Stovka win32/Rootkit.Kryptik.AF

Zpráva

aanime · #1 Příspěvek od **aanime** » 16 dub 2010 14:43

Dobrý den, předevčírem jsem při skenu NODem objevil 10 x win32/Rootkit.Kryptik.AF výhradně v systémovém adresáři ovladačů. Od včerejška se jejich počet zvětšil přes stovku. Zatím se s PC nic radikálního neděje, jenom se pomaleji zapíná a vyhazuje okno s volbou poslední známé konfigurace, jenom mě dost vyděsil nárůst počtu těch trojanů. Díky za pomocné rady

Přikládám log z ComboFixu

Kód: Vybrat vše

ComboFix 10-04-15.02 - Lukáš 16.04.2010  11:50:48.2.2 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.420.1029.18.3067.2449 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

(((((((((((((((((((((((((   Soubory vytvořené od 2010-03-16 do 2010-04-16  )))))))))))))))))))))))))))))))
.

2010-04-16 09:18 . 2010-04-12 15:29	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-04-15 16:23 . 2008-04-13 22:10	34688	-c--a-w-	c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-15 16:23 . 2008-04-13 22:10	34688	----a-w-	c:\windows\system32\drivers\lbrtfdc.sys
2010-04-14 21:48 . 2010-04-14 21:48	--------	d-----w-	c:\program files\Total Uninstall 5
2010-04-13 15:54 . 2008-04-13 22:11	8576	-c--a-w-	c:\windows\system32\dllcache\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11	8576	----a-w-	c:\windows\system32\drivers\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11	8192	-c--a-w-	c:\windows\system32\dllcache\changer.sys
2010-04-13 15:54 . 2008-04-13 22:11	8192	----a-w-	c:\windows\system32\drivers\Changer.sys
2010-04-02 07:59 . 2010-04-02 07:59	--------	d-sh--w-	c:\documents and settings\LocalService\PrivacIE
2010-04-02 07:59 . 2010-04-02 07:59	--------	d-----r-	c:\documents and settings\LocalService\Oblíbené položky
2010-03-30 21:04 . 2010-03-30 21:04	--------	d-----w-	c:\program files\Common Files\Java
2010-03-30 18:17 . 2007-04-01 07:00	2842624	----a-w-	c:\temp\btwicons.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M výpis   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 09:55 . 2010-02-11 14:57	802304	----a-w-	c:\windows\system32\drivers\ttmvmbdi.sys
2010-04-16 09:18 . 2009-04-14 23:48	--------	d-----w-	c:\program files\Java
2010-04-16 09:17 . 2001-10-25 12:00	95892	----a-w-	c:\windows\system32\perfc005.dat
2010-04-16 09:17 . 2001-10-25 12:00	475970	----a-w-	c:\windows\system32\perfh005.dat
2010-04-14 21:50 . 2009-04-14 18:14	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-14 21:43 . 2009-04-14 17:56	--------	d-----w-	c:\program files\Windows Media Connect 2
2010-04-14 19:20 . 2009-04-14 22:41	--------	d-----w-	c:\program files\PowerArchiver
2010-03-23 22:09 . 2009-04-15 08:28	--------	d-----w-	c:\program files\Translator 2005
2010-03-10 06:17 . 2008-04-14 06:52	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-03-08 22:08 . 2010-03-08 22:03	--------	d-----w-	c:\program files\Microsoft SQL Server
2010-03-08 22:02 . 2010-03-08 22:02	--------	d-----w-	c:\program files\Microsoft Device Emulator
2010-03-08 22:02 . 2010-03-08 22:02	--------	d-----w-	c:\program files\Microsoft SQL Server 2005 Mobile Edition
2010-03-08 21:57 . 2010-03-08 21:49	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2010-03-08 21:57 . 2010-03-08 21:51	--------	d-----w-	c:\program files\HTML Help Workshop
2010-03-08 21:55 . 2010-03-08 21:51	--------	d-----w-	c:\program files\Common Files\Merge Modules
2010-03-08 21:51 . 2010-03-08 21:51	--------	d-----w-	c:\program files\Common Files\Business Objects
2010-03-08 21:51 . 2010-03-08 21:51	--------	d-----w-	c:\program files\CE Remote Tools
2010-02-25 06:18 . 2008-05-08 07:16	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-13 22:47	455680	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 20:15 . 2010-02-17 20:15	--------	d-----w-	c:\program files\Audacity 1.3. 9 Beta (Unicode)
2010-02-17 14:35 . 2010-02-17 14:35	--------	d-----w-	c:\program files\Common Files\Digidesign
2010-02-17 14:35 . 2010-02-17 14:35	--------	d-----w-	c:\program files\Audiffex
2010-02-17 14:34 . 2009-09-12 21:30	--------	d-----w-	c:\program files\Vstplugins
2010-02-16 19:08 . 2008-04-14 08:06	2026496	----a-w-	c:\windows\system32\ntkrnlpa.exe
2010-02-16 19:08 . 2008-04-14 06:06	2148352	----a-w-	c:\windows\system32\ntoskrnl.exe
2010-02-12 04:35 . 2008-04-14 06:51	100864	----a-w-	c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-13 22:30	226880	----a-w-	c:\windows\system32\drivers\tcpip6.sys
.

