Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Prosím o pomoc - DNS (?) Virus?

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Kachnacicek

Prosím o pomoc - DNS (?) Virus?

#1 Příspěvek od Kachnacicek »

Zdravím.
byl jsem u kamaráda s NTB, že mu nešli otevřít nějaké stránky - pomohlo restartovat router. Ovšem když jsem se vrátil domů, volal mi, že to opět nejde... Po zapnutí mého NTB doma jsem zjistil, že jsem pravděpodobně tento virus chytl také. Projevuje se tak, že mi v IE nejdou otevřít některé stránky (vypíše chybovou hlášku, nepamatuji si přesné znění, nechci akci opakovat, neboť se bojím nakažení vlastní domácí sítě) a pokud se nějaká stránka otevře, po ukončení IE se znovu a znovu IE spouští s poslední otevřenou stránkou...

Posílám Vám proto RSIT log a zároveň prosím o pomoc s tímto problémem.

Děkuji moc za Váš čas.

Hezký den.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Miloš Zákravský at 2014-08-21 20:38:36
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 32 GB (46%) free of 70 GB
Total RAM: 2038 MB (75% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003Core.job - C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003UA.job - C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT24810 ... hSource=13"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... ource=2&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.145 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\WinLessPlugin]
"Description"=Camera Stream Controller
"Path"=C:\Program Files\Camera Stream Controller\npWinLessRtspCtrl.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\extensions\
{124d001a-bdcb-472f-aa59-bbe7e4bc3204}
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}

C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-11-10 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-02-26 155648]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-02-26 131072]
"LoadFUJ02E3"=C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [2009-06-16 36712]
"TRUUpdater"=C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [2009-06-26 558360]
"WatcherHelper"=C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe [2009-04-07 62744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-06-09 794713]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [2008-12-19 83336]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-07-02 16377344]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2011-07-02 69632]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-06-29 89541]
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-18 188416]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"Panda Security URL Filtering"=C:\Documents and Settings\All Users\Data aplikací\Panda Security URL Filtering\Panda_URL_Filtering.exe [2013-09-26 235072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-07-02 136176]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\Wcescomm.exe [2006-11-13 1289000]

C:\Documents and Settings\Miloš Zákravský\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-02-26 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"MaxGPOScriptWait"=600

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\TRUUpdater.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe:*:Enabled:TRUUpdater"
"C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe:*:Enabled:SwiApiMux"
"F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe"="F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe:*:Enabled:Warcraft III"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\VideoViewer\VideoViewer.exe"="C:\Program Files\VideoViewer\VideoViewer.exe:*:Enabled:VideoViewer"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe"="C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe"="C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe:*:Enabled:InstallationWizard"
"C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe"="C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe"="C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe:*:Enabled:Installation Wizard 2"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\NVR Utility\IP Utility.exe"="C:\Program Files\NVR Utility\IP Utility.exe:*:Enabled:IP Utility"
"C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe"="C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe:*:Enabled:Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\pandasecuritytb\dtUser.exe"="C:\Program Files\pandasecuritytb\dtUser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe:*:Enabled:TeamViewer 9"
"C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe"="C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe:*:Enabled:WinLoad"
"C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe"="C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe:*:Enabled:Network Enabler Administrator"
"C:\Program Files\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe"="C:\Program Files\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe:*:Enabled:DeviceInstaller"
"E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe"="E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe:*:Enabled:winbox"
"E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE"="E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-08-21 20:38:37 ----D---- C:\Program Files\trend micro
2014-08-21 20:38:36 ----D---- C:\rsit
2014-08-14 21:40:06 ----A---- C:\WINDOWS\system32\ptpusb.dll
2014-08-14 21:40:05 ----A---- C:\WINDOWS\system32\ptpusd.dll

