Prosím o kontrolu logu

Zpráva

LetisVT · #1 Příspěvek od **LetisVT** » 18 led 2010 21:03

Zdravím.Potřeboval bych zkontrolovat log.Ze záhadného důvodu mi po startu windows naskakuje IE s nějakou reklamou.
A i možná tam toho bude víc..

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 20:57:38, on 18.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Windows User\winlogon.exe
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Letis\Data aplikací\svost.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search-styles.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-styles.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-styles.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: GdfrDUEn - {A3CF7606-E683-4375-A372-96B75DA0AEF7} - C:\Program Files\Get Styles\enlbrdr.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [ASUS Energy Saving] "C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Service Host] C:\Documents and Settings\Letis\Data aplikací\svost.exe
O4 - HKLM\..\Run: [winlogon] C:\Program Files\Windows User\winlogon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Service Host] C:\Documents and Settings\Letis\Data aplikací\svost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Get Styles\ct.htm
O9 - Extra 'Tools' menuitem: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Get Styles\ct.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP Infium\infium.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2985141359
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

--
End of file - 9013 bytes

Předem děkuji za rady..

pitimir · #2 Příspěvek od **pitimir** » 18 led 2010 21:35

Ahoj, mas tam bordel...

Stiahni RSIT. Spust, klik na "Continue". Po dokoneceni by se ti mal otvorit textovy subor. Ten skopiruj sem.
Pokial by sa nieco stalo, najdes ho aj na adrese "C:\rsit\log.txt".

LetisVT · #3 Příspěvek od **LetisVT** » 18 led 2010 21:40

jj myslel jsem si to nevim jestli je to možný,ale instaloval jsem hodně win xp aktualizací.. tak jesli tim se tam udělal bordel?

log zde

Logfile of random's system information tool 1.06 (written by random/random)
Run by Letis at 2010-01-18 21:37:00
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 364 GB (60%) free of 610 GB
Total RAM: 3582 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:05, on 18.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Windows User\winlogon.exe
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Letis\Data aplikací\svost.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Documents and Settings\Letis\Plocha\Instalačky\RSIT.exe
C:\Program Files\trend micro\Letis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search-styles.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-styles.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-styles.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: GdfrDUEn - {A3CF7606-E683-4375-A372-96B75DA0AEF7} - C:\Program Files\Get Styles\enlbrdr.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [ASUS Energy Saving] "C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Service Host] C:\Documents and Settings\Letis\Data aplikací\svost.exe
O4 - HKLM\..\Run: [winlogon] C:\Program Files\Windows User\winlogon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Service Host] C:\Documents and Settings\Letis\Data aplikací\svost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Get Styles\ct.htm
O9 - Extra 'Tools' menuitem: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Get Styles\ct.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP Infium\infium.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2985141359
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

--
End of file - 8814 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
GdfrDUEn Class - C:\Program Files\Get Styles\enlbrdr.dll [2009-12-16 185344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-10-05 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-07 16862208]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"Ai Nap"=C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe [2008-01-28 1413120]
"CPU Power Monitor"=C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe [2008-01-09 627200]
"Cpu Level Up help"=C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe [2007-11-30 881152]
"ASUS Energy Saving"=C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe [2008-01-28 1352704]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-03-19 13508608]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-03-19 86016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-24 98304]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"Windows Service Host"=C:\Documents and Settings\Letis\Data aplikací\svost.exe [2009-12-17 77824]
"winlogon"=C:\Program Files\Windows User\winlogon.exe [2009-11-11 1232896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Windows Service Host"=C:\Documents and Settings\Letis\Data aplikací\svost.exe [2009-12-17 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT ACR]
C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [2008-06-06 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-09-25 306088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-24 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Valve\Steam\Steam.exe [2009-12-31 1217808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
C:\PROGRA~1\WI459E~1\WINDOW~1.EXE /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Letis^Nabídka Start^Programy^Po spuštění^CCC.lnk]
C:\PROGRA~1\ATITEC~1\ATI.ACE\CORE-S~1\CLI.exe [2009-04-22 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Letis^Nabídka Start^Programy^Po spuštění^DesktopVideoPlayer.LNK]
C:\PROGRA~1\vghd\vghd.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-11-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\QIP Infium\infium.exe"="C:\Program Files\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"C:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Poser 7\Poser.exe"="C:\Program Files\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Program Files\TmNationsForever\TmForever.exe"="C:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\VirtualDJ\virtualdj.exe"="C:\Program Files\VirtualDJ\virtualdj.exe:*:Enabled:VirtualDJ"
"C:\CS-NS+neco navic\cstrike.exe"="C:\CS-NS+neco navic\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Documents and Settings\Letis\Plocha\bulanci.exe"="C:\Documents and Settings\Letis\Plocha\bulanci.exe:*:Enabled:bulanci"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Codemasters\DiRT2\dirt2_game.exe"="C:\Program Files\Codemasters\DiRT2\dirt2_game.exe:*:Enabled:DiRT2"
"C:\CABAL Online (Europe)\launcher\update\ESTdnheadless.exe"="C:\CABAL Online (Europe)\launcher\update\ESTdnheadless.exe:*:Enabled:EST! download engine"
"C:\Program Files\Valve\Steam\SteamApps\l3tis\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\l3tis\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\getnys31\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\getnys31\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\Steam\SteamApps\getnys31\condition zero\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\getnys31\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"Windows Service Host"="C:\Documents and Settings\Letis\Data aplikací\svost.exe"
"C:\Program Files\Valve\Steam\SteamApps\l3tis\condition zero\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\l3tis\condition zero\hl.exe:*:Enabled:Half-Life Launcher"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd5ab6e6-ac2f-11de-8d9b-00221568519e}]
shell\AutoRun\command - WD_Windows_Tools\Setup.exe

