keylogger

[backpase]

Dobrý deň
Do pc sa mi pravdepodobne dostal keylogger, pokúšal som sa ho nejak odstrániť, neviem, či je to už v poriadku a tak vás prosím či by ste mi nemohli poradiť ohľadom tohto problému, ďakujem.

[Rudy]

Zdrvím!
Dejte log RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=130786 .

[backpase]

Logfile of random's system information tool 1.10 (written by random/random)
Run by Admistrimator at 2014-08-25 22:08:46
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 13 GB (34%) free of 38 GB
Total RAM: 254 MB (6% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:10:23, on 25. 8. 2014
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
c:\Program Files\AVG\AVG2014\AVGRSX.EXE
C:\Program Files\AVG\AVG2014\avgcsrvx.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\AVG\AVG2014\avgidsagent.exe
C:\Program Files\AVG\AVG2014\avgwdsvc.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\AVG\AVG2014\avgui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\WINDOWS.0\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe
C:\Program Files\AVG\AVG2014\avgnsx.exe
C:\Program Files\AVG\AVG2014\avgemcx.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Admistrimator\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Admistrimator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.0\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.0\system32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: Kalendár.lnk = C:\WINDOWS.0\MENINY.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: eOne Client.lnk = C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~1\browse~1\sprote~1.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.0\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.0\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS.0\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6739 bytes

======Scheduled tasks folder======

C:\WINDOWS.0\tasks\Adobe Flash Player Updater.job - C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS.0\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1326574676-1801674531-1004Core1cf8f92b1e17a18.job - C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Admistrimator\Application Data\Mozilla\Firefox\Profiles\mnkpzjor.default-1395437861890

"{3f963a5b-e555-4543-90e2-c3908898db71}"=C:\Program Files\AVG\AVG8\Firefox
"{1d5287d1-8a92-0001-1f31-1cec198018d8}"=C:\Program Files\AVG\AVG8\ToolbarFF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.152 Plugin
"Path"=C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS.0\system32\Adobe\Director\np32dsw_1204144.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\WINDOWS.0\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.0]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
QuickTimePlugin.class
NPOFFICE.DLL
nsIQTScriptablePlugin.xpt
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
Search_Results.xml
avg-secure-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2013-01-07 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-08-13 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2013-01-07 2055960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-08-13 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2013-01-07 2055960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS.0\system32\igfxtray.exe [2004-02-10 155648]
"HotKeysCmds"=C:\WINDOWS.0\system32\hkcmd.exe [2004-02-10 118784]
"NvCplDaemon"=C:\WINDOWS.0\system32\NvCpl.dll [2005-10-10 7286784]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS.0\system32\NvMcTray.dll [2005-10-10 86016]
"UserFaultCheck"=C:\WINDOWS.0\system32\dumprep 0 -u []
"AVG_UI"=C:\Program Files\AVG\AVG2014\avgui.exe [2014-08-11 5187088]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS.0\system32\ctfmon.exe [2006-01-13 15360]
"Google Update"=C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-07-14 116648]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
eOne Client.lnk - C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe

C:\Documents and Settings\Admistrimator\Start Menu\Programs\Startup
Kalendár.lnk - C:\WINDOWS.0\MENINY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" c:\progra~1\browse~1\sprote~1.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS.0\system32\avgrsstx.dll [2013-01-07 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS.0\system32\igfxsrvc.dll [2004-02-10 339968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS.0\system32\upnpui.dll [2006-01-13 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\08465862.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\25049659.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\08465862.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\25049659.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\stary disk\HRY\StarCraft\StarCraft.exe"="C:\stary disk\HRY\StarCraft\StarCraft.exe:*:Enabled:Starcraft"
"C:\WINDOWS.0\System32\dplaysvr.exe"="C:\WINDOWS.0\System32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\WINDOWS.0\System32\PnkBstrA.exe"="C:\WINDOWS.0\System32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS.0\System32\PnkBstrB.exe"="C:\WINDOWS.0\System32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"F:\FlatOut2\FlatOut2.exe"="F:\FlatOut2\FlatOut2.exe:*:Enabled:FlatOut2"
"F:\Counter-Strike 1.6\csko.exe"="F:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\GOGcom\Dungeon Keeper 2\DKII.EXE"="C:\Program Files\GOGcom\Dungeon Keeper 2\DKII.EXE:*:Enabled:DKII"
"C:\Counter-Strike 1.6\csko.exe"="C:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Counter-Strike 1.6\hl.exe"="C:\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"F:\HRY\FLATOUT\flatout.exe"="F:\HRY\FLATOUT\flatout.exe:*:Enabled:flatout"
"C:\Counter-Strike 1.6\hltv.exe"="C:\Counter-Strike 1.6\hltv.exe:*:Enabled:HLTV Launcher"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Battle.net\Battle.net.exe"="C:\Program Files\Battle.net\Battle.net.exe:*:Enabled:Battle.net"
"C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\AVG\AVG2014\avgmfapx.exe"="C:\Program Files\AVG\AVG2014\avgmfapx.exe:*:Enabled:AVG Installer"
"C:\Program Files\AVG\AVG2014\avgnsx.exe"="C:\Program Files\AVG\AVG2014\avgnsx.exe:*:Enabled:Online Shield"
"C:\Program Files\AVG\AVG2014\avgdiagex.exe"="C:\Program Files\AVG\AVG2014\avgdiagex.exe:*:Enabled:AVG Diagnostics 2014"
"C:\Program Files\AVG\AVG2014\avgemcx.exe"="C:\Program Files\AVG\AVG2014\avgemcx.exe:*:Enabled:Personal Email Scanner"
"C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.3109\Agent.exe"="C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.3109\Agent.exe:*:Enabled:Battle.net Update Agent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i263_32.drv
"vidc.iv31"=Ir32_32.dll
"vidc.iv32"=Ir32_32.dll
"vidc.iv41"=Ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS.0\system32\l3codeca.acm
"vidc.XVID"=xvidvfw.dll
"VIDC.wmv3"=wmv9vcm.dll
"msacm.imc"=imc32.acm
"msacm.l3codecp"=l3codecp.acm
"VIDC.i263"=i263_32.drv
"VIDC.IV40"=Ir41_32.ax
"VIDC.VP60"=vp6vfw.dll
"VIDC.VP61"=vp6vfw.dll
"vidc.ffds"=ffdshow.ax
"msacm.ac3filter"=ac3filter.acm
"MIDI1"=SYNCOR11.DLL
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.divxa32"=msaud32_divx.acm

======List of files/folders created in the last 1 month======

2014-08-25 22:08:56 ----D---- C:\Program Files\trend micro
2014-08-25 22:08:46 ----D---- C:\rsit
2014-08-25 02:35:29 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.35.29_log.txt
2014-08-25 02:21:17 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.21.17_log.txt
2014-08-25 02:18:20 ----D---- C:\TDSSKiller_Quarantine
2014-08-25 02:12:59 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.12.58_log.txt
2014-08-24 02:11:38 ----D---- C:\Program Files\Common Files\Skype
2014-08-24 02:11:35 ----RD---- C:\Program Files\Skype
2014-08-24 02:01:10 ----D---- C:\Documents and Settings\Admistrimator\Application Data\Skype
2014-08-23 20:16:02 ----SHD---- C:\FOUND.046
2014-08-19 16:13:30 ----SHD---- C:\FOUND.045

