete na Smazat
PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

matus699 · #11 Příspěvek od **matus699** » 13 črc 2013 17:47

tu je
# AdwCleaner v2.305 - Log vytvooen 11/09/2013 v 18:42:07
# Aktualizováno 11/07/2013 Xplode
# Operaení systém : Microsoft Windows XP Service Pack 3 (32 bits)
# Uživatel : Matus - MATUS-6282F6A45
# Spuštin systém : Normální
# Spuštino z : C:\Documents and Settings\Matus\Plocha\adwcleaner.exe
# Volba [Vymazat]

***** [Služby] *****

Zastaveno & vymazáno : APNMCP

***** [Soubory / Složky] *****

Složka Vymazáno : C:\Documents and Settings\All Users\Data aplikací\APN
Složka Vymazáno : C:\Documents and Settings\All Users\Data aplikací\AskPartnerNetwork
Složka Vymazáno : C:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Složka Vymazáno : C:\Documents and Settings\All Users\Data aplikací\PC Optimizer Pro
Složka Vymazáno : C:\Documents and Settings\All Users\Nabídka Start\Programy\PC Optimizer Pro
Složka Vymazáno : C:\Documents and Settings\Matus\Data aplikací\facemoods.com
Složka Vymazáno : C:\Program Files\AskPartnerNetwork
Složka Vymazáno : C:\Program Files\ICQ6Toolbar
Složka Vymazáno : C:\Program Files\PC Optimizer Pro
Soubor Vymazáno : C:\Documents and Settings\All Users\Plocha\PC Optimizer Pro.lnk
Soubor Vymazáno : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml
Vymazáno poi restartu : C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\defdhglnppeioeflggkmglipcecffkhk

***** [Registry] *****

Hodnota Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Klíe Vymazáno : HKCU\Software\AskPartnerNetwork
Klíe Vymazáno : HKCU\Software\AutocompleteProBHO
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\ICQ\ICQToolbar
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Vymazáno : HKCU\Software\pc optimizer pro
Klíe Vymazáno : HKCU\Software\Softonic
Klíe Vymazáno : HKCU\Software\YahooPartnerToolbar
Klíe Vymazáno : HKLM\Software\AskPartnerNetwork
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{442F13BC-2031-42D5-9520-437F65271153}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\AutocompletePro.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Klíe Vymazáno : HKLM\SOFTWARE\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk
Klíe Vymazáno : HKLM\Software\ICQ\ICQToolbar
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AutocompletePro3_is1
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\pc optimizer pro
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc optimizer pro
Klíe Vymazáno : HKLM\Software\pc optimizer pro

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v8.0.6001.18702

Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.facemoods.com/?a=wbst --> hxxp://www.google.com
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v22.0 (sk)

Soubor : C:\Documents and Settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default\prefs.js

[OK] Soubor je eistý.

-\\ Google Chrome v28.0.1500.71

Soubor : C:\Documents and Settings\Matus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Preferences

Vymazáno [l.2185] : homepage = "hxxp://start.facemoods.com/?a=wbst",

*************************

AdwCleaner[R1].txt - [5796 octets] - [11/09/2013 18:26:02]
AdwCleaner[R2].txt - [5856 octets] - [11/09/2013 18:41:57]
AdwCleaner[S1].txt - [5565 octets] - [11/09/2013 18:42:07]

