vcera zacal mrznut notebook- preventivka

[stancoj]

antivirus nic zatial nedetekoval


Logfile of random's system information tool 1.06 (written by random/random)
Run by hp at 2010-02-13 15:36:37
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 1 GB (4%) free of 31 GB
Total RAM: 2046 MB (64% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\ctbr.dll [2010-01-15 1230184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
LocalStrike Toolbar - C:\Program Files\Local_Strike\tbLoc1.dll [2010-01-17 2166296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
VeriSoft Access Manager - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll [2006-11-21 71192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2008-03-27 501056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\ctbr.dll [2010-01-15 1230184]
{2c650b7d-aa32-4798-af1a-fd8ef806d89f} - LocalStrike Toolbar - C:\Program Files\Local_Strike\tbLoc1.dll [2010-01-17 2166296]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-02-13 159744]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"CognizanceTS"=c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll [2003-12-22 17920]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-03-19 2029640]
""= []
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-03-13 81920]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\System32\APSHook.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"ShutdownWithoutLogon"=1
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"NoResolveTrack"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoResolveTrack"=
"NoViewContextMenu"=
"NoFileAssociate"=
"NoFind"=
"NoRun"=
"NoClose"=
"StartMenuLogoff"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-02-13 15:36:37 ----D---- C:\rsit
2010-02-13 15:36:37 ----D---- C:\Program Files\trend micro
2010-02-13 10:06:21 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-13 10:06:20 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-12 22:59:49 ----D---- C:\Windows\system32\QuickTime
2010-02-12 20:12:03 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-02-12 20:11:49 ----D---- C:\Program Files\NVIDIA Corporation
2010-02-12 20:09:43 ----A---- C:\Windows\system32\OpenCL.dll
2010-02-12 20:09:43 ----A---- C:\Windows\system32\nvwgf2um.dll
2010-02-12 20:09:41 ----A---- C:\Windows\system32\nvoglv32.dll
2010-02-12 20:09:41 ----A---- C:\Windows\system32\nvd3dum.dll
2010-02-12 20:09:41 ----A---- C:\Windows\system32\nvcuvid.dll
2010-02-12 20:09:41 ----A---- C:\Windows\system32\nvcuvenc.dll
2010-02-12 20:09:40 ----A---- C:\Windows\system32\nvcuda.dll
2010-02-12 20:09:38 ----A---- C:\Windows\system32\nvcompiler.dll
2010-02-12 20:09:38 ----A---- C:\Windows\system32\nvcod178.dll
2010-02-12 20:09:38 ----A---- C:\Windows\system32\nvcod.dll
2010-02-11 13:10:28 ----A---- C:\Windows\system32\quartz.dll
2010-02-11 13:10:26 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-11 13:10:26 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-11 13:10:25 ----A---- C:\Windows\system32\msyuv.dll
2010-02-11 13:10:24 ----A---- C:\Windows\system32\msrle32.dll
2010-02-11 13:10:23 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-11 13:10:21 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-11 13:10:20 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-11 13:10:19 ----A---- C:\Windows\system32\avifil32.dll
2010-02-10 20:51:56 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-02-09 18:57:44 ----D---- C:\Users\hp\AppData\Roaming\NASA
2010-02-09 15:46:30 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-02-09 15:42:51 ----D---- C:\ProgramData\TuneUp Software
2010-01-22 13:59:34 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 13:59:32 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 13:59:28 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 13:59:27 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 13:59:27 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 13:59:26 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 13:59:25 ----A---- C:\Windows\system32\occache.dll
2010-01-22 13:59:25 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 13:59:22 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 13:59:21 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 13:59:20 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-22 13:59:20 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 13:59:19 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 13:59:19 ----A---- C:\Windows\system32\iesysprep.dll
2010-01-22 13:59:18 ----A---- C:\Windows\system32\msfeedssync.exe
2010-01-22 13:59:18 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 13:59:18 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 13:59:17 ----A---- C:\Windows\system32\iernonce.dll
2010-01-19 20:37:08 ----D---- C:\Users\hp\AppData\Roaming\TuneUp Software
2010-01-15 18:06:29 ----D---- C:\Program Files\Conduit
2010-01-15 18:06:28 ----D---- C:\Program Files\Local_Strike
2010-01-15 16:04:44 ----D---- C:\Users\hp\AppData\Roaming\Malwarebytes
2010-01-15 16:04:37 ----D---- C:\ProgramData\Malwarebytes
2010-01-15 15:56:06 ----D---- C:\Users\hp\AppData\Roaming\skypePM
2010-01-15 15:54:04 ----D---- C:\Users\hp\AppData\Roaming\Skype
2010-01-15 15:53:03 ----D---- C:\Program Files\Common Files\Skype
2010-01-15 15:52:59 ----RD---- C:\Program Files\Skype
2010-01-15 15:52:51 ----D---- C:\ProgramData\Skype
2010-01-15 15:40:26 ----A---- C:\Windows\system32\t2embed.dll
2010-01-15 15:40:25 ----A---- C:\Windows\system32\fontsub.dll