======List of files/folders created in the last 1 months======

2010-01-18 21:37:01 ----D---- C:\Program Files\trend micro
2010-01-18 21:37:00 ----D---- C:\rsit
2010-01-18 20:57:17 ----D---- C:\Program Files\TrendMicro
2010-01-16 16:51:47 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2010-01-13 15:21:10 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-01-11 17:25:43 ----D---- C:\Program Files\Windows User
2010-01-11 17:02:14 ----RSH---- C:\Documents and Settings\Letis\Data aplikací\svost.exe
2010-01-09 18:11:59 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2010-01-09 18:11:41 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-01-09 18:11:39 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2010-01-09 14:09:23 ----RHD---- C:\Documents and Settings\Letis\Data aplikací\SecuROM
2010-01-09 10:00:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2010-01-09 10:00:28 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2010-01-09 10:00:04 ----D---- C:\WINDOWS\system32\GroupPolicy
2010-01-09 10:00:04 ----D---- C:\Program Files\Windows Desktop Search
2010-01-09 09:59:53 ----HDC---- C:\WINDOWS\$NtUninstallKB915800-v4$
2010-01-09 09:59:35 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2010-01-09 09:59:22 ----D---- C:\Program Files\Windows Media Connect 2
2010-01-09 09:59:14 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2010-01-08 23:03:29 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-08 23:03:25 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-01-08 23:03:21 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-01-08 22:54:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-01-08 22:54:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-01-08 22:53:58 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-01-08 22:53:54 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-01-08 22:53:51 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-01-08 22:53:47 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-01-08 22:52:01 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-01-08 22:51:56 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-01-08 22:51:52 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-01-08 22:51:49 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2010-01-08 22:51:45 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-01-08 22:51:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-01-08 22:51:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-01-08 22:51:35 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-01-08 22:51:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-01-08 22:51:24 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-01-08 22:51:21 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-01-08 22:51:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-01-08 22:51:03 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-01-08 22:50:59 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-01-08 22:50:56 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-01-08 22:50:51 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-01-08 22:50:48 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-01-08 22:50:44 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-01-08 22:50:39 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-01-08 22:50:36 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-01-08 22:50:33 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-01-08 22:50:29 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-01-08 22:50:26 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-01-08 22:50:21 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-01-08 22:50:16 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-01-08 22:46:43 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-01-08 22:46:40 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-01-08 22:46:38 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2010-01-08 22:46:18 ----D---- C:\WINDOWS\ie8updates
2010-01-08 22:46:08 ----D---- C:\WINDOWS\WBEM
2010-01-08 22:44:54 ----HDC---- C:\WINDOWS\ie8
2010-01-08 22:41:54 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-01-08 22:41:48 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-01-08 22:41:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-01-08 22:41:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-01-08 22:41:23 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-01-08 22:41:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-01-08 22:36:13 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2010-01-08 22:36:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-01-08 22:35:59 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-01-08 22:35:55 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-01-08 22:35:51 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-01-08 22:35:47 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-01-08 22:35:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-01-08 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-01-08 22:35:03 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2010-01-08 22:34:35 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-01-08 22:34:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-01-08 22:30:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2010-01-08 22:29:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-08 22:29:12 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-01-08 22:29:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-01-08 22:25:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-01-08 22:24:56 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2010-01-08 22:24:48 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-01-08 22:24:43 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2010-01-08 22:15:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Windows Genuine Advantage
2010-01-08 22:15:22 ----D---- C:\WINDOWS\system32\PreInstall
2010-01-08 22:15:21 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2010-01-03 20:56:32 ----D---- C:\Program Files\Get Styles
2010-01-03 20:33:03 ----A---- C:\WINDOWS\system32\btinstall.dll
2010-01-02 23:19:00 ----D---- C:\Documents and Settings\Letis\Data aplikací\DisplayTune
2010-01-02 23:03:29 ----A---- C:\WINDOWS\system32\wpfb_ati2dvag.dll
2010-01-02 23:03:27 ----D---- C:\Program Files\Portrait Displays
2010-01-02 23:03:27 ----A---- C:\WINDOWS\system32\WPFB.DLL
2010-01-02 23:02:46 ----A---- C:\WINDOWS\msvcr70.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\msvcp70.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\msvbvm60.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\mfcm80u.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\mfcm80.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\mfc80u.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\mfc80.dll
2010-01-02 23:02:46 ----A---- C:\WINDOWS\mfc70.dll
2010-01-02 23:02:45 ----A---- C:\WINDOWS\msvcr80.dll
2010-01-02 23:02:45 ----A---- C:\WINDOWS\msvcp80.dll
2010-01-02 23:02:45 ----A---- C:\WINDOWS\msvcm80.dll
2010-01-02 23:02:45 ----A---- C:\WINDOWS\ijl15.dll
2010-01-02 23:02:45 ----A---- C:\WINDOWS\atl80.dll
2010-01-02 23:02:44 ----D---- C:\Program Files\Common Files\Portrait Displays
2010-01-02 23:02:40 ----D---- C:\Program Files\Acer Display
2009-12-31 12:43:57 ----D---- C:\Program Files\Valve
2009-12-22 19:07:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\Codemasters
2009-12-22 19:06:08 ----A---- C:\WINDOWS\system32\mkl_vml_p4.dll
2009-12-22 19:06:08 ----A---- C:\WINDOWS\system32\mkl_vml_p3.dll
2009-12-22 19:06:08 ----A---- C:\WINDOWS\system32\mkl_vml_def.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\rapture3d_oal.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\mkl_p4.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\mkl_p3.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\mkl_lapack64.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\mkl_lapack32.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\mkl_def.dll
2009-12-22 19:06:07 ----A---- C:\WINDOWS\system32\libguide40.dll
2009-12-22 19:06:06 ----D---- C:\Program Files\BRS
2009-12-22 19:04:58 ----RA---- C:\WINDOWS\system32\tmp53C.tmp
2009-12-22 19:04:58 ----RA---- C:\WINDOWS\system32\tmp53B.tmp
2009-12-22 19:04:58 ----D---- C:\Program Files\OpenAL
2009-12-22 19:04:56 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2009-12-22 19:04:55 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2009-12-22 19:04:55 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2009-12-22 19:04:54 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2009-12-22 19:04:54 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2009-12-22 19:04:54 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2009-12-22 19:04:53 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2009-12-22 18:55:52 ----D---- C:\Program Files\Codemasters
2009-12-21 17:47:14 ----D---- C:\Documents and Settings\Letis\Data aplikací\Broad Intelligence
2009-12-21 17:17:24 ----D---- C:\Program Files\MediaCoder
2009-12-21 17:02:48 ----D---- C:\Program Files\Gabest
2009-12-21 17:02:37 ----D---- C:\Program Files\AviSynth 2.5