########## EOF - C:\AdwCleaner[S1].txt - [5625 octets] ##########

#12 Příspěvek od **vyosek** » 13 črc 2013 18:16

Poprosim o DDS http://forum.viry.cz/viewtopic.php?f=13&t=125171

matus699 · #13 Příspěvek od **matus699** » 13 črc 2013 18:25

ok tu je

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.25.2
Run by Matus at 19:23:13 on 2013-09-11
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.511.243 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
BHO: Avira SearchFree Toolbar plus Web Protection: {41564952-412D-5637-00A7-7A786E7484D7} -
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Avira SearchFree Toolbar plus Web Protection: {41564952-412D-5637-00A7-7A786E7484D7} -
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - c:\program files\icq7.2\ICQ.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdat ... 8822455828
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{BF4756F3-AB68-46D2-9394-EE8A2D1FE60F} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{FF1599FF-9DEC-4D4C-A41E-E8F759D0F7FD} : DHCPNameServer = 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\matus\data aplikací\mozilla\firefox\profiles\ut9ksj95.default\
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2013-9-11 37352]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\cyberlink\powerdvd8\000.fcl [2008-5-15 61424]
R2 AntiVirService;Avira Real-Time Protection;c:\program files\avira\antivir desktop\avguard.exe [2013-9-11 108088]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2013-9-11 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2013-9-11 589368]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2013-9-11 84744]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\sony ericsson\sony ericsson pc suite\SupServ.exe [2011-3-1 90112]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2008-4-14 69120]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-21 162408]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2011-3-1 89256]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [2011-3-1 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [2011-3-1 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [2011-3-1 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [2011-3-1 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [2011-3-1 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [2011-3-1 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [2011-3-1 109864]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\sony ericsson\sony ericsson pc companion\PCCService.exe [2011-3-1 155344]
.
=============== Created Last 30 ================
.
2013-09-11 15:57:34 -------- d-sha-r- C:\cmdcons
2013-09-11 15:55:32 98816 ----a-w- c:\windows\sed.exe
2013-09-11 15:55:32 256000 ----a-w- c:\windows\PEV.exe
2013-09-11 15:55:32 208896 ----a-w- c:\windows\MBR.exe
2013-09-11 10:55:47 -------- d-----w- c:\documents and settings\matus\data aplikací\Avira
2013-09-11 10:49:31 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-11 10:49:31 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-09-11 10:49:25 -------- d-----w- c:\program files\Avira
2013-09-10 15:27:17 -------- d-----w- c:\documents and settings\matus\data aplikací\Process Hacker 2
2013-09-10 15:25:54 -------- d-----w- c:\program files\Process Hacker 2
2013-09-10 15:15:10 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-09-10 15:14:55 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-09-10 14:56:58 -------- d-----w- c:\program files\VideoLAN
2013-09-10 13:21:12 293376 ------w- c:\windows\system32\browserchoice.exe
2013-09-10 13:13:10 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-09-10 13:12:33 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-09-10 13:09:13 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2013-09-10 13:09:13 3072 ------w- c:\windows\system32\iacenc.dll
2013-09-07 19:52:21 7168 ----a-r- c:\windows\system32\48UMicro.dll
2013-09-07 19:52:21 45056 ----a-r- c:\windows\GetKey.dll
2013-09-07 19:52:21 167936 ----a-r- c:\windows\A4.dll
2013-09-07 15:36:32 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-09-07 15:35:14 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-07 14:25:36 32768 -c--a-w- c:\windows\system32\dllcache\sisnic.sys
2013-09-07 14:25:36 32768 ----a-w- c:\windows\system32\drivers\sisnic.sys
2013-09-07 14:23:17 7040 ----a-w- c:\windows\system32\ntsim.sys
2013-09-07 14:01:39 -------- d-----w- c:\windows\SiS
2013-09-07 13:37:11 -------- d-----w- c:\program files\common files\ATI Technologies
2013-09-07 13:36:49 -------- d-----w- c:\program files\USB TV
2013-09-07 13:12:36 593920 ------w- c:\windows\system32\ati2sgag.exe
2013-09-07 13:00:27 692224 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2013-09-07 13:00:27 57344 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2013-09-07 13:00:27 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2013-09-07 13:00:27 282756 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2013-09-07 13:00:27 237568 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2013-09-07 13:00:27 163972 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2013-09-07 13:00:27 155648 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2013-09-07 12:58:59 733184 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\iKernel.dll
2013-09-07 12:58:59 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\ctor.dll
2013-09-07 12:58:59 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\DotNetInstaller.exe
2013-09-07 12:58:59 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\iscript.dll
2013-09-07 12:58:59 172032 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\iuser.dll
2013-09-07 12:58:58 180356 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\iGdi.dll
2013-09-07 12:58:57 303236 ----a-w- c:\program files\common files\installshield\professional\runtime\10\00\intel32\setup.dll
.
==================== Find3M ====================
.
2013-09-10 15:13:07 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-09-07 18:25:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 19:23:59,46 ===============