======List of files/folders modified in the last 1 months======

2010-02-13 15:36:37 ----RD---- C:\Program Files
2010-02-13 15:36:35 ----D---- C:\Windows\Temp
2010-02-13 15:18:27 ----D---- C:\Windows\System32
2010-02-13 15:18:27 ----D---- C:\Windows\inf
2010-02-13 15:18:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-13 15:12:23 ----D---- C:\Windows\SMINST
2010-02-13 13:17:23 ----SHD---- C:\System Volume Information
2010-02-13 13:08:36 ----D---- C:\Windows\system32\config
2010-02-13 13:08:32 ----D---- C:\Windows\Tasks
2010-02-13 13:08:32 ----D---- C:\Windows\system32\wbem
2010-02-13 13:08:32 ----D---- C:\Windows\system32\spool
2010-02-13 13:08:32 ----D---- C:\Windows\system32\Msdtc
2010-02-13 13:08:32 ----D---- C:\Windows\registration
2010-02-13 13:08:32 ----D---- C:\WINDOWS
2010-02-13 10:49:35 ----D---- C:\Windows\winsxs
2010-02-13 10:28:27 ----D---- C:\Program Files\Crawler
2010-02-13 10:16:44 ----D---- C:\Windows\Prefetch
2010-02-13 10:06:10 ----D---- C:\Windows\system32\catroot2
2010-02-13 10:06:10 ----D---- C:\Windows\system32\catroot
2010-02-12 23:03:19 ----SHD---- C:\Windows\Installer
2010-02-12 21:34:09 ----D---- C:\Windows\system32\drivers
2010-02-12 21:16:56 ----D---- C:\Windows\system32\Tasks
2010-02-12 20:16:46 ----D---- C:\ProgramData\NVIDIA
2010-02-12 20:14:41 ----D---- C:\NVIDIA
2010-02-12 20:12:54 ----D---- C:\Program Files\AGEIA Technologies
2010-02-12 20:12:03 ----D---- C:\Program Files\Common Files
2010-02-11 09:52:53 ----A---- C:\Windows\system32\PnkBstrB.exe
2010-02-09 15:47:44 ----D---- C:\Program Files\Windows Sidebar
2010-02-09 15:46:30 ----HD---- C:\ProgramData
2010-02-06 12:10:02 ----SD---- C:\Users\hp\AppData\Roaming\Microsoft
2010-02-05 18:20:59 ----D---- C:\Program Files\Mozilla Firefox
2010-01-23 16:47:17 ----D---- C:\Users\hp\AppData\Roaming\Any Video Converter
2010-01-23 15:43:56 ----D---- C:\TEMP
2010-01-22 21:12:19 ----D---- C:\Users\hp\AppData\Roaming\dvdcss
2010-01-22 15:01:08 ----D---- C:\Windows\system32\migration
2010-01-22 15:01:04 ----D---- C:\Program Files\Internet Explorer
2010-01-17 12:44:48 ----D---- C:\Program Files\Windows Mail
2010-01-17 10:45:08 ----D---- C:\Users\hp\AppData\Roaming\HpUpdate
2010-01-17 10:31:32 ----D---- C:\ProgramData\Ashampoo
2010-01-17 10:30:48 ----D---- C:\ProgramData\page
2010-01-16 15:00:08 ----D---- C:\Windows\Debug
2010-01-16 14:44:54 ----D---- C:\Users\hp\AppData\Roaming\Hamachi
2010-01-15 18:01:54 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-03-19 107256]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-03-19 113960]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-03-19 131976]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-03-19 38240]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2007-03-28 140424]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2008-03-03 188416]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-03-19 33096]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-07 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-11-21 11515752]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-17 12032]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 aei59csr;aei59csr; C:\Windows\system32\drivers\aei59csr.sys []
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2007-04-18 79664]
S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2007-04-18 81200]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-04-18 16432]
S3 catchme;catchme; \??\C:\Users\hp\AppData\Local\Temp\catchme.sys []
S3 Dot4;Ovladač MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-01-15 25280]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-04-12 160768]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASBroker;Logon Session Broker; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 ASChannel;Local Communication Channel; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 DfSdkS;Defragmentation-Service; D:\Ashampoo WinOptimizer 2010 Advanced\DfsdkS.exe [2009-08-24 406016]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-03-19 731840]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-11-20 122984]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-12-04 75064]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-03-19 20680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-02-12 880640]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-02-17 74656]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-02-26 267824]