======List of files/folders modified in the last 1 months======

2010-01-18 21:37:01 ----RD---- C:\Program Files
2010-01-18 21:20:51 ----D---- C:\WINDOWS
2010-01-18 21:18:03 ----SD---- C:\Documents and Settings\Letis\Data aplikací\Microsoft
2010-01-18 20:57:18 ----SHD---- C:\WINDOWS\Installer
2010-01-18 20:52:41 ----A---- C:\WINDOWS\win.ini
2010-01-18 19:54:09 ----D---- C:\WINDOWS\Temp
2010-01-18 19:00:50 ----D---- C:\WINDOWS\Prefetch
2010-01-18 17:24:57 ----D---- C:\Documents and Settings\Letis\Data aplikací\vlc
2010-01-18 17:02:03 ----D---- C:\WINDOWS\system32\config
2010-01-18 14:09:09 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-17 18:01:56 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-01-17 17:52:43 ----D---- C:\Fraps
2010-01-17 17:07:47 ----D---- C:\Documents and Settings\Letis\Data aplikací\dvdcss
2010-01-16 16:51:51 ----HD---- C:\WINDOWS\inf
2010-01-16 16:51:48 ----D---- C:\WINDOWS\system32
2010-01-16 16:51:41 ----RSD---- C:\WINDOWS\assembly
2010-01-16 16:51:31 ----D---- C:\WINDOWS\system32\XPSViewer
2010-01-16 16:51:30 ----D---- C:\WINDOWS\system32\cs-cz
2010-01-16 14:34:44 ----D---- C:\FreeRapid-0.83u1
2010-01-14 16:10:32 ----D---- C:\WINDOWS\Debug
2010-01-13 15:21:12 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-13 15:20:58 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-09 13:54:24 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-09 13:53:12 ----D---- C:\WINDOWS\system32\DirectX
2010-01-09 13:41:04 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-09 13:41:04 ----D---- C:\Program Files\Rockstar Games
2010-01-09 10:24:27 ----D---- C:\WINDOWS\Microsoft.NET
2010-01-09 10:05:18 ----D---- C:\WINDOWS\system32\wbem
2010-01-09 10:05:16 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-09 10:03:39 ----RSH---- C:\boot.ini
2010-01-09 10:03:39 ----A---- C:\WINDOWS\system.ini
2010-01-09 10:03:38 ----D---- C:\WINDOWS\pss
2010-01-09 10:00:32 ----D---- C:\WINDOWS\security
2010-01-09 10:00:12 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-01-09 09:59:22 ----D---- C:\Program Files\Windows Media Player
2010-01-09 09:59:20 ----D---- C:\WINDOWS\Help
2010-01-08 23:06:08 ----D---- C:\WINDOWS\AppPatch
2010-01-08 23:03:23 ----D---- C:\WINDOWS\system32\drivers
2010-01-08 22:53:56 ----D---- C:\Program Files\Messenger
2010-01-08 22:53:26 ----D---- C:\WINDOWS\WinSxS
2010-01-08 22:48:35 ----D---- C:\Program Files\Internet Explorer
2010-01-08 22:46:01 ----D---- C:\WINDOWS\Media
2010-01-08 22:41:18 ----D---- C:\Program Files\Outlook Express
2010-01-08 22:28:41 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-08 22:12:40 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-01-08 20:02:40 ----D---- C:\CABAL Online (Helix)
2010-01-08 17:42:49 ----D---- C:\WINDOWS\Minidump
2010-01-08 17:36:03 ----D---- C:\NFS SHIFT
2010-01-04 15:04:34 ----D---- C:\Documents and Settings\Letis\Data aplikací\Microgaming
2010-01-02 23:42:55 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-01-02 23:02:44 ----D---- C:\Program Files\Common Files
2010-01-01 14:05:27 ----D---- C:\Program Files\Cheat Engine
2009-12-31 13:05:17 ----D---- C:\Documents and Settings
2009-12-31 12:14:45 ----D---- C:\bwinPoker
2009-12-28 10:08:05 ----D---- C:\Program Files\QIP Infium
2009-12-26 10:21:17 ----D---- C:\Program Files\Google
2009-12-26 10:17:20 ----D---- C:\WINDOWS\uninstall
2009-12-24 16:50:05 ----D---- C:\CABAL Online (Europe)
2009-12-22 19:04:58 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2009-12-22 19:04:58 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2009-12-20 13:01:35 ----D---- C:\Documents and Settings\Letis\Data aplikací\Adobe
2009-12-19 09:36:55 ----D---- C:\Documents and Settings\Letis\Data aplikací\vghd