======List of files/folders modified in the last 1 month======

2014-08-25 21:17:22 ----A---- C:\WINDOWS.0\win.ini
2014-08-25 15:23:20 ----A---- C:\WINDOWS.0\SchedLgU.Txt
2014-08-24 20:06:40 ----A---- C:\WINDOWS.0\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHX;AVGIDSHX; C:\WINDOWS.0\system32\DRIVERS\avgidshx.sys [2014-05-13 149784]
R0 Avglogx;AVG Logging Driver; C:\WINDOWS.0\system32\DRIVERS\avglogx.sys [2014-06-17 241944]
R0 AvgMfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS.0\system32\DRIVERS\avgmfx86.sys [2014-05-13 107288]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS.0\System32\drivers\sfdrv01.sys [2005-03-03 48640]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS.0\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfvfs02.sys [2007-01-12 82296]
R1 Avgdiskx;AVG Disk Driver; C:\WINDOWS.0\system32\DRIVERS\avgdiskx.sys [2014-06-30 121624]
R1 AVGIDSDriverl;AVGIDSDriverl; C:\WINDOWS.0\system32\DRIVERS\avgidsdriverlx.sys [2014-06-17 190232]
R1 AVGIDSShim;AVGIDSShim; C:\WINDOWS.0\system32\DRIVERS\avgidsshimx.sys [2014-05-13 21272]
R1 AvgLdx86;AVG AVI Loader Driver; C:\WINDOWS.0\system32\DRIVERS\avgldx86.sys [2014-06-17 188696]
R1 AvgTdiX;AVG TDI Driver; C:\WINDOWS.0\system32\DRIVERS\avgtdix.sys [2014-05-13 210200]
R1 intelppm;Intel Processor Driver; C:\WINDOWS.0\system32\DRIVERS\intelppm.sys [2006-01-13 36096]
R3 aeaudio;aeaudio; C:\WINDOWS.0\system32\drivers\aeaudio.sys [2002-08-22 98752]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS.0\system32\DRIVERS\e100b325.sys [2002-09-25 140800]
R3 ialm;ialm; C:\WINDOWS.0\system32\DRIVERS\ialmnt5.sys [2004-02-10 681469]
R3 nv;nv; C:\WINDOWS.0\system32\DRIVERS\nv4_mini.sys [2005-10-10 3530432]
R3 smwdm;smwdm; C:\WINDOWS.0\system32\drivers\smwdm.sys [2002-08-23 549672]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbuhci.sys [2006-01-13 20480]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\WINDOWS.0\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\WINDOWS.0\system32\DRIVERS\ew_usbenumfilter.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS.0\system32\DRIVERS\hidusb.sys [2006-01-13 9600]
S3 huawei_cdcacm;huawei_cdcacm; C:\WINDOWS.0\system32\DRIVERS\ew_jucdcacm.sys []
S3 huawei_cdcecm;huawei_cdcecm; C:\WINDOWS.0\system32\DRIVERS\ew_jucdcecm.sys []
S3 huawei_enumerator;huawei_enumerator; C:\WINDOWS.0\system32\DRIVERS\ew_jubusenum.sys []
S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\WINDOWS.0\system32\DRIVERS\ew_juextctrl.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS.0\system32\DRIVERS\mouhid.sys [2006-01-13 12160]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS.0\system32\DRIVERS\usbccgp.sys [2006-01-06 31744]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS.0\system32\DRIVERS\USBSTOR.SYS [2006-01-06 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS.0\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 WS2IFSL;Prostredie podpory poskytovateľa služby Windows Socket 2.0 Non-IFS Service; C:\WINDOWS.0\System32\drivers\ws2ifsl.sys [2006-01-13 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [2014-08-11 3244048]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [2014-08-11 289328]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-08-13 182184]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS.0\system32\nvsvc32.exe [2005-10-10 131139]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS.0\system32\PnkBstrA.exe [2012-06-29 66872]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-07-15 45056]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10 262320]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-31 119408]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS.0\system32\wdfmgr.exe [2006-01-13 38912]

-----------------EOF-----------------

[Rudy]

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\WINDOWS.0\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1326574676-1801674531-1004Core1cf8f92b1e17a18.job

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"=-
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.

[backpase]

Logfile of random's system information tool 1.10 (written by random/random)
Run by Admistrimator at 2014-08-25 23:00:34
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 15 GB (38%) free of 38 GB
Total RAM: 254 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:01:40, on 25. 8. 2014
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
c:\Program Files\AVG\AVG2014\AVGRSX.EXE
C:\Program Files\AVG\AVG2014\avgcsrvx.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\AVG\AVG2014\avgidsagent.exe
C:\Program Files\AVG\AVG2014\avgwdsvc.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\WINDOWS.0\system32\PnkBstrA.exe
C:\Program Files\AVG\AVG2014\avgui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe
C:\Program Files\AVG\AVG2014\avgnsx.exe
C:\Program Files\AVG\AVG2014\avgemcx.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Admistrimator\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Admistrimator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.0\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.0\system32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: Kalendár.lnk = C:\WINDOWS.0\MENINY.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: eOne Client.lnk = C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~1\browse~1\sprote~1.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.0\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.0\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS.0\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6472 bytes

======Scheduled tasks folder======

C:\WINDOWS.0\tasks\Adobe Flash Player Updater.job - C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Admistrimator\Application Data\Mozilla\Firefox\Profiles\mnkpzjor.default-1395437861890