-----------------EOF-----------------

[motji]

Dobrý večer

arrow: Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[stancoj]

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3732
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

13.2.2010 15:06:22
mbam-log-2010-02-13 (15-06-22).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|E:\|F:\|)
Zkontrolované objekty: 308821
Uplynulý čas: 52 minute(s), 29 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

[motji]

Jak často Vám mrzne?

[stancoj]

nieco okolo 1,5 hod. potom musim natvrdo vypnut a zasa.

[motji]

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

[stancoj]

je kompatibilny s win vista?

[motji]

Ano

[stancoj]

ComboFix 10-02-12.01 - hp 13.02.2010 22:27:45.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2046.1378 [GMT 1:00]
Spuštěný z: c:\users\hp\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2179285541-3270822918-3895208942-500
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-13 do 2010-02-13 )))))))))))))))))))))))))))))))
.

2010-02-13 21:36 . 2010-02-13 21:41 -------- d-----w- c:\users\hp\AppData\Local\temp
2010-02-13 21:36 . 2010-02-13 21:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-13 21:36 . 2010-02-13 21:36 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-02-13 14:36 . 2010-02-13 14:36 -------- d-----w- C:\rsit
2010-02-13 14:36 . 2010-02-13 14:36 -------- d-----w- c:\program files\trend micro
2010-02-13 09:06 . 2009-12-08 20:01 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-13 09:06 . 2009-12-08 20:01 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-12 21:59 . 2010-02-12 21:59 -------- d-----w- c:\windows\system32\QuickTime
2010-02-12 19:12 . 2010-02-12 19:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-12 19:11 . 2010-02-12 19:14 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-12 19:09 . 2009-11-21 02:34 11515752 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-02-12 19:09 . 2009-11-21 02:34 76392 ----a-w- c:\windows\system32\OpenCL.dll
2010-02-12 19:09 . 2009-11-21 02:34 4241000 ----a-w- c:\windows\system32\nvwgf2um.dll
2010-02-12 19:09 . 2009-11-21 02:34 9333352 ----a-w- c:\windows\system32\nvd3dum.dll
2010-02-12 19:09 . 2009-11-21 02:34 2243176 ----a-w- c:\windows\system32\nvcuvid.dll
2010-02-12 19:09 . 2009-11-21 02:34 1989224 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-02-12 19:09 . 2009-11-21 02:34 14064232 ----a-w- c:\windows\system32\nvoglv32.dll
2010-02-12 19:09 . 2009-11-21 02:34 4001384 ----a-w- c:\windows\system32\nvcuda.dll
2010-02-12 19:09 . 2009-11-21 02:34 182888 ----a-w- c:\windows\system32\nvcod178.dll
2010-02-12 19:09 . 2009-11-21 02:34 182888 ----a-w- c:\windows\system32\nvcod.dll
2010-02-12 19:09 . 2009-11-21 02:34 11381352 ----a-w- c:\windows\system32\nvcompiler.dll
2010-02-11 12:10 . 2009-12-04 18:29 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-02-11 12:10 . 2009-12-04 18:30 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-02-11 12:10 . 2009-12-04 18:28 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-02-11 12:10 . 2009-12-04 18:28 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-02-11 12:10 . 2009-12-04 18:28 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-02-11 12:10 . 2009-12-04 18:28 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-02-11 12:10 . 2009-12-04 18:28 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-02-11 12:10 . 2009-12-04 18:28 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-02-11 12:10 . 2009-12-04 18:27 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-02-11 11:45 . 2009-12-11 11:43 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-11 11:45 . 2009-12-11 11:43 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-11 11:44 . 2009-12-04 15:56 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-11 11:44 . 2009-12-04 15:56 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-11 11:43 . 2009-12-08 20:01 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-11 11:43 . 2009-12-08 17:26 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2010-02-10 19:51 . 2010-02-12 20:26 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-02-09 17:57 . 2010-02-09 17:57 -------- d-----w- c:\users\hp\AppData\Roaming\NASA
2010-02-09 14:46 . 2010-02-09 14:46 -------- d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-02-09 14:42 . 2010-02-12 20:26 -------- d-----w- c:\programdata\TuneUp Software
2010-01-19 19:37 . 2010-01-19 19:37 -------- d-----w- c:\users\hp\AppData\Roaming\TuneUp Software