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 Pivot;Pivot; C:\WINDOWS\System32\drivers\pivot.sys [2007-02-09 17465]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-08 56816]
R3 AmdTools;AMD Special Tools Driver; C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2008-04-28 42552]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-11-25 4463104]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2009-04-01 93184]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-07 4739072]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-12 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2008-01-29 54016]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2008-05-03 38176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2008-01-29 22016]
R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2007-10-12 13312]
R3 PdiPorts;Portrait Displays low level device driver; C:\WINDOWS\System32\Drivers\PdiPorts.sys [2009-07-15 17136]
R3 pivotmou;Pivot Mouse/Pointers Filter Driver; \??\C:\WINDOWS\system32\drivers\pivotmou.sys []
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2004-04-14 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2004-04-14 44064]
S2 DgiVecp;Team MFP Comm Driver; C:\WINDOWS\System32\Drivers\DgiVecp.sys [2003-07-29 40448]
S3 abuae0sd;abuae0sd; C:\WINDOWS\system32\drivers\abuae0sd.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2004-10-19 20096]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2004-09-21 10804]
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-01-13 12500]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 dump_wmimmc;dump_wmimmc; \??\C:\CABAL Online (Europe)\GameGuard\dump_wmimmc.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NPPTNT2;NPPTNT2; \??\C:\WINDOWS\system32\npptNT2.sys []
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-03-19 7086240]
S3 PciBus;PciBus; \??\C:\WINDOWS\system32\drivers\PciBus.sys []
S3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2006-03-02 5888]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2004-11-05 82148]
S3 W700bus;Sony Ericsson W700 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\W700bus.sys [2006-02-19 61536]
S3 W700mdfl;Sony Ericsson W700 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\W700mdfl.sys [2006-02-19 9264]
S3 W700mdm;Sony Ericsson W700 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\W700mdm.sys [2006-02-19 97056]
S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2006-02-19 88560]
S3 W700obex;Sony Ericsson W700 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\W700obex.sys [2006-02-19 86368]
S3 WmFilter;Logitech WingMan HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2004-04-14 21280]
S3 WmHidLo;Logitech WingMan USB Filter Driver; C:\WINDOWS\system32\drivers\WmHidLo.sys [2004-04-14 14432]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2004-04-14 5600]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XDva302;XDva302; \??\C:\WINDOWS\system32\XDva302.sys []
S3 XDva309;XDva309; \??\C:\WINDOWS\system32\XDva309.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AsSysCtrlService;ASUS System Control Service; C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-04-02 90112]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-11-04 602112]
R2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe [2008-06-06 69632]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 PdiService;Portrait Displays SDK Service; C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2009-07-15 109168]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
R3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-25 593920]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-03 133104]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-03-19 155716]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-05 655624]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-09-28 3426552]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

pitimir · #4 Příspěvek od **pitimir** » 18 led 2010 21:50

Toto s aktualizaciami nema suvis...s nimi sa malware netaha.

Stiahni OTM. Do laveho policka skopiruj:

Kód: Vybrat vše

:processes
explorer.exe
svost.exe

:files
C:\Documents and Settings\Letis\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
C:\Program Files\DAEMON Tools Toolbar
C:\Documents and Settings\Letis\Data aplikací\svost.exe 
C:\Program Files\Windows User\winlogon.exe 

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Service Host"=-
"winlogon"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Service Host"=-

:commands
[emptytemp]
[reboot]

Klik na "Move It". Nasledne sa ti objavi v okne "Result" pokec, ktory sem cely skopiruj.

P.S.: Keby program ziadal restart, potvr ho. Nasledujuci log najdes v "C:\_OTM\MovedFiles\".

pitimir · #5 Příspěvek od **pitimir** » 18 led 2010 21:51

+ rovno posielam dalsi krok, pokracujeme zajtra poobede:

Stiahni ComboFix, najlepsie na plochu. Vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall. Spust program cez ucet s administratorskymi pravami a postupuj podla instrukcii. Cely sken bude trvat cca 10 minut. Pocas neho moze byt PC restartovane. Log, ktory ComboFix vytvori, najdes na adrese "C:\ComboFix.txt".
Ten vloz sem.