======List of files/folders modified in the last 1 month======

2014-08-21 20:38:37 ----RD---- C:\Program Files
2014-08-21 19:44:30 ----D---- C:\WINDOWS\system32\CatRoot2
2014-08-21 19:03:52 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-08-14 21:40:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-08-14 21:40:08 ----D---- C:\WINDOWS\system32
2014-08-14 21:40:05 ----D---- C:\WINDOWS\system32\drivers
2014-07-29 11:51:46 ----D---- C:\WinloadPrivateDir
2014-07-27 13:46:34 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-10-03 36640]
R0 O2SDRDR;O2SDRDR; C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-05-11 35456]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 nedrv;nedrv; C:\WINDOWS\system32\drivers\nedrv.sys [2005-04-11 54664]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-06-29 1160320]
R3 FUJ02B1;Fujitsu FUJ02B1 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys [2001-08-01 5248]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 4864]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-02-26 5700096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-07-02 4432384]
R3 NETw4x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-02-25 2203520]
R3 O2SCBUS;O2Micro SmartCardBus Reader; C:\WINDOWS\system32\DRIVERS\ozscr.sys [2009-10-16 101848]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-10-24 35913]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-06-09 193120]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-11-02 250496]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2011-03-18 61704]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2011-03-18 73096]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-10-24 17664]
S3 silabenm;JABLOTRON serial interface Serial Port Enumerator Driver; C:\WINDOWS\system32\DRIVERS\silabenm.sys [2012-08-13 47176]
S3 silabser;JABLOTRON serial interface Driver; C:\WINDOWS\system32\DRIVERS\silabser.sys [2012-08-13 61312]
S3 SWNC8U32;Sierra Wireless MUX NDIS Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swnc8u32.sys [2009-07-22 197504]
S3 SWUMX20;Sierra Wireless USB MUX Driver (UMTS20); C:\WINDOWS\system32\DRIVERS\swumx20.sys []
S3 SWUMX32;Sierra Wireless USB MUX Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swumx32.sys [2009-07-22 148992]
S3 Tosrfcom;Tosrfcom; C:\WINDOWS\system32\drivers\Tosrfcom.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2013-02-12 12928]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-11-10 153376]
R2 MCPH;DSC MCPH Service; C:\Program Files\DSC\DLS IV\MCPH\MCPH.exe [2012-12-17 209920]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R2 O2Flash;O2Flash Memory Service; C:\WINDOWS\system32\o2flash.exe [2005-09-13 57344]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2008-10-10 132456]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-27 262320]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119545
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o pomoc - DNS (?) Virus?

#2 Příspěvek od Rudy »

Zdravím!
Spusťte nejprve tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Kachnacicek

Re: Prosím o pomoc - DNS (?) Virus?

#3 Příspěvek od Kachnacicek »

# AdwCleaner v3.308 - Report created 21/08/2014 at 22:06:51
# Updated 20/08/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Miloš Zákravský - NOTESMZ
# Running from : C:\Documents and Settings\Miloš Zákravský\Plocha\adwcleaner_3.308.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Toolbar Cleaner
Folder Deleted : C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\CT2481032
Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Conduit
Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Data aplikací\PriceGong
Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\ConduitCommon
Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\CT2481032
Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\Extensions\{124d001a-bdcb-472f-aa59-bbe7e4bc3204}
[!] Folder Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec
File Deleted : C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\searchplugins\Conduit.xml
File Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage
File Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage-journal
File Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
File Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage
File Deleted : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\Lantronix\DeviceInstaller4.2\DeviceInstaller.exe]
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\PriceGong
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Toolbar Cleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v5.0 (cs)

[ File : C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\prefs.js ]