2010-01-15 17:06 . 2010-01-15 17:06 -------- d-----w- c:\program files\Conduit
2010-01-15 17:06 . 2010-01-17 11:20 -------- d-----w- c:\program files\Local_Strike
2010-01-15 16:41 . 2010-01-15 16:41 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-01-15 15:04 . 2010-01-15 15:04 -------- d-----w- c:\users\hp\AppData\Roaming\Malwarebytes
2010-01-15 15:04 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-15 15:04 . 2010-01-15 15:04 -------- d-----w- c:\programdata\Malwarebytes
2010-01-15 15:04 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 14:56 . 2010-02-07 13:23 -------- d-----w- c:\users\hp\AppData\Roaming\skypePM
2010-01-15 14:54 . 2010-02-07 13:30 -------- d-----w- c:\users\hp\AppData\Roaming\Skype
2010-01-15 14:53 . 2010-01-15 14:53 -------- d-----w- c:\program files\Common Files\Skype
2010-01-15 14:52 . 2010-01-15 14:53 -------- d-----r- c:\program files\Skype
2010-01-15 14:52 . 2010-01-15 14:52 -------- d-----w- c:\programdata\Skype
2010-01-15 14:40 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-15 14:40 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 21:41 . 2009-10-09 18:02 70610 ----a-w- c:\programdata\nvModes.dat
2010-02-13 21:37 . 2009-02-16 23:13 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-13 21:32 . 2007-01-08 21:09 598838 ----a-w- c:\windows\system32\perfh005.dat
2010-02-13 21:32 . 2007-01-08 21:09 115014 ----a-w- c:\windows\system32\perfc005.dat
2010-02-13 15:51 . 2009-03-30 14:05 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-13 15:51 . 2009-03-30 14:05 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-13 09:28 . 2009-10-17 21:48 -------- d-----w- c:\program files\Crawler
2010-02-12 19:16 . 2009-03-26 20:27 -------- d-----w- c:\programdata\NVIDIA
2010-02-12 19:12 . 2009-10-03 12:41 -------- d-----w- c:\program files\AGEIA Technologies
2010-02-09 14:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-02-01 18:33 . 2009-02-15 23:30 100712 ----a-w- c:\users\hp\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-23 15:47 . 2009-10-10 07:50 -------- d-----w- c:\users\hp\AppData\Roaming\Any Video Converter
2010-01-22 20:12 . 2009-07-09 21:09 -------- d-----w- c:\users\hp\AppData\Roaming\dvdcss
2010-01-17 11:44 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-17 09:45 . 2009-10-18 09:05 -------- d-----w- c:\users\hp\AppData\Roaming\HpUpdate
2010-01-17 09:31 . 2009-09-04 17:01 -------- d-----w- c:\programdata\Ashampoo
2010-01-17 09:30 . 2009-10-11 10:18 -------- d-----w- c:\programdata\page
2010-01-16 13:44 . 2009-06-11 17:05 -------- d-----w- c:\users\hp\AppData\Roaming\Hamachi
2010-01-15 17:01 . 2007-06-20 09:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-15 14:56 . 2010-01-15 14:56 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-01-14 10:12 . 2009-10-03 12:27 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-22 12:59 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 12:59 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-01-22 12:59 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-01-22 12:59 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-04 13:02 . 2009-03-30 14:05 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-12-03 09:49 . 2009-12-03 09:48 78204 ----a-w- c:\windows\hpqins05.dat
2009-12-03 09:40 . 2009-12-03 09:41 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-21 02:34 . 2008-12-04 01:42 592488 ----a-w- c:\windows\system32\nvudisp.exe
2009-11-21 02:34 . 2008-12-04 01:42 1249896 ----a-w- c:\windows\system32\nvapi.dll
2009-11-20 19:33 . 2009-11-20 19:33 87144 ----a-w- c:\windows\system32\nvhotkey.dll
2009-11-20 19:33 . 2009-11-20 19:33 812648 ----a-w- c:\windows\system32\nvsvc.dll
2009-11-20 19:33 . 2009-11-20 19:33 66664 ----a-w- c:\windows\system32\nvshext.dll
2009-11-20 19:33 . 2009-11-20 19:33 1323624 ----a-w- c:\windows\system32\nvsvcr.dll
2009-11-20 19:33 . 2009-11-20 19:33 12685928 ----a-w- c:\windows\system32\nvcpl.dll
2009-11-20 19:33 . 2009-11-20 19:33 122984 ----a-w- c:\windows\system32\nvvsvc.exe
2009-11-20 19:33 . 2009-11-20 19:33 110184 ----a-w- c:\windows\system32\nvmctray.dll
2009-11-19 20:42 . 2009-10-09 17:58 592488 ----a-w- c:\windows\system32\nvuninst.exe
2009-11-19 10:48 . 2009-12-01 14:32 872960 ----a-w- c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-19 10:48 . 2009-12-01 14:32 43008 ----a-w- c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-12-01 14:32 340480 ----a-w- c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-12-01 14:32 346624 ----a-w- c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoc1.dll" [2010-01-17 2166296]

[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
2010-01-17 11:21 2166296 ----a-w- c:\program files\Local_Strike\tbLoc1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoc1.dll" [2010-01-17 2166296]

[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C650B7D-AA32-4798-AF1A-FD8EF806D89F}"= "c:\program files\Local_Strike\tbLoc1.dll" [2010-01-17 2166296]

[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 17920]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-03-19 2029640]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,64,86,51,a5,28,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1772001885-842767137-95017056-1000]
"EnableNotificationsRef"=dword:00000001

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [19.3.2009 10:44 107256]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [28.3.2009 15:08 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [28.3.2009 15:08 21504]
R2 DfSdkS;Defragmentation-Service;d:\ashampoo winoptimizer 2010 advanced\DfSdkS.exe [9.12.2009 18:02 406016]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [19.3.2009 10:44 731840]
R2 epfwwfp;epfwwfp;c:\windows\System32\drivers\epfwwfp.sys [19.3.2009 10:45 38240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.sk/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60076&qkw=
FF - component: c:\program files\Crawler\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 22:40
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8521A1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x883b4d24
\Driver\ACPI -> acpi.sys @ 0x80740d68
\Driver\atapi -> 0x8521a1f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1772001885-842767137-95017056-1000\Software\SecuROM\License information*]
"datasecu"=hex:ad,75,1f,e0,d6,c8,c6,8f,22,08,e2,1d,3f,81,df,94,ee,e8,61,4a,1c,
96,15,8b,b6,f5,4e,9a,2d,30,1a,58,84,10,5f,ff,5e,87,58,63,2b,46,45,8f,dc,b3,\
"rkeysecu"=hex:7f,a9,1b,21,6d,25,15,2b,aa,98,7b,fb,70,e7,ed,c7

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(2808)
c:\windows\system32\APSHook.dll
c:\program files\Bioscrypt\VeriSoft\Bin\ItClient.dll
c:\windows\system32\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-02-13 22:45:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-13 21:45

Před spuštěním: 1 495 871 488
Po spuštění: 1 224 208 384

- - End Of File - - 053C348EE024B7BE89450CFD6EC98AE5

[motji]

Jak to vypadá s počítačem ted?
Používáte Daemon nebo alcohol?

[stancoj]

deamon mam nainstalovany ale som ho velmi dlho nepouzival. este ma napadlo za som predvcerom instaloval nove ovladace na grafiku, mohlo by to s tym suvisiet?

[motji]

Je to možné .
Ještě pro jistotu:

odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC
- spusťte gmer


Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde

[stancoj]

uz idem spat lebo zajtra skoro vstavam, zajtra mozme pokracovat

[motji]

Já tu budu celý den nakukovat, mrknu pak na logy.
Dobrou noc

[stancoj]

GMER log cislo 1

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-02-13 23:41:28
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\hp\AppData\Local\Temp\pgldipoc.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread System [4:400] 86F92930

---- EOF - GMER 1.0.15 ----

GMER log cislo 2

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-14 00:05:17
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\hp\AppData\Local\Temp\pgldipoc.sys


---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[420] kernel32.dll!SetUnhandledExceptionFilter 7656A84F 4 Bytes [C2, 04, 00, 00]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [749A7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [749FA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [749ABB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7499F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [749A75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7499E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [749D8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [749ADA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7499FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7499FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [749971CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [74A2CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [749CC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7499D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74996853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7499687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2988] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [749A2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread System [4:400] 86F92930

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bbad005
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bbad005@001e45d5aa2d 0xB0 0x93 0xA5 0x4A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bbad005@001fe499e305 0x31 0x27 0x59 0xEC ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bbad005@00221566b75b 0x9B 0xAE 0xA9 0x1C ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bbad005@0023f1017e20 0x91 0xC3 0x83 0xBF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xC2 0x3C 0x26 0xA3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bbad005 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bbad005@001e45d5aa2d 0xB0 0x93 0xA5 0x4A ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bbad005@001fe499e305 0x31 0x27 0x59 0xEC ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bbad005@00221566b75b 0x9B 0xAE 0xA9 0x1C ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bbad005@0023f1017e20 0x91 0xC3 0x83 0xBF ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xC2 0x3C 0x26 0xA3 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOCC06.00.00.01WSSV 13E1904BC791F3C0A7DDB5C6FA44206BA2C0A1FB2834E7D50794105058FCD45AC26B1FC85546CD12AC7338610E20A133518BBAFC495DD9840A6F00E4AB89696E72F42ADA0AEC22879CD1C42E909BFC40A3F734733618B4978303F9C0028BAA64C7AE41761B7F24A30AE13F26B638CCEAB94CE6FA40919656BD8CE93D69F4DB91DB6E835977DA5AEE7AB21C8668DC7C8CA7EC3E71EC57710B79695079269F13D5BB2B26033BC0A1F767F5E75144D34D81716639FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407C038D530D6EB3452C038D530D6EB3452A8451BDF34AC7AEFB2F4EB7940166C23C20654EF545518C7B02EE3EE698F6E6941F808917DE1C8E900A164667EAD04B431CEAF4B4035273DD0112C167F89254F9D3FA38A7DC21F31B8120024A1124692D79FE8AEB59A3FCD801C7BB02521A379D4EE051F59010747F5995F6B9F0316B270694B561B72BA87BA7CE520500F5E2B4515AB773AC1AE4395C28B487032F922F7D285565B1C9909BF15641CFD80EEB70DEFF70ECD9FE64F3749EB9D13471EFE32B42C12E4EA018790FB532F2E9791891273AE35C2A9A62AC19C519E88DCCFFC249CB6C2AA28384BF67DF2B86368A79DFBC77A0E4F6008A5DDE2EC55D6030363184BFE79A30F2B2F7B9668EAA

---- EOF - GMER 1.0.15 ----