Pozor: Kym ComboFix nevytvori log, na nic neklikat, nic nestlacat !!

LetisVT · #6 Příspěvek od **LetisVT** » 18 led 2010 22:05

no nevim jestli šlo všechno uplně hladce protože ne, že by si vyžadal restart ale nejaka chyba vyskočila tak sem to chtěl screennou jenže sem neměl lištu ani ikony a hodilo to samo restart.. potom už mi IE s reklamou nevyskočil.. ale log tam taky neni jen nějaky jiny soubory

no a combofix má nějaký kecy že vypršela jeho platnost a nejde stáhnout jeho aktualizace.. kdyžtak bych prosil o odkaz kde najdu nějakou normální verzi.

pitimir · #7 Příspěvek od **pitimir** » 19 led 2010 19:19

pitimir píše:P.S.: Keby program ziadal restart, potvr ho. Nasledujuci log najdes v "C:\_OTM\MovedFiles\".

Ten log by sa zisiel

A skus stiahnut znova, uz by to malo slapat, v noci bol link dany nas5 do poriadku.

LetisVT · #8 Příspěvek od **LetisVT** » 19 led 2010 21:13

ten log v moved files opravdu není.. zde dávám log z combofixu

ComboFix 10-01-19.01 - Letis 19.01.2010 21:04:56.2.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3582.3149 [GMT 1:00]
Spuštěný z: c:\documents and settings\Letis\Plocha\Instalačky\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Cheat Engine\dbk32.sys
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-19 do 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-18 20:58 . 2010-01-18 20:58 -------- d-----w- C:\_OTM
2010-01-18 20:37 . 2010-01-18 20:37 -------- d-----w- c:\program files\trend micro
2010-01-18 20:37 . 2010-01-18 20:37 -------- d-----w- C:\rsit
2010-01-18 19:57 . 2010-01-18 19:57 -------- d-----w- c:\program files\TrendMicro
2010-01-14 17:17 . 2010-01-14 17:17 -------- d-----w- c:\documents and settings\Letis\DokumentyVideos
2010-01-12 19:02 . 2010-01-12 19:02 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-01-11 16:25 . 2010-01-18 20:58 -------- d-----w- c:\program files\Windows User
2010-01-09 09:00 . 2010-01-09 09:00 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-01-09 09:00 . 2010-01-09 09:07 -------- d-----w- c:\program files\Windows Desktop Search
2010-01-09 09:00 . 2010-01-09 09:00 -------- d-----w- c:\windows\system32\GroupPolicy
2010-01-09 08:59 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-01-09 08:59 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-01-09 08:59 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-01-09 08:59 . 2010-01-09 08:59 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-08 22:03 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-08 21:58 . 2010-01-08 21:58 -------- d-sh--w- c:\documents and settings\Letis\PrivacIE
2010-01-08 21:48 . 2010-01-08 21:48 -------- d-sh--w- c:\documents and settings\Letis\IETldCache
2010-01-08 21:41 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-08 21:34 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-08 21:34 . 2009-07-10 13:28 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-08 21:33 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-08 21:33 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-08 21:33 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-08 21:33 . 2008-05-01 14:37 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-08 21:29 . 2008-04-11 19:06 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-08 21:24 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-08 21:24 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-08 21:24 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-08 21:24 . 2009-06-22 06:48 726528 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-01-08 21:20 . 2009-08-04 21:59 2191360 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-08 21:20 . 2009-03-06 14:23 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-08 21:20 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-08 21:20 . 2009-02-09 10:56 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-08 21:20 . 2009-02-09 10:56 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-01-08 21:20 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-08 21:20 . 2009-08-04 17:29 2147328 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-08 21:20 . 2009-08-04 17:29 2025984 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-08 21:20 . 2009-06-25 08:27 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2010-01-08 21:20 . 2009-02-09 10:56 709632 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-08 21:20 . 2009-02-09 10:56 684032 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-08 21:20 . 2009-02-09 10:56 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-08 21:12 . 2010-01-08 21:12 -------- d-sh--w- c:\documents and settings\Letis\UserData
2010-01-03 19:56 . 2010-01-03 19:56 -------- d-----w- c:\program files\Get Styles
2010-01-03 19:33 . 2008-04-14 07:52 54272 ----a-w- c:\windows\system32\drivers\vfwwdm32.dll
2010-01-02 22:03 . 2010-01-02 22:03 62009 ----a-w- c:\windows\system32\wpfb_ati2dvag.dll
2010-01-02 22:03 . 2004-11-22 11:07 2304 ----a-w- c:\windows\system32\Machnm32.sys
2010-01-02 22:03 . 2010-01-02 22:03 -------- d-----w- c:\program files\Portrait Displays
2010-01-02 22:03 . 2007-02-09 11:17 17465 ----a-w- c:\windows\system32\drivers\pivot.sys
2010-01-02 22:03 . 2007-02-09 11:17 62009 ----a-w- c:\windows\system32\WPFB.DLL
2010-01-02 22:03 . 2007-02-09 11:17 11323 ----a-w- c:\windows\system32\drivers\pivotmou.sys