#14 Příspěvek od **vyosek** » 13 črc 2013 21:49

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

DDS::
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
BHO: Avira SearchFree Toolbar plus Web Protection: {41564952-412D-5637-00A7-7A786E7484D7} - 
TB: Avira SearchFree Toolbar plus Web Protection: {41564952-412D-5637-00A7-7A786E7484D7} - 

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=-
"ApnTBMon"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=-
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Aggiorna ESET license.lnk]
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^BDARemote.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"=-
"58639:TCP"=-
"58639:UDP"=-

File::
c:\windows\Tasks\Adobe Flash Player Updater.job

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

matus699 · #15 Příspěvek od **matus699** » 14 črc 2013 10:58

tu je log

ComboFix 13-07-13.01 - Matus 12.09.2013 11:40:42.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.511.202 [GMT 2:00]
Running from: c:\documents and settings\Matus\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Matus\Plocha\CFScript.txt
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
.
.
((((((((((((((((((((((((( Files Created from 2013-08-12 to 2013-09-12 )))))))))))))))))))))))))))))))
.
.
2013-09-11 10:55 . 2013-09-11 10:55 -------- d-----w- c:\documents and settings\Matus\Data aplikací\Avira
2013-09-11 10:49 . 2013-09-11 10:48 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-11 10:49 . 2013-09-11 10:48 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-09-11 10:49 . 2013-09-11 10:48 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-11 10:49 . 2013-09-11 10:49 -------- d-----w- c:\program files\Avira
2013-09-10 15:50 . 2013-09-10 15:50 -------- d-----w- c:\documents and settings\Matus\Local Settings\Data aplikací\Sun
2013-09-10 15:27 . 2013-09-10 15:27 -------- d-----w- c:\documents and settings\Matus\Data aplikací\Process Hacker 2
2013-09-10 15:25 . 2013-09-10 15:25 -------- d-----w- c:\program files\Process Hacker 2
2013-09-10 15:15 . 2013-09-10 15:15 -------- d-----w- c:\program files\Common Files\Java
2013-09-10 15:15 . 2013-09-10 15:13 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-09-10 15:14 . 2013-09-10 15:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-09-10 14:56 . 2013-09-10 14:56 -------- d-----w- c:\program files\VideoLAN
2013-09-10 14:52 . 2013-09-10 14:52 -------- d-----w- c:\program files\Common Files\Skype
2013-09-10 13:21 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2013-09-10 13:13 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-09-10 13:12 . 2013-06-07 21:53 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-09-10 13:09 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2013-09-10 13:09 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
2013-09-07 19:52 . 2002-01-11 09:54 167936 ----a-r- c:\windows\A4.dll
2013-09-07 19:52 . 2002-01-06 03:57 7168 ----a-r- c:\windows\system32\48UMicro.dll
2013-09-07 19:52 . 2001-10-18 10:01 45056 ----a-r- c:\windows\GetKey.dll
2013-09-07 15:46 . 2013-09-07 15:46 -------- d-----w- c:\program files\Common Files\Adobe
2013-09-07 15:36 . 2013-09-10 15:13 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-09-07 15:35 . 2013-09-07 18:25 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-07 15:31 . 2013-09-07 15:47 -------- d-----w- c:\documents and settings\Matus\Local Settings\Data aplikací\Adobe
2013-09-07 14:25 . 2008-04-13 18:05 32768 -c--a-w- c:\windows\system32\dllcache\sisnic.sys
2013-09-07 14:25 . 2008-04-13 18:05 32768 ----a-w- c:\windows\system32\drivers\sisnic.sys
2013-09-07 14:23 . 2003-07-17 14:10 7040 ----a-w- c:\windows\system32\ntsim.sys
2013-09-07 14:01 . 2013-09-07 14:01 -------- d-----w- c:\windows\SiS
2013-09-07 13:37 . 2013-09-07 13:37 -------- d-----w- c:\program files\Common Files\ATI Technologies
2013-09-07 13:36 . 2013-09-07 13:36 -------- d-----w- c:\program files\DIFX
2013-09-07 13:36 . 2013-09-07 13:36 -------- d-----w- c:\program files\USB TV
2013-09-07 13:12 . 2010-02-10 19:20 593920 ------w- c:\windows\system32\ati2sgag.exe