"{3f963a5b-e555-4543-90e2-c3908898db71}"=C:\Program Files\AVG\AVG8\Firefox
"{1d5287d1-8a92-0001-1f31-1cec198018d8}"=C:\Program Files\AVG\AVG8\ToolbarFF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.9.900.152 Plugin
"Path"=C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS.0\system32\Adobe\Director\np32dsw_1204144.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\WINDOWS.0\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.0]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
QuickTimePlugin.class
NPOFFICE.DLL
nsIQTScriptablePlugin.xpt
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
babylon.xml
Search_Results.xml
avg-secure-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2013-01-07 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-08-13 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2013-01-07 2055960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-08-13 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2013-01-07 2055960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS.0\system32\igfxtray.exe [2004-02-10 155648]
"HotKeysCmds"=C:\WINDOWS.0\system32\hkcmd.exe [2004-02-10 118784]
"NvCplDaemon"=C:\WINDOWS.0\system32\NvCpl.dll [2005-10-10 7286784]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS.0\system32\NvMcTray.dll [2005-10-10 86016]
"AVG_UI"=C:\Program Files\AVG\AVG2014\avgui.exe [2014-08-11 5187088]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS.0\system32\ctfmon.exe [2006-01-13 15360]
"Google Update"=C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-07-14 116648]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
eOne Client.lnk - C:\Program Files\SecureMedia\Encryptonite ONE System\Client\smdaemon.exe

C:\Documents and Settings\Admistrimator\Start Menu\Programs\Startup
Kalendár.lnk - C:\WINDOWS.0\MENINY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" c:\progra~1\browse~1\sprote~1.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS.0\system32\avgrsstx.dll [2013-01-07 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS.0\system32\igfxsrvc.dll [2004-02-10 339968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS.0\system32\upnpui.dll [2006-01-13 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\08465862.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\25049659.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\08465862.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\25049659.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\stary disk\HRY\StarCraft\StarCraft.exe"="C:\stary disk\HRY\StarCraft\StarCraft.exe:*:Enabled:Starcraft"
"C:\WINDOWS.0\System32\dplaysvr.exe"="C:\WINDOWS.0\System32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\WINDOWS.0\System32\PnkBstrA.exe"="C:\WINDOWS.0\System32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS.0\System32\PnkBstrB.exe"="C:\WINDOWS.0\System32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"F:\FlatOut2\FlatOut2.exe"="F:\FlatOut2\FlatOut2.exe:*:Enabled:FlatOut2"
"F:\Counter-Strike 1.6\csko.exe"="F:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\GOGcom\Dungeon Keeper 2\DKII.EXE"="C:\Program Files\GOGcom\Dungeon Keeper 2\DKII.EXE:*:Enabled:DKII"
"C:\Counter-Strike 1.6\csko.exe"="C:\Counter-Strike 1.6\csko.exe:*:Enabled:Half-Life Launcher"
"C:\Counter-Strike 1.6\hl.exe"="C:\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"F:\HRY\FLATOUT\flatout.exe"="F:\HRY\FLATOUT\flatout.exe:*:Enabled:flatout"
"C:\Counter-Strike 1.6\hltv.exe"="C:\Counter-Strike 1.6\hltv.exe:*:Enabled:HLTV Launcher"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Battle.net\Battle.net.exe"="C:\Program Files\Battle.net\Battle.net.exe:*:Enabled:Battle.net"
"C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\AVG\AVG2014\avgmfapx.exe"="C:\Program Files\AVG\AVG2014\avgmfapx.exe:*:Enabled:AVG Installer"
"C:\Program Files\AVG\AVG2014\avgnsx.exe"="C:\Program Files\AVG\AVG2014\avgnsx.exe:*:Enabled:Online Shield"
"C:\Program Files\AVG\AVG2014\avgdiagex.exe"="C:\Program Files\AVG\AVG2014\avgdiagex.exe:*:Enabled:AVG Diagnostics 2014"
"C:\Program Files\AVG\AVG2014\avgemcx.exe"="C:\Program Files\AVG\AVG2014\avgemcx.exe:*:Enabled:Personal Email Scanner"
"C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.3109\Agent.exe"="C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.3109\Agent.exe:*:Enabled:Battle.net Update Agent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i263_32.drv
"vidc.iv31"=Ir32_32.dll
"vidc.iv32"=Ir32_32.dll
"vidc.iv41"=Ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS.0\system32\l3codeca.acm
"vidc.XVID"=xvidvfw.dll
"VIDC.wmv3"=wmv9vcm.dll
"msacm.imc"=imc32.acm
"msacm.l3codecp"=l3codecp.acm
"VIDC.i263"=i263_32.drv
"VIDC.IV40"=Ir41_32.ax
"VIDC.VP60"=vp6vfw.dll
"VIDC.VP61"=vp6vfw.dll
"vidc.ffds"=ffdshow.ax
"msacm.ac3filter"=ac3filter.acm
"MIDI1"=SYNCOR11.DLL
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.divxa32"=msaud32_divx.acm