Line Deleted : user_pref("CT2481032..clientLogIsEnabled", false);
Line Deleted : user_pref("CT2481032..clientLogServiceUrl", "hxxp://clientlog.users.tbccint.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Line Deleted : user_pref("CT2481032..uninstallLogServiceUrl", "hxxp://uninstall.users.tbccint.com/Uninstall.asmx/RegisterToolbarUninstallation");
Line Deleted : user_pref("CT2481032.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Line Deleted : user_pref("CT2481032.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/default.aspx");
Line Deleted : user_pref("CT2481032.BrowserCompStateIsOpen_129469743936644511", true);
Line Deleted : user_pref("CT2481032.BrowserCompStateIsOpen_129681724834737563", true);
Line Deleted : user_pref("CT2481032.BrowserCompStateIsOpen_130104334689907164", true);
Line Deleted : user_pref("CT2481032.BrowserCompStateIsOpen_1396366933000", true);
Line Deleted : user_pref("CT2481032.CTID", "CT2481032");
Line Deleted : user_pref("CT2481032.CurrentServerDate", "24-7-2014");
Line Deleted : user_pref("CT2481032.DSInstall", true);
Line Deleted : user_pref("CT2481032.DialogsAlignMode", "LTR");
Line Deleted : user_pref("CT2481032.DialogsGetterLastCheckTime", "Fri Aug 01 2014 13:43:50 GMT+0200");
Line Deleted : user_pref("CT2481032.DownloadReferralCookieData", "");
Line Deleted : user_pref("CT2481032.FeedLastCount129137415284993440", 160);
Line Deleted : user_pref("CT2481032.FeedLastCount1470371090506316425", 1018);
Line Deleted : user_pref("CT2481032.FeedPollDate128975107603475850", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129104903994210185", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129125588542653211", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129137415288118473", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129137415288118474", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129137436798437243", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129137436798437244", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate129137436798437245", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757377779301063", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757377961554609", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757377979947076", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378132259586", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378265651739", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378449145277", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378705873295", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378902522699", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757378968484097", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379044202234", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379219112080", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379310186023", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379320546978", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379400531926", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379497083274", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379497148810", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379497279882", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379644150784", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379646262407", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379767858421", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379797989042", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757379883299006", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380108070872", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380344955611", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380390189978", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380412472059", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380467866928", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380521772385", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380616362201", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380727291645", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380767393172", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757380868375745", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381043554700", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381080219037", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381151343676", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381247526121", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381247591657", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381372042911", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381453742514", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381520490197", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381582880127", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381641974229", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381669771831", "Sun Feb 05 2012 23:28:24 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381670861676", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381749396397", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381869347434", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381908324302", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381919420428", "Sun Feb 05 2012 23:28:28 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381932420313", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381975368474", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381979169315", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedPollDate5609757381989950054", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.FeedTTL128975107603475850", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129104903994210185", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129125588542653211", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129137415288118473", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129137415288118474", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129137436798437243", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129137436798437244", 40);