2009-12-31 11:43 . 2009-12-31 11:43 -------- d-----w- c:\program files\Valve
2009-12-22 18:06 . 2009-07-13 18:04 839680 ----a-w- c:\windows\system32\mkl_vml_p4.dll
2009-12-22 18:06 . 2009-07-13 18:04 532480 ----a-w- c:\windows\system32\mkl_vml_p3.dll
2009-12-22 18:06 . 2009-07-13 18:04 512000 ----a-w- c:\windows\system32\mkl_vml_def.dll
2009-12-22 18:06 . 2009-10-16 10:19 872448 ----a-w- c:\windows\system32\rapture3d_oal.dll
2009-12-22 18:06 . 2009-07-13 18:04 3485696 ----a-w- c:\windows\system32\mkl_p4.dll
2009-12-22 18:06 . 2009-07-13 18:04 2793472 ----a-w- c:\windows\system32\mkl_p3.dll
2009-12-22 18:06 . 2009-07-13 18:04 2441216 ----a-w- c:\windows\system32\mkl_def.dll
2009-12-22 18:06 . 2009-07-13 18:04 2174976 ----a-w- c:\windows\system32\mkl_lapack32.dll
2009-12-22 18:06 . 2009-07-13 18:04 2125824 ----a-w- c:\windows\system32\mkl_lapack64.dll
2009-12-22 18:06 . 2009-07-13 18:04 184320 ----a-w- c:\windows\system32\libguide40.dll
2009-12-22 18:06 . 2009-12-22 18:06 -------- d-----w- c:\program files\BRS
2009-12-22 18:04 . 2009-12-22 18:04 -------- d-----w- c:\program files\OpenAL
2009-12-22 18:04 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-12-22 18:04 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-12-22 18:04 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-12-22 18:04 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-12-22 18:04 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-12-22 18:04 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-12-22 18:04 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-12-22 17:55 . 2009-12-22 17:55 -------- d-----w- c:\program files\Codemasters
2009-12-21 16:56 . 2009-12-21 16:56 -------- d-----w- c:\documents and settings\Letis\.dvdcss
2009-12-21 16:18 . 2009-12-21 16:18 -------- d-----w- c:\documents and settings\Letis\NabÝdka Start
2009-12-21 16:17 . 2009-12-21 16:18 -------- d-----w- c:\program files\MediaCoder
2009-12-21 16:02 . 2009-12-21 16:10 -------- d-----w- c:\program files\Gabest
2009-12-21 16:02 . 2009-12-21 16:10 -------- d-----w- c:\program files\AviSynth 2.5
2009-12-21 13:38 . 2009-12-21 13:38 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-19 20:07 . 2009-09-26 13:30 -------- d-----w- c:\program files\Cheat Engine
2010-01-19 20:04 . 2006-03-02 12:00 78076 ----a-w- c:\windows\system32\perfc005.dat
2010-01-19 20:04 . 2006-03-02 12:00 429080 ----a-w- c:\windows\system32\perfh005.dat
2010-01-18 21:06 . 2010-01-18 21:07 390144 ----a-w- c:\windows\system32\CF3308.exe
2010-01-09 12:41 . 2009-09-25 16:43 -------- d-----w- c:\program files\Rockstar Games
2010-01-09 12:41 . 2009-09-25 15:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-02 22:02 . 2010-01-02 22:02 -------- d-----w- c:\program files\Common Files\Portrait Displays
2010-01-02 22:02 . 2010-01-02 22:02 -------- d-----w- c:\program files\Acer Display
2009-12-28 09:08 . 2009-09-26 12:06 -------- d-----w- c:\program files\QIP Infium
2009-12-26 09:21 . 2009-10-03 12:04 -------- d-----w- c:\program files\Google
2009-12-22 18:04 . 2009-09-25 16:28 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-22 18:04 . 2009-09-25 16:28 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-19 08:32 . 2009-12-18 21:29 7 ----a-w- c:\windows\sbacknt.bin
2009-12-18 21:28 . 2009-12-18 21:28 152904 ----a-w- c:\windows\system32\vghd.scr
2009-12-18 17:12 . 2009-09-25 16:07 -------- d-----w- c:\program files\ATI Technologies
2009-12-17 16:29 . 2009-12-17 16:29 -------- d-----w- c:\program files\PokerStove
2009-12-11 10:23 . 2009-12-11 10:23 -------- d-----w- c:\program files\QuickTime
2009-12-11 10:23 . 2009-12-11 10:23 -------- d-----w- c:\program files\Common Files\Apple
2009-12-11 10:23 . 2009-12-11 10:23 -------- d-----w- c:\program files\Apple Software Update
2009-12-11 08:05 . 2009-12-11 08:05 -------- d-----w- c:\program files\AMD
2009-12-11 08:00 . 2009-12-11 07:58 -------- d-----w- c:\program files\ATI
2009-12-08 11:56 . 2009-09-25 17:50 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-28 11:54 . 2009-09-25 16:35 -------- d-----w- c:\program files\Opera
2009-11-25 03:50 . 2009-04-29 03:30 4463104 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-11-25 03:27 . 2009-09-25 16:08 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-11-25 03:11 . 2009-04-29 02:06 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-11-25 03:10 . 2009-04-29 02:06 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-11-25 03:07 . 2009-04-29 02:03 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-11-25 02:59 . 2009-09-25 16:08 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-11-25 02:44 . 2009-04-29 01:45 13533184 ----a-w- c:\windows\system32\atioglxx.dll
2009-11-25 02:42 . 2009-12-18 17:12 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-11-25 02:42 . 2009-12-18 17:12 3 ----a-w- c:\windows\system32\ativva5x.dat
2009-11-25 02:26 . 2009-04-29 01:26 65024 ----a-w- c:\windows\system32\atimpc32.dll
2009-11-25 02:26 . 2009-04-29 01:26 65024 ----a-w- c:\windows\system32\amdpcom32.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-11-25 02:19 . 2009-04-29 01:20 176128 ----a-w- c:\windows\system32\atiadlxx.dll
2009-11-25 02:18 . 2009-04-29 01:19 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-11-25 02:18 . 2009-04-29 01:18 3612672 ----a-w- c:\windows\system32\aticaldd.dll