======List of files/folders created in the last 1 month======

2014-08-25 22:36:48 ----D---- C:\_OTM
2014-08-25 22:08:56 ----D---- C:\Program Files\trend micro
2014-08-25 22:08:46 ----D---- C:\rsit
2014-08-25 02:35:29 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.35.29_log.txt
2014-08-25 02:21:17 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.21.17_log.txt
2014-08-25 02:18:20 ----D---- C:\TDSSKiller_Quarantine
2014-08-25 02:12:59 ----A---- C:\TDSSKiller.3.0.0.40_25.08.2014_02.12.58_log.txt
2014-08-24 02:11:38 ----D---- C:\Program Files\Common Files\Skype
2014-08-24 02:11:35 ----RD---- C:\Program Files\Skype
2014-08-24 02:01:10 ----D---- C:\Documents and Settings\Admistrimator\Application Data\Skype
2014-08-23 20:16:02 ----SHD---- C:\FOUND.046
2014-08-19 16:13:30 ----SHD---- C:\FOUND.045

======List of files/folders modified in the last 1 month======

2014-08-25 22:52:12 ----A---- C:\WINDOWS.0\win.ini
2014-08-25 22:47:50 ----A---- C:\WINDOWS.0\SchedLgU.Txt
2014-08-24 20:06:40 ----A---- C:\WINDOWS.0\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHX;AVGIDSHX; C:\WINDOWS.0\system32\DRIVERS\avgidshx.sys [2014-05-13 149784]
R0 Avglogx;AVG Logging Driver; C:\WINDOWS.0\system32\DRIVERS\avglogx.sys [2014-06-17 241944]
R0 AvgMfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS.0\system32\DRIVERS\avgmfx86.sys [2014-05-13 107288]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS.0\System32\drivers\sfdrv01.sys [2005-03-03 48640]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS.0\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS.0\System32\drivers\sfvfs02.sys [2007-01-12 82296]
R1 Avgdiskx;AVG Disk Driver; C:\WINDOWS.0\system32\DRIVERS\avgdiskx.sys [2014-06-30 121624]
R1 AVGIDSDriverl;AVGIDSDriverl; C:\WINDOWS.0\system32\DRIVERS\avgidsdriverlx.sys [2014-06-17 190232]
R1 AVGIDSShim;AVGIDSShim; C:\WINDOWS.0\system32\DRIVERS\avgidsshimx.sys [2014-05-13 21272]
R1 AvgLdx86;AVG AVI Loader Driver; C:\WINDOWS.0\system32\DRIVERS\avgldx86.sys [2014-06-17 188696]
R1 AvgTdiX;AVG TDI Driver; C:\WINDOWS.0\system32\DRIVERS\avgtdix.sys [2014-05-13 210200]
R1 intelppm;Intel Processor Driver; C:\WINDOWS.0\system32\DRIVERS\intelppm.sys [2006-01-13 36096]
R3 aeaudio;aeaudio; C:\WINDOWS.0\system32\drivers\aeaudio.sys [2002-08-22 98752]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS.0\system32\DRIVERS\e100b325.sys [2002-09-25 140800]
R3 ialm;ialm; C:\WINDOWS.0\system32\DRIVERS\ialmnt5.sys [2004-02-10 681469]
R3 nv;nv; C:\WINDOWS.0\system32\DRIVERS\nv4_mini.sys [2005-10-10 3530432]
R3 smwdm;smwdm; C:\WINDOWS.0\system32\drivers\smwdm.sys [2002-08-23 549672]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbuhci.sys [2006-01-13 20480]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\WINDOWS.0\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\WINDOWS.0\system32\DRIVERS\ew_usbenumfilter.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS.0\system32\DRIVERS\hidusb.sys [2006-01-13 9600]
S3 huawei_cdcacm;huawei_cdcacm; C:\WINDOWS.0\system32\DRIVERS\ew_jucdcacm.sys []
S3 huawei_cdcecm;huawei_cdcecm; C:\WINDOWS.0\system32\DRIVERS\ew_jucdcecm.sys []
S3 huawei_enumerator;huawei_enumerator; C:\WINDOWS.0\system32\DRIVERS\ew_jubusenum.sys []
S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\WINDOWS.0\system32\DRIVERS\ew_juextctrl.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS.0\system32\DRIVERS\mouhid.sys [2006-01-13 12160]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS.0\system32\DRIVERS\usbccgp.sys [2006-01-06 31744]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS.0\system32\DRIVERS\USBSTOR.SYS [2006-01-06 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS.0\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 WS2IFSL;Prostredie podpory poskytovateľa služby Windows Socket 2.0 Non-IFS Service; C:\WINDOWS.0\System32\drivers\ws2ifsl.sys [2006-01-13 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [2014-08-11 3244048]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [2014-08-11 289328]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-08-13 182184]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS.0\system32\nvsvc32.exe [2005-10-10 131139]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS.0\system32\PnkBstrA.exe [2012-06-29 66872]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-07-15 45056]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10 262320]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-31 119408]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS.0\system32\wdfmgr.exe [2006-01-13 38912]

-----------------EOF-----------------

[Rudy]

Dvouklikem na soubor C:\Program Files\trend micro\Admistrimator.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.

[backpase]

Hotovo. Už je to celkom hotovo alebo nie? Mám vám sem hodiť nový log z RSIT?

[Rudy]

Nemusíte. Spusťte ale ještě kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[backpase]

Pri otvorení toho odkazu mi napíše "504 - Gateway Timeout". Čo mám spraviť?

[Rudy]

Zkuste stahnout odtud: http://www.stahuj.centrum.cz/utility_a_ ... i-malware/ .

[backpase]

Takže tu máte ten log.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 28. 8. 2014
Scan Time: 22:59:49
Logfile: MBAM.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.28.06
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 2
CPU: x86
File System: FAT32
User: Admistrimator

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 311566
Time Elapsed: 1 hr, 4 min, 32 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 13
PUP.Optional.Datamngr.A, HKLM\SOFTWARE\CLASSES\CLSID\{f34c9277-6577-4dff-b2d7-7d58092f272f}, , [8c6a5873e497d462a541d4ad2ad8ce32],
PUP.Optional.Datamngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F34C9277-6577-4DFF-B2D7-7D58092F272F}, , [8c6a5873e497d462a541d4ad2ad8ce32],
PUP.Optional.Datamngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F34C9277-6577-4DFF-B2D7-7D58092F272F}, , [8c6a5873e497d462a541d4ad2ad8ce32],
PUP.Optional.Datamngr.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{F34C9277-6577-4DFF-B2D7-7D58092F272F}, , [8c6a5873e497d462a541d4ad2ad8ce32],
PUP.Optional.SweetPacks.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}, , [0aec4883374441f5b38bf7bb9c6619e7],
PUP.Optional.SweetPacks.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}, , [0aec4883374441f5b38bf7bb9c6619e7],
PUP.Optional.Datamngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014}, , [4ea88348c6b59c9a9a4b0879e0228f71],
PUP.Optional.Datamngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014}, , [4ea88348c6b59c9a9a4b0879e0228f71],
PUP.Optional.BundleInstaller.A, HKLM\SOFTWARE\VITTALIA\AxtanInstaller, , [f7ff05c6403be056277efb1d59aa0df3],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Datamngr, , [a74f9c2fa5d6122453f7af824bb98080],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, , [bc3a319ac7b4f1450445042df80cc43c],
PUP.Optional.SProtector.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SProtector, , [9a5cc10a2e4dd95d8468a78c1de7cc34],
PUP.Optional.Softonic.A, HKU\S-1-5-21-1454471165-1326574676-1801674531-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [7f774982e398fe3892a732d8e81b35cb],

Registry Values: 0
(No malicious items detected)

Registry Data: 2
PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|AntiVirusDisableNotify, 1, Good: (0), Bad: (1),,[52a4c5061b6039fd0a770dd1c44057a9]
PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Good: (0), Bad: (1),,[27cf21aa3f3cfa3c5132d30bdb2938c8]

Folders: 5
PUP.Optional.BrowseToSave.A, C:\Documents and Settings\All Users\Application Data\Browse2saVe, , [8373bf0cd6a5d95d07040fb34ab8bb45],
PUP.Optional.OpenCandy, C:\Documents and Settings\Admistrimator\Application Data\OpenCandy, , [fdf907c4027940f6d748358d5ca629d7],
PUP.Optional.OpenCandy, C:\Documents and Settings\Admistrimator\Application Data\OpenCandy\A671758685DC4D0397C476C187514FBF, , [fdf907c4027940f6d748358d5ca629d7],
PUP.Optional.Datamngr.A, C:\Documents and Settings\Admistrimator\AppData\LocalLow\DataMngr, , [ae4856751566bd797a0eeddb9d65a759],
PUP.Optional.SearchResultsToolbar.A, C:\Documents and Settings\Admistrimator\Application Data\searchresultstb, , [f7ff15b62a5193a3ade2dafea75b9d63],

Files: 10
PUP.Optional.Babylon.A, C:\Documents and Settings\Admistrimator\Application Data\OpenCandy\A671758685DC4D0397C476C187514FBF\DeltaTB.exe, , [9660418adba05cda5797eb27b15028d8],
PUP.Optional.ContinueToSave.A, C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage, , [9f57a9227ffc1620d59643ad788a23dd],
PUP.Optional.ContinueToSave.A, C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage-journal, , [45b1507bcdae6cca98d3ed0360a234cc],
PUP.Optional.Babylon.A, C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml, , [70867d4e601bae88b79fd63f649f9769],
Malware.Trace, C:\WINDOWS.0\inf\ntvdm.inf, , [10e608c38eedba7cc1e1c56d59ab21df],
PUP.Optional.BrowseToSave.A, C:\Documents and Settings\All Users\Application Data\Browse2saVe\settings.ini, , [8373bf0cd6a5d95d07040fb34ab8bb45],
PUP.Optional.BrowseToSave.A, C:\Documents and Settings\All Users\Application Data\Browse2saVe\513b9fd1ac5e0.tlb, , [8373bf0cd6a5d95d07040fb34ab8bb45],
PUP.Optional.Datamngr.A, C:\Documents and Settings\Admistrimator\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, , [ae4856751566bd797a0eeddb9d65a759],
PUP.Optional.Delta.A, C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": "http://www.delta-search.com/?babsrc=HP_ ... 5&tsp=5025",), ,[c036f1dadc9f3bfb40c5ad6930d538c8]
PUP.Optional.Delta.A, C:\Documents and Settings\Admistrimator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "startup_urls": [ "http://www.delta-search.com/?babsrc=HP_ ... 5&tsp=5025" ],), ,[4fa736952655c76f73c38e88966f9070]

Physical Sectors: 0
(No malicious items detected)


(end)

[Rudy]

Vše nalezené smažte.

[backpase]

Mohli by ste prosím napísať ako/cez čo to vymazať? Z týchto vecí som úplne vedľa, ďakujem.

[Rudy]

V programu MBAM by mělo být na tlačítko.

[backpase]

Vymazané. Podľa skenu to vyzerá, že je to už čisté. Ďakujem za pomoc a poprosil by som vás ešte o 1 radu... Mohol by som si nainštalovať SP3?

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 30. 8. 2014
Čas skenování: 17:12:32
Protokol:
Správce: Ano

Verze: 2.00.2.1012
Databáze malwaru: v2014.08.30.05
Databáze rootkitů: v2014.08.21.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Self-protection: Vypnuto

OS: Windows XP Service Pack 2
CPU: x86
Souborový systém: FAT32
Uživatel: Admistrimator

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 312044
Uplynulý čas: 1 hod, 1 min, 32 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristics: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(No malicious items detected)

Moduly: 0
(No malicious items detected)

Klíče registru: 0
(No malicious items detected)

Hodnoty registru: 0
(No malicious items detected)

Data registru: 0
(No malicious items detected)

Složky: 0
(No malicious items detected)

Soubory: 0
(No malicious items detected)

Fyzické sektory: 0
(No malicious items detected)


(end)