Line Deleted : user_pref("CT2481032.FeedTTL129137436798437245", 40);
Line Deleted : user_pref("CT2481032.FeedTTL5609757377779301063", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757377979947076", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757378132259586", 10);
Line Deleted : user_pref("CT2481032.FeedTTL5609757378265651739", 30);
Line Deleted : user_pref("CT2481032.FeedTTL5609757378705873295", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757379310186023", 5);
Line Deleted : user_pref("CT2481032.FeedTTL5609757379320546978", 2);
Line Deleted : user_pref("CT2481032.FeedTTL5609757379400531926", 5);
Line Deleted : user_pref("CT2481032.FeedTTL5609757380108070872", 5);
Line Deleted : user_pref("CT2481032.FeedTTL5609757380412472059", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757380467866928", 2);
Line Deleted : user_pref("CT2481032.FeedTTL5609757380727291645", 5);
Line Deleted : user_pref("CT2481032.FeedTTL5609757380767393172", 1440);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381043554700", 2);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381247526121", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381372042911", 60);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381453742514", 15);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381908324302", 30);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381932420313", 10);
Line Deleted : user_pref("CT2481032.FeedTTL5609757381979169315", 15);
Line Deleted : user_pref("CT2481032.FirstServerDate", "6-2-2012");
Line Deleted : user_pref("CT2481032.FirstTime", true);
Line Deleted : user_pref("CT2481032.FirstTimeFF3", true);
Line Deleted : user_pref("CT2481032.FixPageNotFoundErrors", true);
Line Deleted : user_pref("CT2481032.GroupingServerCheckInterval", 1440);
Line Deleted : user_pref("CT2481032.GroupingServiceUrl", "hxxp://grouping.tbccint.com/");
Line Deleted : user_pref("CT2481032.HPInstall", true);
Line Deleted : user_pref("CT2481032.HasUserGlobalKeys", true);
Line Deleted : user_pref("CT2481032.HomePageProtectorEnabled", true);
Line Deleted : user_pref("CT2481032.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT2481032&SearchSource=13");
Line Deleted : user_pref("CT2481032.Initialize", true);
Line Deleted : user_pref("CT2481032.InitializeCommonPrefs", true);
Line Deleted : user_pref("CT2481032.InstallationAndCookieDataSentCount", 3);
Line Deleted : user_pref("CT2481032.InstallationId", "ConduitNSISIntegration");
Line Deleted : user_pref("CT2481032.InstallationType", "ConduitXPEIntegration");
Line Deleted : user_pref("CT2481032.InstalledDate", "Sun Feb 05 2012 23:28:23 GMT+0100");
Line Deleted : user_pref("CT2481032.InvalidateCache", false);
Line Deleted : user_pref("CT2481032.IsGrouping", false);
Line Deleted : user_pref("CT2481032.IsInitSetupIni", true);
Line Deleted : user_pref("CT2481032.IsMulticommunity", false);
Line Deleted : user_pref("CT2481032.IsOpenThankYouPage", false);
Line Deleted : user_pref("CT2481032.IsOpenUninstallPage", false);
Line Deleted : user_pref("CT2481032.IsProtectorsInit", true);
Line Deleted : user_pref("CT2481032.LanguagePackLastCheckTime", "Fri Aug 01 2014 13:43:50 GMT+0200");
Line Deleted : user_pref("CT2481032.LanguagePackReloadIntervalMM", 1440);
Line Deleted : user_pref("CT2481032.LanguagePackServiceUrl", "hxxp://translation.users.tbccint.com/Translation.ashx");
Line Deleted : user_pref("CT2481032.LastLogin_3.15.1.0", "Fri Aug 01 2014 13:43:49 GMT+0200");
Line Deleted : user_pref("CT2481032.LastLogin_3.9.0.3", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CT2481032.LatestVersion", "3.20.0.4");
Line Deleted : user_pref("CT2481032.Locale", "en");
Line Deleted : user_pref("CT2481032.MCDetectTooltipHeight", "83");
Line Deleted : user_pref("CT2481032.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Deleted : user_pref("CT2481032.MCDetectTooltipWidth", "295");
Line Deleted : user_pref("CT2481032.MyStuffEnabledAtInstallation", true);
Line Deleted : user_pref("CT2481032.OriginalFirstVersion", "3.9.0.3");
Line Deleted : user_pref("CT2481032.RadioIsPodcast", false);
Line Deleted : user_pref("CT2481032.RadioLastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CT2481032.RadioLastUpdateIPServer", "3");
Line Deleted : user_pref("CT2481032.RadioLastUpdateServer", "3");
Line Deleted : user_pref("CT2481032.RadioMediaID", "9962");
Line Deleted : user_pref("CT2481032.RadioMediaType", "Media Player");
Line Deleted : user_pref("CT2481032.RadioMenuSelectedID", "EBRadioMenu_CT24810329962");
Line Deleted : user_pref("CT2481032.RadioShrinkedFromSetup", false);
Line Deleted : user_pref("CT2481032.RadioStationName", "California%20Rock");
Line Deleted : user_pref("CT2481032.RadioStationURL", "hxxp://feedlive.net/california.asx");
Line Deleted : user_pref("CT2481032.SavedHomepage", "chrome://branding/locale/browserconfig.properties");
Line Deleted : user_pref("CT2481032.SearchCaption", "Ashampoo US Customized Web Search");
Line Deleted : user_pref("CT2481032.SearchEngineBeforeUnload", "Ashampoo US Customized Web Search");
Line Deleted : user_pref("CT2481032.SearchFromAddressBarIsInit", true);
Line Deleted : user_pref("CT2481032.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&q=");
Line Deleted : user_pref("CT2481032.SearchInNewTabEnabled", true);
Line Deleted : user_pref("CT2481032.SearchInNewTabIntervalMM", 1440);
Line Deleted : user_pref("CT2481032.SearchInNewTabLastCheckTime", "Fri Aug 01 2014 13:43:49 GMT+0200");
Line Deleted : user_pref("CT2481032.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");
Line Deleted : user_pref("CT2481032.SearchProtectorEnabled", false);
Line Deleted : user_pref("CT2481032.SearchProtectorToolbarDisabled", false);
Line Deleted : user_pref("CT2481032.SendProtectorDataViaLogin", true);
Line Deleted : user_pref("CT2481032.ServiceMapLastCheckTime", "Fri Aug 01 2014 13:43:49 GMT+0200");
Line Deleted : user_pref("CT2481032.SettingsLastCheckTime", "Fri Aug 01 2014 13:43:49 GMT+0200");
Line Deleted : user_pref("CT2481032.SettingsLastUpdate", "1405919504");
Line Deleted : user_pref("CT2481032.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2481032&SearchSource=13");
Line Deleted : user_pref("CT2481032.ThirdPartyComponentsInterval", 504);
Line Deleted : user_pref("CT2481032.ThirdPartyComponentsLastCheck", "Sun Feb 05 2012 23:28:23 GMT+0100");
Line Deleted : user_pref("CT2481032.ThirdPartyComponentsLastUpdate", "1312887586");
Line Deleted : user_pref("CT2481032.ToolbarShrinkedFromSetup", false);
Line Deleted : user_pref("CT2481032.TrusteLinkUrl", "hxxp://trust.cpccint.com");
Line Deleted : user_pref("CT2481032.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,tbclient.tbccint.com,codefuel.com,tbccint.com,trovi.com,seccint.com,cpccint.com,appstrm.com,OurToolbar.co[...]
Line Deleted : user_pref("CT2481032.UserID", "UN35637221548422915");
Line Deleted : user_pref("CT2481032.alertChannelId", "874438");
Line Deleted : user_pref("CT2481032.backendstorage.cbfirsttime", "53756E2046656220303520323031322032333A32383A333220474D542B30313030");
Line Deleted : user_pref("CT2481032.backendstorage.shoppingapp.gk.exipres", "4672692046656220313020323031322032333A32383A323920474D542B30313030");
Line Deleted : user_pref("CT2481032.backendstorage.shoppingapp.gk.geolocation", "637A6563682072657075626C6963");
Line Deleted : user_pref("CT2481032.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"hxxp://appdown[...]
Line Deleted : user_pref("CT2481032.globalFirstTimeInfoLastCheckTime", "Sun Feb 05 2012 23:28:25 GMT+0100");
Line Deleted : user_pref("CT2481032.homepageProtectorEnableByLogin", true);
Line Deleted : user_pref("CT2481032.initDone", true);
Line Deleted : user_pref("CT2481032.isAppTrackingManagerOn", true);
Line Deleted : user_pref("CT2481032.isFirstRadioInstallation", false);
Line Deleted : user_pref("CT2481032.myStuffEnabled", true);
Line Deleted : user_pref("CT2481032.myStuffPublihserMinWidth", 400);
Line Deleted : user_pref("CT2481032.myStuffSearchUrl", "hxxp://appstrm.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Line Deleted : user_pref("CT2481032.myStuffServiceIntervalMM", 1440);
Line Deleted : user_pref("CT2481032.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Line Deleted : user_pref("CT2481032.revertSettingsEnabled", true);
Line Deleted : user_pref("CT2481032.searchProtectorDialogDelayInSec", 10);
Line Deleted : user_pref("CT2481032.searchProtectorEnableByLogin", true);
Line Deleted : user_pref("CT2481032.testingCtid", "");
Line Deleted : user_pref("CT2481032.toolbarAppMetaDataLastCheckTime", "Fri Aug 01 2014 13:43:50 GMT+0200");
Line Deleted : user_pref("CT2481032.toolbarContextMenuLastCheckTime", "Sun Feb 05 2012 23:28:27 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2481032&SearchSource=13");
Line Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Ashampoo US Customized Web Search");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2481032/CT2481032", "\"cf576dc99694069838b97c0274e1241e3\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2481032", "\"1396366945\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE", "wVmmvqqOMqrv5xct1cJIHg==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE", "0uSPYx+Kl2jpu8sJZMeHjw==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE", "Dclc8oo4TTv7+mAkSlUSWg==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE", "K4Vqu91uAzWURlxJRdXJOg==");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15.1.0", "\"dfe74040abc2ce1:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.0.3", "\"6a637346d78ccc1:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2481032", "\"a238378f7d0708034a0defa297cb8b8b\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equalizer_dead.gif", "\"0678fe477ac91:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimize.gif", "\"046c7ab477ac91:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gif", "\"0484de117c4c91:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gif", "\"0e7a152347ac91:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif", "\"087c778347ac91:0\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"073e33a707e0305bf15c11c5bbb33921\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"71b38c0ea19de594d5b8442946da1691\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/1344951.xml", "\"16b723d9aadea0f0199781de59a56240\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/16887175.xml", "\"f27d0ea4309a419a24916282c1372cf1\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/17151925.xml", "\"a8a61a3b2ae386e98bc325fb5d5d4a98\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/20536157.xml", "\"0222825a35d27a249130718f7f6a6373\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/30261067.xml", "\"d1688ee044594502a9f40b89e0e0bc5c\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/34655603.xml", "\"32f0e7ecc6043f323ec1cf1ab63b7b86\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/428333.xml", "\"f72500a22dca8340385106d6f2f5b61c\"");
Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/816653.xml", "\"015991b61efdf48da7ed635560554b8d\"");
Line Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Miloa Zákravský\\Data aplikací\\Mozilla\\Firefox\\Profiles\\s9xtns0r.default\\conduitCommon\\modules\\3.9.0.3");
Line Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.9.0.3");
Line Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2481032");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2481032");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2481032");
Line Deleted : user_pref("CommunityToolbar.globalUserId", "515ec86a-a65d-4a71-b746-48a2c98d4805");
Line Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2481032");
Line Deleted : user_pref("CommunityToolbar.originalHomepage", "chrome://branding/locale/browserconfig.properties");
Line Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties");
Line Deleted : user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_34655603.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Sun Feb 05 2012 23:28:26 GMT+0100");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "Ashampoo US Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("browser.search.selectedEngine", "Ashampoo US Customized Web Search");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT2481032&SearchSource=13");
Line Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&q=");

-\\ Google Chrome v

[ File : C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : ggagiiobgjmfpdadhecbofeoelcpidec

*************************

AdwCleaner[R0].txt - [27626 octets] - [21/08/2014 22:05:52]
AdwCleaner[S0].txt - [28098 octets] - [21/08/2014 22:06:51]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [28159 octets] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119545
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o pomoc - DNS (?) Virus?

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Kachnacicek

Re: Prosím o pomoc - DNS (?) Virus?

#5 Příspěvek od Kachnacicek »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Miloš Zákravský at 2014-08-21 22:49:17
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 33 GB (46%) free of 70 GB
Total RAM: 2038 MB (76% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003Core.job - C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003UA.job - C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.145 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\WinLessPlugin]
"Description"=Camera Stream Controller
"Path"=C:\Program Files\Camera Stream Controller\npWinLessRtspCtrl.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\extensions\
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-11-10 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-02-26 155648]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-02-26 131072]
"LoadFUJ02E3"=C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [2009-06-16 36712]
"TRUUpdater"=C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [2009-06-26 558360]
"WatcherHelper"=C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe [2009-04-07 62744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-06-09 794713]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [2008-12-19 83336]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-07-02 16377344]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2011-07-02 69632]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-06-29 89541]
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-18 188416]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"Panda Security URL Filtering"=C:\Documents and Settings\All Users\Data aplikací\Panda Security URL Filtering\Panda_URL_Filtering.exe [2013-09-26 235072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-07-02 136176]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\Wcescomm.exe [2006-11-13 1289000]

C:\Documents and Settings\Miloš Zákravský\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-02-26 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"MaxGPOScriptWait"=600

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\TRUUpdater.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe:*:Enabled:TRUUpdater"
"C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe:*:Enabled:SwiApiMux"
"F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe"="F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe:*:Enabled:Warcraft III"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\VideoViewer\VideoViewer.exe"="C:\Program Files\VideoViewer\VideoViewer.exe:*:Enabled:VideoViewer"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe"="C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe"="C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe:*:Enabled:InstallationWizard"
"C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe"="C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe"="C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe:*:Enabled:Installation Wizard 2"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\NVR Utility\IP Utility.exe"="C:\Program Files\NVR Utility\IP Utility.exe:*:Enabled:IP Utility"
"C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe"="C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe:*:Enabled:Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\pandasecuritytb\dtUser.exe"="C:\Program Files\pandasecuritytb\dtUser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe:*:Enabled:TeamViewer 9"
"C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe"="C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe:*:Enabled:WinLoad"
"C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe"="C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe:*:Enabled:Network Enabler Administrator"
"E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe"="E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe:*:Enabled:winbox"
"E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE"="E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-08-21 22:05:08 ----D---- C:\AdwCleaner
2014-08-21 20:38:37 ----D---- C:\Program Files\trend micro
2014-08-21 20:38:36 ----D---- C:\rsit
2014-08-14 21:40:06 ----A---- C:\WINDOWS\system32\ptpusb.dll
2014-08-14 21:40:05 ----A---- C:\WINDOWS\system32\ptpusd.dll

======List of files/folders modified in the last 1 month======

2014-08-21 22:07:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-08-21 22:06:52 ----RD---- C:\Program Files
2014-08-21 19:44:30 ----D---- C:\WINDOWS\system32\CatRoot2
2014-08-14 21:40:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-08-14 21:40:08 ----D---- C:\WINDOWS\system32
2014-08-14 21:40:05 ----D---- C:\WINDOWS\system32\drivers
2014-07-29 11:51:46 ----D---- C:\WinloadPrivateDir
2014-07-27 13:46:34 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-10-03 36640]
R0 O2SDRDR;O2SDRDR; C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-05-11 35456]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 nedrv;nedrv; C:\WINDOWS\system32\drivers\nedrv.sys [2005-04-11 54664]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-06-29 1160320]
R3 FUJ02B1;Fujitsu FUJ02B1 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys [2001-08-01 5248]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 4864]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-02-26 5700096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-07-02 4432384]
R3 NETw4x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-02-25 2203520]
R3 O2SCBUS;O2Micro SmartCardBus Reader; C:\WINDOWS\system32\DRIVERS\ozscr.sys [2009-10-16 101848]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-10-24 35913]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-06-09 193120]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-11-02 250496]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2011-03-18 61704]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2011-03-18 73096]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-10-24 17664]
S3 silabenm;JABLOTRON serial interface Serial Port Enumerator Driver; C:\WINDOWS\system32\DRIVERS\silabenm.sys [2012-08-13 47176]
S3 silabser;JABLOTRON serial interface Driver; C:\WINDOWS\system32\DRIVERS\silabser.sys [2012-08-13 61312]
S3 SWNC8U32;Sierra Wireless MUX NDIS Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swnc8u32.sys [2009-07-22 197504]
S3 SWUMX20;Sierra Wireless USB MUX Driver (UMTS20); C:\WINDOWS\system32\DRIVERS\swumx20.sys []
S3 SWUMX32;Sierra Wireless USB MUX Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swumx32.sys [2009-07-22 148992]
S3 Tosrfcom;Tosrfcom; C:\WINDOWS\system32\drivers\Tosrfcom.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2013-02-12 12928]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-11-10 153376]
R2 MCPH;DSC MCPH Service; C:\Program Files\DSC\DLS IV\MCPH\MCPH.exe [2012-12-17 209920]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R2 O2Flash;O2Flash Memory Service; C:\WINDOWS\system32\o2flash.exe [2005-09-13 57344]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2008-10-10 132456]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-27 262320]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]

-----------------EOF-----------------
Nahoru
Kachnacicek

Re: Prosím o pomoc - DNS (?) Virus?

#6 Příspěvek od Kachnacicek »

Opravdu vás nenapadá co s tím? :(
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119545
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o pomoc - DNS (?) Virus?

#7 Příspěvek od Rudy »

Nebyl jsem to od čtvrtka, byl jsem na srazu fóra. Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1292428093-839522115-1003UA.job

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"KernelFaultCheck"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Kachnacicek

Re: Prosím o pomoc - DNS (?) Virus?

#8 Příspěvek od Kachnacicek »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Miloš Zákravský at 2014-08-25 11:38:20
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 34 GB (48%) free of 70 GB
Total RAM: 2038 MB (77% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.145 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\WinLessPlugin]
"Description"=Camera Stream Controller
"Path"=C:\Program Files\Camera Stream Controller\npWinLessRtspCtrl.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml

C:\Documents and Settings\Miloš Zákravský\Data aplikací\Mozilla\Firefox\Profiles\s9xtns0r.default\extensions\
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-11-10 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - Panda Security Toolbar - C:\Program Files\pandasecuritytb\pandasecurityDx.dll [2013-10-01 91712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-02-26 155648]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-02-26 131072]
"LoadFUJ02E3"=C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [2009-06-16 36712]
"TRUUpdater"=C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [2009-06-26 558360]
"WatcherHelper"=C:\Program Files\Sierra Wireless Inc\3G Watcher\WaHelper.exe [2009-04-07 62744]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-06-09 794713]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [2008-12-19 83336]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2011-07-02 16377344]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2011-07-02 69632]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-06-29 89541]
"LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-18 188416]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"Panda Security URL Filtering"=C:\Documents and Settings\All Users\Data aplikací\Panda Security URL Filtering\Panda_URL_Filtering.exe [2013-09-26 235072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-07-02 136176]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\Wcescomm.exe [2006-11-13 1289000]

C:\Documents and Settings\Miloš Zákravský\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-02-26 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"MaxGPOScriptWait"=600

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\3G Watcher\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\Program Files\Sierra Wireless Inc\3G Watcher\TRUUpdater.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe:*:Enabled:TRUUpdater"
"C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe"="C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe:*:Enabled:SwiApiMux"
"F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe"="F:\Adam\Install\Warcraft 3 + Frozen Throne\Warcraft III.exe:*:Enabled:Warcraft III"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\VideoViewer\VideoViewer.exe"="C:\Program Files\VideoViewer\VideoViewer.exe:*:Enabled:VideoViewer"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe"="C:\DOCUME~1\MILOZK~1\LOCALS~1\Temp\RarSFX0\SwiApiMux.exe:*:Enabled:SwiApiMux"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe"="C:\Program Files\NUUO\NVRmini2\InstallWizard\InstallationWizard.exe:*:Enabled:InstallationWizard"
"C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe"="C:\Program Files\Panda Security\Panda Security Toolbar\dtuser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe"="C:\Program Files\VIVOTEK Inc\Installation Wizard 2\IW2.exe:*:Enabled:Installation Wizard 2"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\NVR Utility\IP Utility.exe"="C:\Program Files\NVR Utility\IP Utility.exe:*:Enabled:IP Utility"
"C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe"="C:\Program Files\DSC\DLS IV\Client\DLSMDIHost.exe:*:Enabled:Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\pandasecuritytb\dtUser.exe"="C:\Program Files\pandasecuritytb\dtUser.exe:*:Enabled:Panda Security Toolbar DTX Broker"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Temp\TeamViewer\Version9\TeamViewer.exe:*:Enabled:TeamViewer 9"
"C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe"="C:\Program Files\Paradox Security Systems\WinLoad\WinLoad.exe:*:Enabled:WinLoad"
"C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe"="C:\Program Files\Network Enabler Administrator 2.7\NEADMIN.exe:*:Enabled:Network Enabler Administrator"
"E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe"="E:\AVTech - IP kamery\Software\AVTECH_IP_scan\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\IPScan_i.exe:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe"="C:\Documents and Settings\Miloš Zákravský\Plocha\winbox.exe:*:Enabled:winbox"
"E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE"="E:\AVTECH - IP KAMERY\SOFTWARE PRO WINDOWS\AVTECH_IP_SCAN\IPSCAN_I.EXE:*:Enabled:IP Scan Application"
"C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Miloš Zákravský\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-08-25 11:30:35 ----D---- C:\_OTM
2014-08-25 11:29:36 ----D---- C:\adc8f758ca5f94d485fcaf339143
2014-08-21 22:05:08 ----D---- C:\AdwCleaner
2014-08-21 20:38:37 ----D---- C:\Program Files\trend micro
2014-08-21 20:38:36 ----D---- C:\rsit
2014-08-14 21:40:06 ----A---- C:\WINDOWS\system32\ptpusb.dll
2014-08-14 21:40:05 ----A---- C:\WINDOWS\system32\ptpusd.dll

======List of files/folders modified in the last 1 month======

2014-08-25 11:35:24 ----D---- C:\WINDOWS\Temp
2014-08-25 11:34:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-08-25 11:33:48 ----D---- C:\WINDOWS\system32
2014-08-25 11:33:48 ----D---- C:\WINDOWS
2014-08-25 11:30:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-25 11:30:36 ----SD---- C:\WINDOWS\Tasks
2014-08-25 11:29:44 ----A---- C:\WINDOWS\system32\MRT.exe
2014-08-21 22:06:52 ----RD---- C:\Program Files
2014-08-21 19:44:30 ----D---- C:\WINDOWS\system32\CatRoot2
2014-08-14 21:40:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-08-14 21:40:05 ----D---- C:\WINDOWS\system32\drivers
2014-07-29 11:51:46 ----D---- C:\WinloadPrivateDir
2014-07-27 13:46:34 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-10-03 36640]
R0 O2SDRDR;O2SDRDR; C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-05-11 35456]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 nedrv;nedrv; C:\WINDOWS\system32\drivers\nedrv.sys [2005-04-11 54664]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-06-29 1160320]
R3 FUJ02B1;Fujitsu FUJ02B1 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02B1.sys [2001-08-01 5248]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver; C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-17 4864]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-02-26 5700096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2011-07-02 4432384]
R3 NETw4x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-02-25 2203520]
R3 O2SCBUS;O2Micro SmartCardBus Reader; C:\WINDOWS\system32\DRIVERS\ozscr.sys [2009-10-16 101848]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-10-24 35913]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-06-09 193120]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-11-02 250496]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-10-24 23808]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2011-03-18 61704]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2011-03-18 73096]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-10-24 17664]
S3 silabenm;JABLOTRON serial interface Serial Port Enumerator Driver; C:\WINDOWS\system32\DRIVERS\silabenm.sys [2012-08-13 47176]
S3 silabser;JABLOTRON serial interface Driver; C:\WINDOWS\system32\DRIVERS\silabser.sys [2012-08-13 61312]
S3 SWNC8U32;Sierra Wireless MUX NDIS Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swnc8u32.sys [2009-07-22 197504]
S3 SWUMX20;Sierra Wireless USB MUX Driver (UMTS20); C:\WINDOWS\system32\DRIVERS\swumx20.sys []
S3 SWUMX32;Sierra Wireless USB MUX Driver (UMTS32); C:\WINDOWS\system32\DRIVERS\swumx32.sys [2009-07-22 148992]
S3 Tosrfcom;Tosrfcom; C:\WINDOWS\system32\drivers\Tosrfcom.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2013-02-12 12928]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-11-10 153376]
R2 MCPH;DSC MCPH Service; C:\Program Files\DSC\DLS IV\MCPH\MCPH.exe [2012-12-17 209920]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
R2 O2Flash;O2Flash Memory Service; C:\WINDOWS\system32\o2flash.exe [2005-09-13 57344]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2008-10-10 132456]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-27 262320]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]

-----------------EOF-----------------


Díky moc za pomoc!
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119545
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o pomoc - DNS (?) Virus?

#9 Příspěvek od Rudy »

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Kachnacicek

Re: Prosím o pomoc - DNS (?) Virus?

#10 Příspěvek od Kachnacicek »

Ano, zdá se to být zase OK.

Díííky moc.
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119545
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o pomoc - DNS (?) Virus?

#11 Příspěvek od Rudy »

Rádo se stalo! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“