2009-11-25 02:18 . 2009-04-29 01:19 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-11-23 17:22 . 2009-11-23 17:22 -------- d-----w- c:\program files\Vstplugins
2009-11-23 17:22 . 2009-11-23 17:22 -------- d-----w- c:\program files\Sony
2009-11-23 17:10 . 2009-11-23 17:10 -------- d-----w- c:\program files\Sony Setup
2009-11-21 16:03 . 2006-03-02 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-18 08:18 . 2009-11-18 08:18 196608 ----a-w- c:\windows\system32\XPva00.dll
2009-11-07 22:25 . 2009-11-07 22:25 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-11-06 09:59 . 2009-11-06 09:59 15406728 ----a-w- c:\windows\system32\xlive.dll
2009-11-06 09:59 . 2009-11-06 09:59 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2009-11-04 16:33 . 2009-09-27 11:48 0 ----a-w- c:\windows\system32\svc_host.dat
2009-11-04 15:44 . 2009-04-29 02:17 300032 ----a-w- c:\windows\system32\ati2dvag.dll
2009-11-04 15:29 . 2009-04-29 02:07 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-11-04 15:29 . 2009-04-29 02:06 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-11-04 15:28 . 2009-04-29 02:06 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-11-04 15:27 . 2009-04-29 02:04 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-11-04 15:18 . 2009-04-29 01:56 3518304 ----a-w- c:\windows\system32\ati3duag.dll
2009-11-04 15:05 . 2009-04-29 01:42 2135680 ----a-w- c:\windows\system32\ativvaxx.dll
2009-11-04 14:47 . 2009-04-29 01:22 565248 ----a-w- c:\windows\system32\atikvmag.dll
2009-11-04 14:44 . 2009-04-29 01:17 397312 ----a-w- c:\windows\system32\atiok3x2.dll
2009-11-04 14:39 . 2009-04-29 01:13 638976 ----a-w- c:\windows\system32\ati2cqag.dll
2009-11-02 17:05 . 2009-11-02 17:05 167064 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-02 17:05 . 2009-11-02 17:05 71832 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-02 15:59 . 2009-10-02 19:37 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-29 07:43 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-22 15:59 . 2009-09-25 16:08 196565 ----a-w- c:\windows\system32\atiicdxx.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2009-12-16 09:03 185344 ----a-w- c:\program files\Get Styles\enlbrdr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-07 16862208]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2008-01-28 1413120]
"CPU Power Monitor"="c:\program files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"ASUS Energy Saving"="c:\program files\ASUS\AI Suite\EnergySaving\PwSave.exe" [2008-01-28 1352704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-19 13508608]
"nwiz"="nwiz.exe" [2008-03-19 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-19 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-24 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Letis^Nabídka Start^Programy^Po spuštění^CCC.lnk]
path=c:\documents and settings\Letis\Nabídka Start\Programy\Po spuštění\CCC.lnk
backup=c:\windows\pss\CCC.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Letis^Nabídka Start^Programy^Po spuštění^DesktopVideoPlayer.LNK]
path=c:\documents and settings\Letis\Nabídka Start\Programy\Po spuštění\DesktopVideoPlayer.LNK
backup=c:\windows\pss\DesktopVideoPlayer.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT ACR]
2008-06-06 10:39 81920 ----a-w- c:\program files\Common Files\Portrait Displays\Shared\DT_Startup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-09-25 17:23 306088 ----a-w- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-11-24 20:24 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-31 11:47 1217808 ----a-w- c:\program files\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Poser 7\\Poser.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\VirtualDJ\\virtualdj.exe"=
"c:\\Documents and Settings\\Letis\\Plocha\\bulanci.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Codemasters\\DiRT2\\dirt2_game.exe"=
"c:\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\l3tis\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\getnys31\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\getnys31\\condition zero\\hl.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"Windows Service Host"= c:\documents and settings\Letis\Data aplikací\svost.exe
"c:\\Program Files\\Valve\\Steam\\SteamApps\\l3tis\\condition zero\\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [25.9.2009 18:50 108289]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2.1.2010 23:03 109168]
R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\drivers\AmdTools.sys [16.11.2009 23:07 42552]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [3.5.2008 4:16 38176]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [25.9.2009 17:22 721904]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [26.9.2009 9:12 90112]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.10.2009 13:04 133104]
S3 dump_wmimmc;dump_wmimmc;\??\c:\cabal online (europe)\GameGuard\dump_wmimmc.sys --> c:\cabal online (europe)\GameGuard\dump_wmimmc.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 XDva302;XDva302;\??\c:\windows\system32\XDva302.sys --> c:\windows\system32\XDva302.sys [?]
S3 XDva309;XDva309;\??\c:\windows\system32\XDva309.sys --> c:\windows\system32\XDva309.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 12:04]