------- Sigcheck -------

[-] 2008-05-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((   SnapShot@2010-04-16_01.51.54   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-16 09:46 . 2010-04-16 09:46	16384              c:\windows\Temp\Perflib_Perfdata_6e8.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17	85288              c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43	85288              c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17	479398              c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43	479398              c:\windows\system32\perfh009.dat
+ 2010-04-16 09:18 . 2010-04-12 15:29	153376              c:\windows\system32\javaws.exe
- 2010-03-30 21:04 . 2010-03-09 02:28	153376              c:\windows\system32\javaws.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29	145184              c:\windows\system32\javaw.exe
- 2010-03-30 21:04 . 2010-03-09 02:28	145184              c:\windows\system32\javaw.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29	145184              c:\windows\system32\java.exe
- 2010-03-30 21:04 . 2010-03-09 02:28	145184              c:\windows\system32\java.exe
.
((((((((((((((((((((((((((((((((((   Spouštěcí body v registru   )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Bezpečnost" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-12 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk /r \??\F:\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-17 16:06	1848648	----a-w-	c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-10 16:20	689488	----a-w-	c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2008-06-09 22:36	870920	----a-w-	c:\progra~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52	1695232	------w-	c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50	155648	----a-r-	c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2010-02-22 09:40	207504	----a-w-	c:\menší programy\pdf24\pdf24.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-04-17 17:14	98304	----a-w-	c:\přehrávače\QuickTimePlayer\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Bezpečnost,síť\\QIP\\qip.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Vietcong\\vietcong_1.6_NO_CD_crack.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1234:UDP"= 1234:UDP:ab
"9875:UDP"= 9875:UDP:ac

R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.4.2009 20:07 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 10:04 735960]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [14.4.2009 21:24 51160]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [14.4.2009 21:24 43736]
S0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.4.2009 20:07 160640]
S2 gupdate1ca03409edf825e;Služba Google Update (gupdate1ca03409edf825e);c:\program files\Google\Update\GoogleUpdate.exe [13.7.2009 0:32 133104]
S3 DfuUsb;DfuUsb;c:\windows\system32\drivers\dfuusb.sys [8.11.2007 22:51 10880]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasusb.sys [27.12.2009 13:08 18432]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 8:01 2799808]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - ttmvmbdi
.
Obsah adresáře 'Naplánované úlohy'

2010-04-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 22:28]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator 2005\WEBIE.DLL
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\eh7m0i36.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("html5.enable", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************
skenování skrytých procesů ...  

skenování skrytých položek 'Po spuštění' ... 

skenování skrytých souborů ...  

sken byl úspešně dokončen
skryté soubory: 

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\ttmvmbdi]

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1085031214-842925246-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a6,26,de,95,4a,9b,6f,9f,f2,de,b2,98,e1,fa,62,ca,c4,e3,98,e6,67,9b,2d,
   69,1b,00,36,51,94,73,89,07,39,ce,5d,a1,46,57,c7,93,b4,71,05,f3,4d,ac,f7,90,\
"??"=hex:29,09,d2,a8,43,0c,17,31,e4,b9,9b,46,02,82,18,87
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1496)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(16712)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Celkový čas: 2010-04-16  11:57:14
ComboFix-quarantined-files.txt  2010-04-16 09:57
ComboFix2.txt  2010-04-16 01:57

Před spuštěním: Volných bajtů: 22 522 753 024
Po spuštění: Volných bajtů: 22 489 739 264

Current=7 Default=7 Failed=6 LastKnownGood=8 Sets=1,2,4,5,6,7,8
- - End Of File - - F3991BE37F7AB5179B57071D8CA2F978

#2 Příspěvek od **motji** » 16 dub 2010 15:21

Hezké odpoledne

nedávejte prosím logy do code, špatně se to čte. Díky

Dejte soubor otestovat na http://www.virustotal.com

c:\windows\system32\sfcfiles.dll
c:\temp\btwicons.dll
c:\windows\system32\drivers\ttmvmbdi.sys

-Na virustotalu dáte procházet, a do spodního okénka nakopírujete přímo cestu k souboru a dáte odeslat
-z prohlížeče zkopírujete adresu ke stránce s výsledky
-pokud se Vás zeptá, dejte soubor otestovat znovu, tak aby to byl soubor z Vašeho počítače

Tyto porty znáte?
"1234:UDP"= 1234:UDP:ab
"9875:UDP"= 9875:UDP:ac

aanime · #3 Příspěvek od **aanime** » 16 dub 2010 16:37

http://www.virustotal.com/cs/analisis/7 ... 1271431563
http://www.virustotal.com/cs/analisis/c ... 1271431717
Poslední soubor z cesty "c:\windows\system32\drivers\ttmvmbdi.sys" nelze nahrát - prohlížeč vyhodí hlášku "0 bytes size received / Se ha recibido un archivo vacio", přitom ten soubor velikost má..

Ty porty budou souviset s TV vysíláním přes internet,ale už je nepoužívám.

#4 Příspěvek od **motji** » 16 dub 2010 18:12

Ty porty Vám smažu, jestli Vám to nebude vadit

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

KillAll::
Collect::
c:\windows\system32\drivers\ttmvmbdi.sys

Driver::
ttmvmbdi

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1234:UDP"=-
"9875:UDP"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=-

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

ještě porposím o log ze Rsitu, viz můj podpis

aanime · #5 Příspěvek od **aanime** » 16 dub 2010 19:51

Log z ComboFix

ComboFix 10-04-15.02 - Lukáš 16.04.2010 20:29:23.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3067.2286 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lukáš\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

file zipped: c:\windows\system32\drivers\ttmvmbdi.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ttmvmbdi.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TTMVMBDI
-------\Service_ttmvmbdi

((((((((((((((((((((((((( Soubory vytvořené od 2010-03-16 do 2010-04-16 )))))))))))))))))))))))))))))))
.

2010-04-16 09:18 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 16:23 . 2008-04-13 22:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-15 16:23 . 2008-04-13 22:10 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-14 21:48 . 2010-04-14 21:48 -------- d-----w- c:\program files\Total Uninstall 5
2010-04-13 15:54 . 2008-04-13 22:11 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-03-30 21:04 . 2010-03-30 21:04 -------- d-----w- c:\program files\Common Files\Java
2010-03-30 18:17 . 2007-04-01 07:00 2842624 ----a-w- c:\temp\btwicons.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 09:18 . 2009-04-14 23:48 -------- d-----w- c:\program files\Java
2010-04-16 09:17 . 2001-10-25 12:00 95892 ----a-w- c:\windows\system32\perfc005.dat
2010-04-16 09:17 . 2001-10-25 12:00 475970 ----a-w- c:\windows\system32\perfh005.dat
2010-04-14 21:50 . 2009-04-14 18:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 21:43 . 2009-04-14 17:56 -------- d-----w- c:\program files\Windows Media Connect 2
2010-04-14 19:20 . 2009-04-14 22:41 -------- d-----w- c:\program files\PowerArchiver
2010-03-23 22:09 . 2009-04-15 08:28 -------- d-----w- c:\program files\Translator 2005
2010-03-10 06:17 . 2008-04-14 06:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-08 22:08 . 2010-03-08 22:03 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft Device Emulator
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft SQL Server 2005 Mobile Edition
2010-03-08 21:57 . 2010-03-08 21:49 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-08 21:57 . 2010-03-08 21:51 -------- d-----w- c:\program files\HTML Help Workshop
2010-03-08 21:55 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Merge Modules
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Business Objects
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\CE Remote Tools
2010-02-25 06:18 . 2008-05-08 07:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-13 22:47 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 20:15 . 2010-02-17 20:15 -------- d-----w- c:\program files\Audacity 1.3. 9 Beta (Unicode)
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Common Files\Digidesign
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Audiffex
2010-02-17 14:34 . 2009-09-12 21:30 -------- d-----w- c:\program files\Vstplugins
2010-02-16 19:08 . 2008-04-14 08:06 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 19:08 . 2008-04-14 06:06 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-12 04:35 . 2008-04-14 06:51 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-13 22:30 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys
[-] 2008-04-13 22:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

[-] 2008-05-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-04-16_01.51.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-16 18:34 . 2010-04-16 18:34 16384 c:\windows\temp\Perflib_Perfdata_540.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 85288 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 85288 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 479398 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 479398 c:\windows\system32\perfh009.dat
+ 2010-04-16 09:18 . 2010-04-12 15:29 153376 c:\windows\system32\javaws.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 153376 c:\windows\system32\javaws.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\javaw.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\javaw.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\java.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\java.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-12 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\F:\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-17 16:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-10 16:20 689488 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2008-06-09 22:36 870920 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2010-02-22 09:40 207504 ----a-w- c:\menší programy\pdf24\pdf24.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-04-17 17:14 98304 ----a-w- c:\přehrávače\QuickTimePlayer\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Bezpečnost,síť\\QIP\\qip.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Vietcong\\vietcong_1.6_NO_CD_crack.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.4.2009 20:07 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.4.2009 20:07 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 10:04 735960]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [14.4.2009 21:24 51160]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [14.4.2009 21:24 43736]
S2 gupdate1ca03409edf825e;Služba Google Update (gupdate1ca03409edf825e);c:\program files\Google\Update\GoogleUpdate.exe [13.7.2009 0:32 133104]
S3 DfuUsb;DfuUsb;c:\windows\system32\drivers\dfuusb.sys [8.11.2007 22:51 10880]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasusb.sys [27.12.2009 13:08 18432]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 8:01 2799808]
.
Obsah adresáře 'Naplánované úlohy'

2010-04-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 22:28]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator 2005\WEBIE.DLL
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\eh7m0i36.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("html5.enable", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-16 20:34
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8AD44C70]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f57cb8
\Driver\atapi -> 0x8ad44c70
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel(R) Wireless WiFi Link 5100 -> SendCompleteHandler -> NDIS.sys @ 0xb9c93bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9ca0a21
SendHandler -> NDIS.sys @ 0xb9c7e87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1085031214-842925246-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a6,26,de,95,4a,9b,6f,9f,f2,de,b2,98,e1,fa,62,ca,c4,e3,98,e6,67,9b,2d,
69,1b,00,36,51,94,73,89,07,39,ce,5d,a1,46,57,c7,93,b4,71,05,f3,4d,ac,f7,90,\
"??"=hex:29,09,d2,a8,43,0c,17,31,e4,b9,9b,46,02,82,18,87
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1520)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(6104)
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\matlab7\webserver\bin\win32\matlabserver.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\matlab7\bin\win32\matlab.exe
c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\docume~1\LUK~1\LOCALS~1\Temp\RtkBtMnt.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-04-16 20:40:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-16 18:40
ComboFix2.txt 2010-04-16 09:57
ComboFix3.txt 2010-04-16 01:57

Před spuštěním: Volných bajtů: 22 545 805 312
Po spuštění: Volných bajtů: 22 509 985 792

- - End Of File - - 9CB1E438B94591BB84372A20071996F2

Log z RSIT

info.txt logfile of random's system information tool 1.06 2010-04-16 20:48:26

======Uninstall list======

-->MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
-->MsiExec /X{65F1CF63-31E0-450B-96F3-4A88BE7361A6}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acer Crystal Eye webcam Ver:1.1.57.409-->C:\Program Files\InstallShield Installation Information\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}\setup.exe -runfromtemp -l0x0009 -removeonly
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A81200000003}
Adobe Shockwave Player 11.5-->C:\WINDOWS\system32\Adobe\uninstaller.exe
AGEIA PhysX v7.07.09-->MsiExec.exe /X{65F1CF63-31E0-450B-96F3-4A88BE7361A6}
Ahead Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Aktualizace systému Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Aktualizace systému Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Aktualizace systému Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Aktualizace systému Windows Internet Explorer 8 (KB980182)-->"C:\WINDOWS\ie8updates\KB980182-IE8\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Aktualizace zabezpečení produktu Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aktualizace zabezpečení systému Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Audacity 1.3.9 (Unicode)-->"C:\Program Files\Audacity 1.3. 9 Beta (Unicode)\unins000.exe"
Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{A64A5576-D862-44F8-89DC-2B17FCC9B86E}
BSPlayer-->"C:\Přehrávače\BSplayer\uninstall.exe"
Canon MP Navigator EX 2.0-->"C:\Program Files\Canon\MP Navigator EX 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator EX 2.0\uninst.ini
Canon MP540 series MP Drivers-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series /L0x0005
Canon Utilities Easy-PhotoPrint EX-->C:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe uninst.ini
Canon Utilities My Printer-->C:\Program Files\Canon\MyPrinter\uninst.exe uninst.ini
Canon Utilities Solution Menu-->C:\Program Files\Canon\SolutionMenu\uninst.exe uninst.ini
Catalyst Control Center - Branding-->MsiExec.exe /I{2BA2F736-7663-4C76-9425-40890A46F995}
Counter-Strike 1.6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{13B792AA-C078-43A4-8A3A-8B12D629940D}\Setup.exe" -l0x19
DeepBurner v1.8.0.224-->"C:\Program Files\Astonsoft\DeepBurner\Uninstall.exe" "C:\Program Files\Astonsoft\DeepBurner\install.log"
Důležitá aktualizace aplikace Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
EarMaster Pro 5-->"C:\Program Files\EarMaster Pro 5\unins000.exe"
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
Free Video Flip and Rotate version 1.4-->"C:\Program Files\DVDVideoSoft\Free Video Flip and Rotate\unins000.exe"
GK Amplification Demo 1.0.5-->"C:\Program Files\Audiffex\GK Amplification Demo\unins000.exe"
Google Earth-->MsiExec.exe /X{2EAF7E61-068E-11DF-953C-005056806466}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe"
Half-Life-->C:\PROGRA~1\HALF-L~1\UNWISE.EXE C:\PROGRA~1\HALF-L~1\INSTALL.LOG
Hamachi 1.0.2.5-->C:\Program Files\Hamachi\uninstall.exe
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118\UIU32m.exe -U -IAcZUnM5k.inf
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012F0}
Java(TM) 6 Update 20-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
K-Lite Codec Pack 4.7.0 (Standard)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Last.fm 1.5.4.24567-->"C:\Program Files\Last.fm\unins000.exe"
Launch Manager-->C:\WINDOWS\UNINST32.EXE LManager.UNI
Lexicon Alpha ASIO (remove only)-->C:\Program Files\Lexicon\Alpha\AlphaUNInstaller.exe
Lexicon Pantheon VST Plug-in (remove only)-->C:\Program Files\Lexicon\Lexicon Pantheon VST Plug-inUNInstaller.exe
MATLAB Family of Products Release 14-->C:\MATLAB7\uninstall\uninstall.exe C:\MATLAB7\
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Device Emulator version 1.0 - ENU-->MsiExec.exe /X{78B75C6D-E53C-424C-BF83-4B63BD4A6682}
Microsoft Document Explorer 2005-->C:\Program Files\Common Files\Microsoft Shared\Help 8\Microsoft Document Explorer 2005\install.exe
Microsoft Document Explorer 2005-->MsiExec.exe /X{44D4AF75-6870-41F5-9181-662EA05507E1}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110405-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)-->MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
Microsoft SQL Server 2005 Mobile [ENU] Developer Tools-->MsiExec.exe /X{1389C6A4-4965-4AEC-9175-08B54A10FA48}
Microsoft SQL Server 2005 Tools Express Edition-->MsiExec.exe /I{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}
Microsoft SQL Server 2005-->"C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{BF251EAF-8697-4E89-BF09-C998F97BBC40}
Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{1CBE3804-20DF-48DA-B048-895C206E80A5}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual J# 2.0 Redistributable Package-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package\install.exe
Microsoft Visual Studio 2005 Professional Edition - ENU-->C:\Program Files\Microsoft Visual Studio 8\Microsoft Visual Studio 2005 Professional Edition - ENU\setup.exe
MixMeister BPM Analyzer 1.0-->"C:\Menší programy\MixMeister BPM Analyzer\unins000.exe"
Mp3tag v2.42-->C:\Menší programy\Mp3tag\Mp3tagUninstall.EXE
MSXML 6.0 Parser-->MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}
MV2Player (remove only)-->C:\Přehrávače\Mv2Player\uninst.exe
Notebook BatteryInfo -->"C:\Menší programy\BatteryInfo\uninstall.exe"
O2Micro Flash Memory Card Reader Driver (x86)-->MsiExec.exe /X{548AF5C1-54E3-4B74-A3E5-D5E6CB7D487C}
Oprava hotfix aplikace Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
PDF24 Creator-->"C:\Menší programy\pdf24\unins000.exe"
PowerArchiver 2010 Czech-->MsiExec.exe /I{E72D7025-339A-431E-8CF4-41807660911B}
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x5 -removeonly
Recuva-->"C:\Menší programy\Recuva\uninst.exe"
Registrace uživatele zařízení Canon MP540 series-->C:\Program Files\Canon\IJEREG\MP540 series\UNINST.EXE
RemoveIT Pro v4 - SE-->C:\PROGRA~1\INCODE~1\REMOVE~1\UNWISE.EXE C:\PROGRA~1\INCODE~1\REMOVE~1\INSTALL.LOG
Sada Compatibility Pack pro systém Office 2007-->MsiExec.exe /X{90120000-0020-0405-0000-0000000FF1CE}
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Softarová utilita ATI - Odinstalovat-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
Sony ACID Music Studio 7.0-->MsiExec.exe /X{A74C1699-4BCE-433F-82D6-F11207A0581B}
Sothink FLV Player-->"C:\Program Files\Common Files\SourceTec\Sothink FLV Player\unins000.exe"
Steinberg Cubase LE 4-->MsiExec.exe /I{AB3C4AC6-C401-4132-A8B5-265899A9C0E8}
Syncrosoft License Control-->C:\PROGRA~1\SYNCRO~1\UNWISE.EXE C:\PROGRA~1\SYNCRO~1\INSTALL.LOG
Total Commander (Remove or Repair)-->C:\Menší programy\totalcmd\tcuninst.exe
Total Uninstall 5.6.0-->"C:\Program Files\Total Uninstall 5\unins000.exe"
Uninstall 1.0.0.0-->"C:\Program Files\Common Files\DVDVideoSoft\unins000.exe"
Unreal Tournament 2003-->C:\Program Files\UT 2003\System\Setup.exe uninstall "UT2003"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vietcong-->C:\Program Files\Vietcong\Uninstall.exe
VUPlayer-->"C:\Přehrávače\VUPlayer\Uninstall.exe"
Vypnutí PC-->C:\WINDOWS\st6unst.exe -n "C:\Menší programy\Vypnutí PC\ST6UNST.LOG"
Web Translator-->C:\WINDOWS\XXLGS\UN32.EXE
WIDCOMM Bluetooth Software-->MsiExec.exe /X{84814E6B-2581-46EC-926A-823BD1C670F6}
Winamp-->"C:\Přehrávače\Winamp\UninstWA.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"

======Security center information======

AV: ESET Smart Security 4.0
FW: ESET personal firewall

======System event log======

Computer Name: LUKAS
Event Code: 7036
Message: Stav služby Služba rozpoznávání pomocí protokolu SSDP byl změněn na: Spuštěno

Record Number: 23784
Source Name: Service Control Manager
Time Written: 20100306140956.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 7035
Message: Řídící příkaz Spuštěno byl službě Služba rozpoznávání pomocí protokolu SSDP úspěšně odeslán.

Record Number: 23783
Source Name: Service Control Manager
Time Written: 20100306140955.000000+060
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: LUKAS
Event Code: 7036
Message: Stav služby Služba modelu COM pro zápis na disk CD (IMAPI) byl změněn na: Spuštěno

Record Number: 23782
Source Name: Service Control Manager
Time Written: 20100306140952.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 7035
Message: Řídící příkaz Spuštěno byl službě Služba modelu COM pro zápis na disk CD (IMAPI) úspěšně odeslán.

Record Number: 23781
Source Name: Service Control Manager
Time Written: 20100306140952.000000+060
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: LUKAS
Event Code: 7036
Message: Stav služby Služba brány aplikačního rozhraní byl změněn na: Spuštěno

Record Number: 23780
Source Name: Service Control Manager
Time Written: 20100306140943.000000+060
Event Type: Informace
User:

=====Application event log=====

Computer Name: LUKAS
Event Code: 17663
Message: Server name is 'LUKAS\SQLEXPRESS'. This is an informational message only. No user action is required.

Record Number: 6975
Source Name: MSSQL$SQLEXPRESS
Time Written: 20100310152058.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 17137
Message: Starting up database 'model'.

Record Number: 6974
Source Name: MSSQL$SQLEXPRESS
Time Written: 20100310152058.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 17137
Message: Starting up database 'mssqlsystemresource'.

Record Number: 6973
Source Name: MSSQL$SQLEXPRESS
Time Written: 20100310152058.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 19030
Message: SQL Trace ID 1 was started by login "sa".

Record Number: 6972
Source Name: MSSQL$SQLEXPRESS
Time Written: 20100310152058.000000+060
Event Type: Informace
User:

Computer Name: LUKAS
Event Code: 3454
Message: Recovery is writing a checkpoint in database 'master' (1). This is an informational message only. No user action is required.

Record Number: 6971
Source Name: MSSQL$SQLEXPRESS
Time Written: 20100310152058.000000+060
Event Type: Informace
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Microsoft SQL Server\90\Tools\binn;C:\MATLAB7\bin\win32;
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"VS80COMNTOOLS"=C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\

-----------------EOF-----------------

#6 Příspěvek od **motji** » 16 dub 2010 19:57

Použijte ještě jeden skript s tímto textem

Kód: Vybrat vše

Restore::
c:\windows\system32\drivers\atapi.sys

aanime · #7 Příspěvek od **aanime** » 17 dub 2010 10:29

Vypadá to, že je vše v pořádku. Moc děkuji za vyřešení problému, hezký den

#8 Příspěvek od **motji** » 17 dub 2010 10:39

Počkejte, neutíkejte mi, ještě jsme neskončili

.
Poprosím o log z combofixu po aplikaci toho skriptu, musím zkontrolovat, zda výměna toho systémového souboru proběhla v pořádku

aanime · #9 Příspěvek od **aanime** » 17 dub 2010 12:20

ComboFix 10-04-15.05 - Lukáš 17.04.2010 13:12:17.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3067.2515 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-03-17 do 2010-04-17 )))))))))))))))))))))))))))))))
.

2010-04-16 18:47 . 2010-04-16 18:48 -------- d-----w- C:\rsit
2010-04-16 18:47 . 2010-04-16 18:48 -------- d-----w- c:\program files\trend micro
2010-04-16 09:18 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 16:23 . 2008-04-13 22:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-04-15 16:23 . 2008-04-13 22:10 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-04-14 21:48 . 2010-04-14 21:48 -------- d-----w- c:\program files\Total Uninstall 5
2010-04-13 15:54 . 2008-04-13 22:11 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-04-13 15:54 . 2008-04-13 22:11 8192 ----a-w- c:\windows\system32\drivers\Changer.sys
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-04-02 07:59 . 2010-04-02 07:59 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-03-30 21:04 . 2010-03-30 21:04 -------- d-----w- c:\program files\Common Files\Java
2010-03-30 18:17 . 2007-04-01 07:00 2842624 ----a-w- c:\temp\btwicons.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 09:18 . 2009-04-14 23:48 -------- d-----w- c:\program files\Java
2010-04-16 09:17 . 2001-10-25 12:00 95892 ----a-w- c:\windows\system32\perfc005.dat
2010-04-16 09:17 . 2001-10-25 12:00 475970 ----a-w- c:\windows\system32\perfh005.dat
2010-04-14 21:50 . 2009-04-14 18:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 21:43 . 2009-04-14 17:56 -------- d-----w- c:\program files\Windows Media Connect 2
2010-04-14 19:20 . 2009-04-14 22:41 -------- d-----w- c:\program files\PowerArchiver
2010-03-23 22:09 . 2009-04-15 08:28 -------- d-----w- c:\program files\Translator 2005
2010-03-10 06:17 . 2008-04-14 06:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-08 22:08 . 2010-03-08 22:03 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft Device Emulator
2010-03-08 22:02 . 2010-03-08 22:02 -------- d-----w- c:\program files\Microsoft SQL Server 2005 Mobile Edition
2010-03-08 21:57 . 2010-03-08 21:49 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-08 21:57 . 2010-03-08 21:51 -------- d-----w- c:\program files\HTML Help Workshop
2010-03-08 21:55 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Merge Modules
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\Common Files\Business Objects
2010-03-08 21:51 . 2010-03-08 21:51 -------- d-----w- c:\program files\CE Remote Tools
2010-02-25 06:18 . 2008-05-08 07:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-13 22:47 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 20:15 . 2010-02-17 20:15 -------- d-----w- c:\program files\Audacity 1.3. 9 Beta (Unicode)
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Common Files\Digidesign
2010-02-17 14:35 . 2010-02-17 14:35 -------- d-----w- c:\program files\Audiffex
2010-02-17 14:34 . 2009-09-12 21:30 -------- d-----w- c:\program files\Vstplugins
2010-02-16 19:08 . 2008-04-14 08:06 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 19:08 . 2008-04-14 06:06 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-12 04:35 . 2008-04-14 06:51 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-13 22:30 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

------- Sigcheck -------

[-] 2008-05-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-04-16_01.51.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-17 11:05 . 2010-04-17 11:05 16384 c:\windows\temp\Perflib_Perfdata_500.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 85288 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 85288 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2010-04-16 09:17 479398 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2010-04-10 09:43 479398 c:\windows\system32\perfh009.dat
+ 2010-04-16 09:18 . 2010-04-12 15:29 153376 c:\windows\system32\javaws.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 153376 c:\windows\system32\javaws.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\javaw.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\javaw.exe
+ 2010-04-16 09:18 . 2010-04-12 15:29 145184 c:\windows\system32\java.exe
- 2010-03-30 21:04 . 2010-03-09 02:28 145184 c:\windows\system32\java.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-12 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\F:\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-17 16:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-03-10 16:20 689488 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2008-06-09 22:36 870920 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2010-02-22 09:40 207504 ----a-w- c:\menší programy\pdf24\pdf24.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-04-17 17:14 98304 ----a-w- c:\přehrávače\QuickTimePlayer\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Bezpečnost,síť\\QIP\\qip.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Vietcong\\vietcong_1.6_NO_CD_crack.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [17.4.2009 20:07 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 10:04 735960]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [14.4.2009 21:24 51160]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [14.4.2009 21:24 43736]
S0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [17.4.2009 20:07 160640]
S2 gupdate1ca03409edf825e;Služba Google Update (gupdate1ca03409edf825e);c:\program files\Google\Update\GoogleUpdate.exe [13.7.2009 0:32 133104]
S3 DfuUsb;DfuUsb;c:\windows\system32\drivers\dfuusb.sys [8.11.2007 22:51 10880]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasusb.sys [27.12.2009 13:08 18432]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 8:01 2799808]
.
Obsah adresáře 'Naplánované úlohy'

2010-04-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-12 22:28]

2010-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]

2010-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-12 22:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator 2005\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator 2005\WEBIE.DLL
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\eh7m0i36.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\bezpeźnost,sˇś\firefox\greprefs\all.js - pref("html5.enable", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\bezpeźnost,sˇś\firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\bezpeźnost,sˇś\firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-17 13:16
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1085031214-842925246-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a6,26,de,95,4a,9b,6f,9f,f2,de,b2,98,e1,fa,62,ca,c4,e3,98,e6,67,9b,2d,
69,1b,00,36,51,94,73,89,07,39,ce,5d,a1,46,57,c7,93,b4,71,05,f3,4d,ac,f7,90,\
"??"=hex:29,09,d2,a8,43,0c,17,31,e4,b9,9b,46,02,82,18,87
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1488)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-04-17 13:18:30
ComboFix-quarantined-files.txt 2010-04-17 11:18
ComboFix2.txt 2010-04-16 19:21
ComboFix3.txt 2010-04-16 18:40
ComboFix4.txt 2010-04-16 09:57
ComboFix5.txt 2010-04-17 11:06

Před spuštěním: Volných bajtů: 22 443 749 376
Po spuštění: Volných bajtů: 22 404 595 712

- - End Of File - - 20ED9FABA34EFFC3D654D5BBAD7D1952

#10 Příspěvek od **motji** » 17 dub 2010 12:56

Vy jste znovu spustil combofix? Já chtěla ten log po aplikaci skriptu

. Nevadí, vypadá to, že je čisto

Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.

***********

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir

***********

Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázek

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázek

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy

ok

zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.

***********

Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech

***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?

aanime · #11 Příspěvek od **aanime** » 17 dub 2010 13:57

Logfile of random's system information tool 1.06 (written by random/random)
Run by Lukáš at 2010-04-17 14:53:46
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 25 GB (42%) free of 60 GB
Total RAM: 3067 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:54:09, on 17.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\MATLAB7\webserver\bin\win32\matlabserver.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\DOCUME~1\LUK~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Lukáš\Plocha\RSIT.exe
C:\Program Files\trend micro\Lukáš.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Program Files\Translator 2005\WEBIE.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Program Files\Translator 2005\WEBIE.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\Translator 2005\WEBIE.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} (Java Plug-in 1.6.0_19) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate1ca03409edf825e) (gupdate1ca03409edf825e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)

--
End of file - 7349 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Program Files\Translator 2005\WEBIE.DLL [2009-04-15 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-13 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Program Files\Translator 2005\WEBIE.DLL [2009-04-15 360448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-16 16862720]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-07-13 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2008-03-17 1848648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2008-03-10 689488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\PROGRA~1\LAUNCH~1\LManager.exe [2008-06-10 870920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
C:\Menší programy\pdf24\pdf24.exe [2010-02-22 207504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\přehrávače\QuickTimePlayer\qttask.exe [2009-04-17 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2007-04-01 568176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-04-30 126976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-08 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Bezpečnost,síť\QIP\qip.exe"="C:\Bezpečnost,síť\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\Vietcong\vietcong_1.6_NO_CD_crack.exe"="C:\Program Files\Vietcong\vietcong_1.6_NO_CD_crack.exe:*:Enabled:vietcong_1.6_NO_CD_crack"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-04-17 14:53:46 ----D---- C:\rsit
2010-04-17 14:46:17 ----SHD---- C:\RECYCLER
2010-04-16 20:47:38 ----D---- C:\Program Files\trend micro
2010-04-16 20:31:41 ----D---- C:\WINDOWS\temp
2010-04-16 11:18:24 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-04-16 11:18:23 ----A---- C:\WINDOWS\system32\javaws.exe
2010-04-16 11:18:23 ----A---- C:\WINDOWS\system32\javaw.exe
2010-04-16 11:18:23 ----A---- C:\WINDOWS\system32\java.exe
2010-04-15 19:39:43 ----A---- C:\Boot.bak
2010-04-15 19:39:35 ----RASHD---- C:\cmdcons
2010-04-14 23:48:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\Martau
2010-04-14 23:48:48 ----D---- C:\Program Files\Total Uninstall 5
2010-04-14 14:03:33 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-14 14:03:23 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-14 14:01:19 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-14 14:01:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-14 14:01:04 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-14 14:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-03-30 23:04:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-03-30 23:04:30 ----D---- C:\Program Files\Common Files\Java
2010-03-24 00:33:25 ----A---- C:\WINDOWS\wcx_ftp.ini

======List of files/folders modified in the last 1 months======

2010-04-17 14:53:15 ----D---- C:\WINDOWS
2010-04-17 14:53:15 ----A---- C:\WINDOWS\TRNCOM.INI
2010-04-17 14:50:17 ----SD---- C:\WINDOWS\Tasks
2010-04-17 14:48:40 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-17 14:46:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-04-17 14:46:17 ----D---- C:\WINDOWS\Debug
2010-04-17 14:44:54 ----D---- C:\WINDOWS\Minidump
2010-04-17 14:44:52 ----D---- C:\WINDOWS\Prefetch
2010-04-17 14:41:39 ----D---- C:\WINDOWS\system32\Restore
2010-04-17 13:16:07 ----A---- C:\WINDOWS\system.ini
2010-04-17 13:14:22 ----D---- C:\WINDOWS\system32\drivers
2010-04-17 13:14:22 ----D---- C:\WINDOWS\system32
2010-04-17 13:14:22 ----D---- C:\WINDOWS\AppPatch
2010-04-17 13:14:16 ----D---- C:\Program Files\Common Files
2010-04-17 13:06:49 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-17 11:27:25 ----D---- C:\Bezpečnost,síť
2010-04-16 21:08:38 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-16 20:47:38 ----RD---- C:\Program Files
2010-04-16 20:31:59 ----D---- C:\WINDOWS\system32\config
2010-04-16 17:41:39 ----A---- C:\WINDOWS\WTRAN32.INI
2010-04-16 11:18:39 ----SHD---- C:\WINDOWS\Installer
2010-04-16 11:18:22 ----D---- C:\Program Files\Java
2010-04-16 11:17:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-04-15 19:39:43 ----RASH---- C:\boot.ini
2010-04-15 18:24:14 ----HD---- C:\WINDOWS\inf
2010-04-15 18:24:11 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-15 00:02:22 ----D---- C:\WINDOWS\Microsoft.NET
2010-04-14 23:52:24 ----D---- C:\Menší programy
2010-04-14 23:50:30 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-14 23:47:40 ----RSD---- C:\WINDOWS\assembly
2010-04-14 23:43:09 ----D---- C:\Program Files\Windows Media Connect 2
2010-04-14 23:42:55 ----D---- C:\Přehrávače
2010-04-14 23:35:42 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-04-14 21:20:44 ----D---- C:\Program Files\PowerArchiver
2010-04-14 14:03:32 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-12 21:05:55 ----A---- C:\WINDOWS\matlab.ini
2010-04-11 22:01:00 ----A---- C:\WINDOWS\CRC.INI
2010-04-11 15:45:24 ----A---- C:\WINDOWS\WDICT32.INI
2010-04-10 19:24:50 ----A---- C:\WINDOWS\cdplayer.ini
2010-04-06 19:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-02 15:08:39 ----SD---- C:\Documents and Settings\Lukáš\Data aplikací\Microsoft
2010-03-31 23:16:43 ----D---- C:\Program Files\Internet Explorer
2010-03-31 19:33:20 ----D---- C:\WINDOWS\SoftwareDistribution
2010-03-30 21:29:31 ----D---- C:\Temp
2010-03-30 21:27:22 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Audacity
2010-03-24 12:18:30 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Media Player Classic
2010-03-24 00:33:52 ----A---- C:\WINDOWS\wincmd.ini
2010-03-24 00:10:58 ----A---- C:\WINDOWS\MAILTRAN.INI
2010-03-24 00:09:36 ----D---- C:\Program Files\Translator 2005

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2001-10-25 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2001-10-25 55936]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-04-30 2880000]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2008-03-19 175104]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2006-01-20 17408]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-05-06 25280]
R3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2006-12-22 988800]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2006-12-22 209664]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-20 4800000]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NETw5x32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2008-04-28 3626112]
R3 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2008-04-15 51160]
R3 O2SDRDR;O2SDRDR; C:\WINDOWS\system32\DRIVERS\o2sd.sys [2008-04-08 43736]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2006-12-22 730112]
S3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys []
S3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2007-03-23 37424]
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-03-23 149123]
S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2007-03-31 55352]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-03-23 67960]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 DfuUsb;DfuUsb; C:\WINDOWS\SYSTEM32\DRIVERS\DFUUsb.sys [2007-11-08 10880]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SynasUSB;SynasUSB; C:\WINDOWS\system32\drivers\SynasUSB.sys [2006-11-23 18432]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-08 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-08 82944]
S4 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Ovladač filtru Obnovy systému; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73344]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-04-30 536576]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2007-04-01 273256]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 matlabserver;MATLAB Server; C:\MATLAB7\webserver\bin\win32\matlabserver.exe [2004-04-24 536576]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2005-10-14 28768528]
R2 o2flash;O2Micro Flash Memory Card Service; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [2007-02-13 65536]
S2 gupdate1ca03409edf825e;Služba Google Update (gupdate1ca03409edf825e); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-13 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-13 190448]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE []
S3 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2005-10-14 87768]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-09-23 2799808]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2005-10-14 239320]

-----------------EOF-----------------

PC se chová normálně

#12 Příspěvek od **motji** » 17 dub 2010 15:49

Log je v pořádku. Pokud nejsou problémy, je to vše

VIRY.CZ

Stovka win32/Rootkit.Kryptik.AF

Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF

Re: Stovka win32/Rootkit.Kryptik.AF