2013-09-07 13:00 . 2013-09-07 13:00 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-09-07 13:00 . 2013-09-07 13:00 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-09-07 13:00 . 2002-12-05 12:12 692224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-09-07 13:00 . 2002-12-05 12:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-09-07 13:00 . 2002-12-02 13:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-09-07 13:00 . 2002-12-02 11:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-09-07 13:00 . 2002-12-02 11:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-09-07 12:58 . 2004-04-18 21:42 733184 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll
2013-09-07 12:58 . 2004-04-18 21:40 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll
2013-09-07 12:58 . 2004-04-18 21:39 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll
2013-09-07 12:58 . 2004-04-18 21:39 172032 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
2013-09-07 12:58 . 2004-04-18 21:39 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe
2013-09-07 12:58 . 2013-09-07 12:58 180356 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll
2013-09-07 12:58 . 2013-09-07 12:58 303236 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-10 15:13 . 2010-09-07 16:26 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-09-07 18:25 . 2011-09-13 11:01 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-30 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-09-11 345144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ScanPanel.lnk]
backup=c:\windows\pss\ScanPanel.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Matus^Nabídka Start^Programy^Po spuštění^GameRanger.lnk]
backup=c:\windows\pss\GameRanger.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 12:01 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-02-10 21:32 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\_HRY\\Counter-Strike Source\\hl2.exe"=
"d:\\_HRY\\Counter Strike\\Valve\\hl.exe"=
"d:\\_HRY\\Warcraft III\\Warcraft III.exe"=
"d:\\_HRY\\Warcraft III\\War3.exe"=
"c:\\Documents and Settings\\Matus\\Data aplikací\\GameRanger\\GameRanger\\GameRanger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.9.2010 17:31 691696]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11.9.2013 12:49 37352]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [15.5.2008 9:37 61424]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.9.2013 12:49 84024]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [11.9.2013 12:49 589368]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [1.3.2011 21:58 90112]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [21.6.2013 9:53 162408]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [1.3.2011 21:27 89256]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [1.3.2011 21:27 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [1.3.2011 21:27 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [1.3.2011 21:27 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [1.3.2011 21:27 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [1.3.2011 21:27 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [1.3.2011 21:27 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [1.3.2011 21:27 109864]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [1.3.2011 21:32 155344]
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-07 18:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Matus\Data aplikací\Mozilla\Firefox\Profiles\ut9ksj95.default\
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-ApnTBMon - c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-12 11:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'lsass.exe'(608)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(2332)
c:\windows\system32\wpdshext.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\PSIService.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\avira\antivir desktop\guardgui.exe
.
**************************************************************************
.
Completion time: 2013-09-12 11:56:13 - machine was rebooted
ComboFix-quarantined-files.txt 2013-09-12 09:56
ComboFix2.txt 2013-09-11 16:11
.
Pre-Run: Volných bajtů: 20 775 284 736
Post-Run: Volných bajtů: 20 653 363 200
.
- - End Of File - - DFCEE56F380C02646227D8EEDD8B54BB
413FC2A0C716421B3158746D63736515

VIRY.CZ

100% cpu svchost

100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost

Re: 100% cpu svchost