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 12:04]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search-styles.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - c:\program files\Get Styles\ct.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
HKCU-Run-Windows Service Host - c:\documents and settings\Letis\Data aplikací\svost.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 21:07
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-343818398-602609370-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:29,9c,68,61,85,07,25,c1,2f,2a,bd,b4,99,58,f6,da,98,2c,5b,1b,bd,
99,4f,6e,44,80,73,4f,53,c1,80,46,24,d3,a2,c4,e2,52,75,11,20,ea,fd,28,59,2d,\
"rkeysecu"=hex:d8,ed,bd,d2,f8,85,56,29,cc,b9,e0,50,42,d9,44,21

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_1bcf&Pid_0007&Col01\6&17455080&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Celkový čas: 2010-01-19 21:08:41
ComboFix-quarantined-files.txt 2010-01-19 20:08

Před spuštěním: Volných bajtů: 382 097 330 176
Po spuštění: Volných bajtů: 382 059 851 776

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 8775FA39B8185FBE08C39C30CF7B95E1

pitimir · #9 Příspěvek od **pitimir** » 20 led 2010 18:59

ComboFix mal byt na ploche

Presun ikonu CF na plochu, vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall a otvor poznamkovy blok. Donho skopiruj:

Kód: Vybrat vše

http://viry.cz/forum/viewtopic.php?f=13&t=96412

KillAll:
DirLook::
c:\documents and settings\Letis\.dvdcss
C:\_OTM\MovedFiles

Folder::
c:\program files\Get Styles

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]

Driver::
XDva302
XDva309

Collect::
c:\windows\system32\XDva302.sys
c:\windows\system32\XDva309.sys

DDS::
uStart Page = hxxp://search-styles.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - c:\program files\Get Styles\ct.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe

RegLockDel::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_1bcf&Pid_0007&Col01\6&17455080&0&0000\LogConf]

Uloz na plochu ako CFScript.txt a mysou pretiahni nad ikonou CF.

Obrázek

Program script spracuje a spravi novy log.

Pozor: Ak po aplikacii skriptu nenabehne Windows, restartuj PC, stlac F8 a zvol Poslednu znamu funkcnu konfiguraciu.

LetisVT · #10 Příspěvek od **LetisVT** » 20 led 2010 19:49

bohužel si asi něco napsal špatně píše to něco o neplatný aplikaci

tak na po 2. už to snad vyšlo.. ...je dobře,že CFScript.txt "zmizel"?

log musim někam nahrát protože "Vaše zpráva obsahuje 65996 znaků. Maximální povolený počet znaků je 60000"

http://www.edisk.cz/stahni/50594/ComboF ... .35KB.html

pitimir · #11 Příspěvek od **pitimir** » 21 led 2010 19:28

V poriadku.

1) Stiahni Defogger. Spust, klik na "Disable" -> "OK". V mieste spustenia by sa mal zjavit log, ten sem vloz.

2) Start -> Spustit -> (napis) cmd /c mbr.exe -t >log.txt&start log.txt
Otvori sa textak (log.txt), aj jeho obsah sem skopiruj.

LetisVT · #12 Příspěvek od **LetisVT** » 21 led 2010 19:43

1)
defogger_disable by jpshortstuff (28.11.09.2)
Log created at 19:37 on 21/01/2010 (Letis)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)

-=E.O.F=-

2)
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

pitimir · #13 Příspěvek od **pitimir** » 21 led 2010 19:45

Ako to vyzera s problemami teraz?

LetisVT · #14 Příspěvek od **LetisVT** » 21 led 2010 19:49

řekl bych že snad už žádné nejsou nebo je aspoň nepozoruju

pitimir · #15 Příspěvek od **pitimir** » 21 led 2010 19:53

Nevidim ziaden antivirus, treba prioritne doinstalovat

Stiahni na plochu CureIt. Zatial ho nespustat. Restart do nudoveho rezimu (>>klik<<) a v nom spravis nasledovne:

Spust program dvojklikom, zrus pripadne vyzvy na stiahnutie novsej verzie a klikni na "Start".
Potvrd okna a automaticky zacne expresny scan. Ak sa pri tomto kratkom scane najdu infikovane subory, klikni na "Vyber vsetky" -> "Liecit" -> "Odstran neliecitelne".
Vo vrchnom menu klikni na "Volby" -> "Zmenit Nastavenia" a vyfajkni Heuristicka analyza a Vyzva na akciu -> "OK". Vrat sa naspat do hlavneho menu, v nom zvol komplet scan a klikni na zelenu sipku naprvo pod logom Dr. Web.
Ked bude scan hotovy, vo vrchnom menu klik na "File" a zvol "Uloz...". Uloz log na plochu, otvor v poznamkovom bloku a vloz ho sem. Nezabudni restartovat PC.

VIRY.CZ

Prosím o kontrolu logu

Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu