Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
rustock.m
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Caroprd111
- VIP
- Příspěvky: 13492
- Registrován: 22 bře 2009 20:48
- Bydliště: Třebíč
- Kontaktovat uživatele:
Re: rustock.m
ještě jsem to nestopnul. Isass využívá procesor na 60-70%
Mám to teda zrušit?
Mám to teda zrušit?
-
Caroprd111
- VIP
- Příspěvky: 13492
- Registrován: 22 bře 2009 20:48
- Bydliště: Třebíč
- Kontaktovat uživatele:
Re: rustock.m
ted to vypadá,že dojel,ale zatím se neobjevil v okně žádný text vyjma 4 řádku co tam jsou od začátku
-
Caroprd111
- VIP
- Příspěvky: 13492
- Registrován: 22 bře 2009 20:48
- Bydliště: Třebíč
- Kontaktovat uživatele:
Re: rustock.m
log z rsit
Logfile of random's system information tool 1.06 (written by random/random)
Run by administrator at 2010-04-21 21:40:44
Systém Microsoft Windows XP Professional Service Pack 3
System drive H: has 85 GB (85%) free of 100 GB
Total RAM: 2047 MB (79% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:49, on 21.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\AVG\AVG9\avgwdsvc.exe
H:\WINDOWS\avgagent.exe
H:\Program Files\AVG\AVG9\avgchsvx.exe
H:\Program Files\AVG\AVG9\avgrsx.exe
H:\Program Files\AVG\AVG9\avgcsrvx.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\AVG\AVG9\avgam.exe
H:\Program Files\AVG\AVG9\avgnsx.exe
H:\WINDOWS\system32\wuauclt.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\RTHDCPL.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
H:\PROGRA~1\AVG\AVG9\avgtray.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Documents and Settings\Administrator.EP9\Plocha\RSIT.exe
H:\Program Files\trend micro\administrator.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - H:\Program Files\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] H:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: e&xportovat do aplikace microsoft excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ep9.local
O17 - HKLM\Software\..\Telephony: DomainName = ep9.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ep9.local
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - H:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - H:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - H:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG9 Remote Support Service (AvgAgent) (avgagent) - Unknown owner - avgagent.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4906 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18df081c-e8ad-4283-a596-fa578c2ebdc3}]
Adobe PDF Link Helper - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - H:\Program Files\AVG\AVG9\avgssie.dll [2010-04-20 1615200]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"=H:\WINDOWS\SkyTel.EXE [2006-05-17 2879488]
"RTHDCPL"=H:\WINDOWS\RTHDCPL.EXE [2006-11-15 16270848]
"Alcmtr"=H:\WINDOWS\ALCMTR.EXE [2005-05-04 69632]
"NvCplDaemon"=H:\WINDOWS\system32\NvCpl.dll [2007-06-28 8466432]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=H:\WINDOWS\system32\NvMcTray.dll [2007-06-28 81920]
"Adobe Reader Speed Launcher"=H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"AVG9_TRAY"=H:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-04-20 2064736]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=H:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
H:\WINDOWS\system32\avgrsstx.dll [2010-04-20 12464]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
H:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoWelcomeScreen"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\WINDOWS\avgagent.exe"="H:\WINDOWS\avgagent.exe:*:Enabled:avgagent.exe"
"H:\Program Files\AVG\AVG8\avgam.exe"="H:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe"
"H:\Program Files\AVG\AVG8\avgupd.exe"="H:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"H:\Program Files\AVG\AVG8\avgnsx.exe"="H:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"H:\Program Files\NetMeeting\conf.exe"="H:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"H:\Program Files\AVG\AVG9\avgam.exe"="H:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe"
"H:\Program Files\AVG\AVG9\avgdiagex.exe"="H:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe"
"H:\Program Files\AVG\AVG9\avgupd.exe"="H:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"H:\Program Files\AVG\AVG9\avgnsx.exe"="H:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
======List of files/folders created in the last 1 months======
2010-04-21 16:57:11 ----A---- H:\WINDOWS\ntbtlog.txt
2010-04-21 07:47:18 ----HDC---- H:\WINDOWS\$NtUninstallKB971513$
2010-04-21 07:46:58 ----HDC---- H:\WINDOWS\$NtUninstallKB971737$
2010-04-21 07:46:52 ----HDC---- H:\WINDOWS\$NtUninstallKB970430$
2010-04-21 07:46:46 ----HDC---- H:\WINDOWS\$NtUninstallKB943729$
2010-04-21 07:46:17 ----D---- H:\WINDOWS\ie8updates
2010-04-21 07:45:52 ----D---- H:\WINDOWS\WBEM
2010-04-21 07:45:10 ----HDC---- H:\WINDOWS\ie8
2010-04-21 07:43:17 ----A---- H:\WINDOWS\imsins.BAK
2010-04-21 07:43:13 ----HDC---- H:\WINDOWS\$NtUninstallbasecsp$
2010-04-21 07:41:58 ----D---- H:\WINDOWS\system32\URTTEMP
2010-04-21 03:15:32 ----HDC---- H:\WINDOWS\$NtUninstallKB978262$
2010-04-21 03:15:27 ----HDC---- H:\WINDOWS\$NtUninstallKB960859$
2010-04-21 03:15:01 ----HDC---- H:\WINDOWS\$NtUninstallKB971468$
2010-04-21 03:14:53 ----HDC---- H:\WINDOWS\$NtUninstallKB979683$
2010-04-21 03:14:46 ----HDC---- H:\WINDOWS\$NtUninstallKB958869$
2010-04-21 03:14:41 ----HDC---- H:\WINDOWS\$NtUninstallKB980232$
2010-04-21 03:14:36 ----HDC---- H:\WINDOWS\$NtUninstallKB955759$
2010-04-21 03:13:18 ----HDC---- H:\WINDOWS\$NtUninstallKB974318$
2010-04-21 03:13:13 ----HDC---- H:\WINDOWS\$NtUninstallKB969059$
2010-04-21 03:13:08 ----HDC---- H:\WINDOWS\$NtUninstallKB981349$
2010-04-21 03:13:03 ----HDC---- H:\WINDOWS\$NtUninstallKB968816_WM9$
2010-04-21 03:12:59 ----HDC---- H:\WINDOWS\$NtUninstallKB978037$
2010-04-21 03:12:55 ----HDC---- H:\WINDOWS\$NtUninstallKB975713$
2010-04-21 03:12:49 ----HDC---- H:\WINDOWS\$NtUninstallKB971657$
2010-04-21 03:12:44 ----HDC---- H:\WINDOWS\$NtUninstallKB978338$
2010-04-21 03:12:40 ----HDC---- H:\WINDOWS\$NtUninstallKB954155_WM9$
2010-04-21 03:12:37 ----HDC---- H:\WINDOWS\$NtUninstallKB972270$
2010-04-21 03:12:31 ----HDC---- H:\WINDOWS\$NtUninstallKB956744$
2010-04-21 03:12:26 ----HDC---- H:\WINDOWS\$NtUninstallKB974112$
2010-04-21 03:12:21 ----HDC---- H:\WINDOWS\$NtUninstallKB956844$
2010-04-21 03:12:02 ----HDC---- H:\WINDOWS\$NtUninstallKB961501$
2010-04-21 03:11:58 ----HDC---- H:\WINDOWS\$NtUninstallKB975561$
2010-04-21 03:11:53 ----HDC---- H:\WINDOWS\$NtUninstallKB973869$
2010-04-21 03:11:49 ----HDC---- H:\WINDOWS\$NtUninstallKB975025$
2010-04-21 03:11:43 ----HDC---- H:\WINDOWS\$NtUninstallKB974571$
2010-04-21 03:11:38 ----HDC---- H:\WINDOWS\$NtUninstallKB975560$
2010-04-21 03:11:30 ----HDC---- H:\WINDOWS\$NtUninstallKB973507$
2010-04-21 03:11:15 ----D---- H:\Program Files\MSXML 4.0
2010-04-21 03:11:08 ----HDC---- H:\WINDOWS\$NtUninstallKB977816$
2010-04-21 03:11:03 ----HDC---- H:\WINDOWS\$NtUninstallKB973687$
2010-04-21 03:10:24 ----HDC---- H:\WINDOWS\$NtUninstallKB980182$
2010-04-21 03:10:15 ----HDC---- H:\WINDOWS\$NtUninstallKB978601$
2010-04-21 03:05:58 ----HDC---- H:\WINDOWS\$NtUninstallKB973354$
2010-04-21 03:05:52 ----HDC---- H:\WINDOWS\$NtUninstallKB973904$
2010-04-21 03:04:01 ----HDC---- H:\WINDOWS\$NtUninstallKB973540_WM9$
2010-04-21 03:03:34 ----HDC---- H:\WINDOWS\$NtUninstallKB974392$
2010-04-21 03:03:02 ----HDC---- H:\WINDOWS\$NtUninstallKB977914$
2010-04-21 03:02:39 ----HDC---- H:\WINDOWS\$NtUninstallKB970238$
2010-04-21 03:02:34 ----HDC---- H:\WINDOWS\$NtUninstallKB979309$
2010-04-21 03:02:30 ----HDC---- H:\WINDOWS\$NtUninstallKB978706$
2010-04-21 03:02:26 ----HDC---- H:\WINDOWS\$NtUninstallKB973815$
2010-04-21 03:02:21 ----HDC---- H:\WINDOWS\$NtUninstallKB979306$
2010-04-21 03:01:27 ----HDC---- H:\WINDOWS\$NtUninstallKB971961$
2010-04-21 03:01:23 ----HDC---- H:\WINDOWS\$NtUninstallKB975467$
2010-04-21 03:01:17 ----HDC---- H:\WINDOWS\$NtUninstallKB968389$
2010-04-21 03:01:09 ----HDC---- H:\WINDOWS\$NtUninstallKB969947$
2010-04-21 00:28:41 ----HD---- H:\$AVG
2010-04-20 22:55:39 ----A---- H:\WINDOWS\system32\avgrsstx.dll
2010-04-20 22:31:54 ----SHD---- H:\RECYCLER
2010-04-20 22:31:05 ----D---- H:\Program Files\AVG
2010-04-20 21:44:32 ----D---- H:\RECYCLER(2)
2010-04-20 20:35:32 ----D---- H:\WINDOWS\temp
2010-04-20 20:35:28 ----A---- H:\ComboFix.txt
2010-04-20 19:14:39 ----A---- H:\Boot.bak
2010-04-20 19:14:35 ----D---- H:\cmdcons
2010-04-20 19:12:57 ----D---- H:\WINDOWS\ERDNT
2010-04-20 19:12:49 ----D---- H:\Qoobox
2010-04-20 18:07:46 ----D---- H:\_OTL
2010-04-20 16:31:18 ----D---- H:\rsit
2010-04-20 16:31:18 ----D---- H:\Program Files\trend micro
2010-04-13 08:57:36 ----D---- H:\Documents and Settings\All Users\Data aplikací\avg9
2010-04-13 08:55:37 ----AD---- H:\Documents and Settings\All Users\Data aplikací\Temp
======List of files/folders modified in the last 1 months======
2010-04-21 21:40:20 ----D---- H:\WINDOWS\Prefetch
2010-04-21 21:39:19 ----SHD---- H:\WINDOWS\CSC
2010-04-21 18:37:52 ----D---- H:\Documents and Settings
2010-04-21 16:57:11 ----D---- H:\WINDOWS
2010-04-21 16:55:54 ----A---- H:\WINDOWS\SchedLgU.Txt
2010-04-21 16:43:11 ----SD---- H:\Documents and Settings\Administrator.EP9\Data aplikací\Microsoft
2010-04-21 07:52:20 ----D---- H:\WINDOWS\system32
2010-04-21 07:52:19 ----A---- H:\WINDOWS\system32\PerfStringBackup.INI
2010-04-21 07:48:34 ----RSHDC---- H:\WINDOWS\system32\dllcache
2010-04-21 07:48:34 ----D---- H:\WINDOWS\system32\cs-cz
2010-04-21 07:48:33 ----HD---- H:\WINDOWS\inf
2010-04-21 07:48:33 ----D---- H:\WINDOWS\Help
2010-04-21 07:48:33 ----D---- H:\Program Files\Internet Explorer
2010-04-21 07:47:17 ----D---- H:\Config.Msi
2010-04-21 07:47:15 ----SHD---- H:\WINDOWS\Installer
2010-04-21 07:47:12 ----D---- H:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-04-21 07:46:54 ----D---- H:\WINDOWS\system32\drivers
2010-04-21 07:46:48 ----D---- H:\WINDOWS\system32\wbem
2010-04-21 07:46:26 ----HD---- H:\WINDOWS\$hf_mig$
2010-04-21 07:45:46 ----D---- H:\WINDOWS\Media
2010-04-21 07:44:07 ----D---- H:\WINDOWS\Debug
2010-04-21 07:43:18 ----D---- H:\WINDOWS\security
2010-04-21 07:43:11 ----RSD---- H:\WINDOWS\assembly
2010-04-21 07:42:42 ----D---- H:\WINDOWS\Registration
2010-04-21 07:41:11 ----D---- H:\WINDOWS\system32\CatRoot2
2010-04-21 07:36:36 ----D---- H:\WINDOWS\SoftwareDistribution
2010-04-21 03:32:04 ----D---- H:\WINDOWS\AppPatch
2010-04-21 03:14:46 ----D---- H:\WINDOWS\WinSxS
2010-04-21 03:11:59 ----D---- H:\Program Files\Movie Maker
2010-04-21 03:11:15 ----RD---- H:\Program Files
2010-04-21 03:09:06 ----RSD---- H:\WINDOWS\Fonts
2010-04-21 03:08:59 ----D---- H:\Program Files\Common Files\Microsoft Shared
2010-04-21 03:08:41 ----D---- H:\Program Files\Microsoft Works
2010-04-21 03:08:36 ----D---- H:\WINDOWS\Microsoft.NET
2010-04-21 03:07:22 ----D---- H:\Program Files\Common Files\System
2010-04-21 03:07:22 ----A---- H:\WINDOWS\win.ini
2010-04-21 03:05:59 ----D---- H:\Program Files\Outlook Express
2010-04-20 23:30:40 ----A---- H:\WINDOWS\avgagent.ini
2010-04-20 22:35:33 ----D---- H:\WINDOWS\system32\CatRoot
2010-04-20 22:32:49 ----D---- H:\WINDOWS\system32\config
2010-04-20 22:30:06 ----D---- H:\WINDOWS\system32\Restore
2010-04-20 22:16:32 ----D---- H:\Program Files\Common Files
2010-04-20 22:07:29 ----D---- H:\WINDOWS\Minidump
2010-04-20 22:06:14 ----SD---- H:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-04-20 20:29:14 ----A---- H:\WINDOWS\system.ini
2010-04-20 19:32:38 ----SD---- H:\WINDOWS\Tasks
2010-04-20 18:13:06 ----SHD---- H:\System Volume Information
2010-04-12 16:58:15 ----A---- H:\WINDOWS\avgagent.exe
2010-04-06 10:52:56 ----A---- H:\WINDOWS\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AvgLdx86;AVG AVI Loader Driver x86; H:\WINDOWS\System32\Drivers\avgldx86.sys [2010-04-20 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; H:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-04-20 29512]
R1 AvgTdiX;AVG Network Redirector; H:\WINDOWS\System32\Drivers\avgtdix.sys [2010-04-20 242896]
R1 intelppm;Řadič procesoru Intel; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; H:\WINDOWS\System32\drivers\ws2ifsl.sys [2007-08-02 12032]
R3 Arp1394;Protokol 1394 ARP Client; H:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; H:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-10-31 35840]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-16 4225920]
R3 MTsensor;ATK0110 ACPI UTILITY; H:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; H:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; H:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-06-28 6807328]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; H:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; H:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 a129c789;a129c789; H:\WINDOWS\System32\drivers\a129c789.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; H:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 WpdUsb;WpdUsb; H:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; H:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; H:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avg9wd;AVG WatchDog; H:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-04-20 308064]
R2 avgagent;AVG9 Remote Support Service (AvgAgent); avgagent.exe /srvfsys []
R2 Net Driver HPZ12;Net Driver HPZ12; H:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; H:\WINDOWS\system32\nvsvc32.exe [2007-06-28 155716]
R2 Pml Driver HPZ12;Pml Driver HPZ12; H:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; H:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 odserv;Microsoft Office Diagnostics Service; H:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; H:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
-----------------EOF-----------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by administrator at 2010-04-21 21:40:44
Systém Microsoft Windows XP Professional Service Pack 3
System drive H: has 85 GB (85%) free of 100 GB
Total RAM: 2047 MB (79% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:49, on 21.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\AVG\AVG9\avgwdsvc.exe
H:\WINDOWS\avgagent.exe
H:\Program Files\AVG\AVG9\avgchsvx.exe
H:\Program Files\AVG\AVG9\avgrsx.exe
H:\Program Files\AVG\AVG9\avgcsrvx.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\AVG\AVG9\avgam.exe
H:\Program Files\AVG\AVG9\avgnsx.exe
H:\WINDOWS\system32\wuauclt.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\RTHDCPL.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
H:\PROGRA~1\AVG\AVG9\avgtray.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Documents and Settings\Administrator.EP9\Plocha\RSIT.exe
H:\Program Files\trend micro\administrator.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - H:\Program Files\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] H:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: e&xportovat do aplikace microsoft excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ep9.local
O17 - HKLM\Software\..\Telephony: DomainName = ep9.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ep9.local
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - H:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - H:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - H:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG9 Remote Support Service (AvgAgent) (avgagent) - Unknown owner - avgagent.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4906 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18df081c-e8ad-4283-a596-fa578c2ebdc3}]
Adobe PDF Link Helper - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - H:\Program Files\AVG\AVG9\avgssie.dll [2010-04-20 1615200]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"=H:\WINDOWS\SkyTel.EXE [2006-05-17 2879488]
"RTHDCPL"=H:\WINDOWS\RTHDCPL.EXE [2006-11-15 16270848]
"Alcmtr"=H:\WINDOWS\ALCMTR.EXE [2005-05-04 69632]
"NvCplDaemon"=H:\WINDOWS\system32\NvCpl.dll [2007-06-28 8466432]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=H:\WINDOWS\system32\NvMcTray.dll [2007-06-28 81920]
"Adobe Reader Speed Launcher"=H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=H:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"AVG9_TRAY"=H:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-04-20 2064736]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=H:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
H:\WINDOWS\system32\avgrsstx.dll [2010-04-20 12464]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
H:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoWelcomeScreen"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\WINDOWS\avgagent.exe"="H:\WINDOWS\avgagent.exe:*:Enabled:avgagent.exe"
"H:\Program Files\AVG\AVG8\avgam.exe"="H:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe"
"H:\Program Files\AVG\AVG8\avgupd.exe"="H:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"H:\Program Files\AVG\AVG8\avgnsx.exe"="H:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"H:\Program Files\NetMeeting\conf.exe"="H:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"H:\Program Files\AVG\AVG9\avgam.exe"="H:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe"
"H:\Program Files\AVG\AVG9\avgdiagex.exe"="H:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe"
"H:\Program Files\AVG\AVG9\avgupd.exe"="H:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"H:\Program Files\AVG\AVG9\avgnsx.exe"="H:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
======List of files/folders created in the last 1 months======
2010-04-21 16:57:11 ----A---- H:\WINDOWS\ntbtlog.txt
2010-04-21 07:47:18 ----HDC---- H:\WINDOWS\$NtUninstallKB971513$
2010-04-21 07:46:58 ----HDC---- H:\WINDOWS\$NtUninstallKB971737$
2010-04-21 07:46:52 ----HDC---- H:\WINDOWS\$NtUninstallKB970430$
2010-04-21 07:46:46 ----HDC---- H:\WINDOWS\$NtUninstallKB943729$
2010-04-21 07:46:17 ----D---- H:\WINDOWS\ie8updates
2010-04-21 07:45:52 ----D---- H:\WINDOWS\WBEM
2010-04-21 07:45:10 ----HDC---- H:\WINDOWS\ie8
2010-04-21 07:43:17 ----A---- H:\WINDOWS\imsins.BAK
2010-04-21 07:43:13 ----HDC---- H:\WINDOWS\$NtUninstallbasecsp$
2010-04-21 07:41:58 ----D---- H:\WINDOWS\system32\URTTEMP
2010-04-21 03:15:32 ----HDC---- H:\WINDOWS\$NtUninstallKB978262$
2010-04-21 03:15:27 ----HDC---- H:\WINDOWS\$NtUninstallKB960859$
2010-04-21 03:15:01 ----HDC---- H:\WINDOWS\$NtUninstallKB971468$
2010-04-21 03:14:53 ----HDC---- H:\WINDOWS\$NtUninstallKB979683$
2010-04-21 03:14:46 ----HDC---- H:\WINDOWS\$NtUninstallKB958869$
2010-04-21 03:14:41 ----HDC---- H:\WINDOWS\$NtUninstallKB980232$
2010-04-21 03:14:36 ----HDC---- H:\WINDOWS\$NtUninstallKB955759$
2010-04-21 03:13:18 ----HDC---- H:\WINDOWS\$NtUninstallKB974318$
2010-04-21 03:13:13 ----HDC---- H:\WINDOWS\$NtUninstallKB969059$
2010-04-21 03:13:08 ----HDC---- H:\WINDOWS\$NtUninstallKB981349$
2010-04-21 03:13:03 ----HDC---- H:\WINDOWS\$NtUninstallKB968816_WM9$
2010-04-21 03:12:59 ----HDC---- H:\WINDOWS\$NtUninstallKB978037$
2010-04-21 03:12:55 ----HDC---- H:\WINDOWS\$NtUninstallKB975713$
2010-04-21 03:12:49 ----HDC---- H:\WINDOWS\$NtUninstallKB971657$
2010-04-21 03:12:44 ----HDC---- H:\WINDOWS\$NtUninstallKB978338$
2010-04-21 03:12:40 ----HDC---- H:\WINDOWS\$NtUninstallKB954155_WM9$
2010-04-21 03:12:37 ----HDC---- H:\WINDOWS\$NtUninstallKB972270$
2010-04-21 03:12:31 ----HDC---- H:\WINDOWS\$NtUninstallKB956744$
2010-04-21 03:12:26 ----HDC---- H:\WINDOWS\$NtUninstallKB974112$
2010-04-21 03:12:21 ----HDC---- H:\WINDOWS\$NtUninstallKB956844$
2010-04-21 03:12:02 ----HDC---- H:\WINDOWS\$NtUninstallKB961501$
2010-04-21 03:11:58 ----HDC---- H:\WINDOWS\$NtUninstallKB975561$
2010-04-21 03:11:53 ----HDC---- H:\WINDOWS\$NtUninstallKB973869$
2010-04-21 03:11:49 ----HDC---- H:\WINDOWS\$NtUninstallKB975025$
2010-04-21 03:11:43 ----HDC---- H:\WINDOWS\$NtUninstallKB974571$
2010-04-21 03:11:38 ----HDC---- H:\WINDOWS\$NtUninstallKB975560$
2010-04-21 03:11:30 ----HDC---- H:\WINDOWS\$NtUninstallKB973507$
2010-04-21 03:11:15 ----D---- H:\Program Files\MSXML 4.0
2010-04-21 03:11:08 ----HDC---- H:\WINDOWS\$NtUninstallKB977816$
2010-04-21 03:11:03 ----HDC---- H:\WINDOWS\$NtUninstallKB973687$
2010-04-21 03:10:24 ----HDC---- H:\WINDOWS\$NtUninstallKB980182$
2010-04-21 03:10:15 ----HDC---- H:\WINDOWS\$NtUninstallKB978601$
2010-04-21 03:05:58 ----HDC---- H:\WINDOWS\$NtUninstallKB973354$
2010-04-21 03:05:52 ----HDC---- H:\WINDOWS\$NtUninstallKB973904$
2010-04-21 03:04:01 ----HDC---- H:\WINDOWS\$NtUninstallKB973540_WM9$
2010-04-21 03:03:34 ----HDC---- H:\WINDOWS\$NtUninstallKB974392$
2010-04-21 03:03:02 ----HDC---- H:\WINDOWS\$NtUninstallKB977914$
2010-04-21 03:02:39 ----HDC---- H:\WINDOWS\$NtUninstallKB970238$
2010-04-21 03:02:34 ----HDC---- H:\WINDOWS\$NtUninstallKB979309$
2010-04-21 03:02:30 ----HDC---- H:\WINDOWS\$NtUninstallKB978706$
2010-04-21 03:02:26 ----HDC---- H:\WINDOWS\$NtUninstallKB973815$
2010-04-21 03:02:21 ----HDC---- H:\WINDOWS\$NtUninstallKB979306$
2010-04-21 03:01:27 ----HDC---- H:\WINDOWS\$NtUninstallKB971961$
2010-04-21 03:01:23 ----HDC---- H:\WINDOWS\$NtUninstallKB975467$
2010-04-21 03:01:17 ----HDC---- H:\WINDOWS\$NtUninstallKB968389$
2010-04-21 03:01:09 ----HDC---- H:\WINDOWS\$NtUninstallKB969947$
2010-04-21 00:28:41 ----HD---- H:\$AVG
2010-04-20 22:55:39 ----A---- H:\WINDOWS\system32\avgrsstx.dll
2010-04-20 22:31:54 ----SHD---- H:\RECYCLER
2010-04-20 22:31:05 ----D---- H:\Program Files\AVG
2010-04-20 21:44:32 ----D---- H:\RECYCLER(2)
2010-04-20 20:35:32 ----D---- H:\WINDOWS\temp
2010-04-20 20:35:28 ----A---- H:\ComboFix.txt
2010-04-20 19:14:39 ----A---- H:\Boot.bak
2010-04-20 19:14:35 ----D---- H:\cmdcons
2010-04-20 19:12:57 ----D---- H:\WINDOWS\ERDNT
2010-04-20 19:12:49 ----D---- H:\Qoobox
2010-04-20 18:07:46 ----D---- H:\_OTL
2010-04-20 16:31:18 ----D---- H:\rsit
2010-04-20 16:31:18 ----D---- H:\Program Files\trend micro
2010-04-13 08:57:36 ----D---- H:\Documents and Settings\All Users\Data aplikací\avg9
2010-04-13 08:55:37 ----AD---- H:\Documents and Settings\All Users\Data aplikací\Temp
======List of files/folders modified in the last 1 months======
2010-04-21 21:40:20 ----D---- H:\WINDOWS\Prefetch
2010-04-21 21:39:19 ----SHD---- H:\WINDOWS\CSC
2010-04-21 18:37:52 ----D---- H:\Documents and Settings
2010-04-21 16:57:11 ----D---- H:\WINDOWS
2010-04-21 16:55:54 ----A---- H:\WINDOWS\SchedLgU.Txt
2010-04-21 16:43:11 ----SD---- H:\Documents and Settings\Administrator.EP9\Data aplikací\Microsoft
2010-04-21 07:52:20 ----D---- H:\WINDOWS\system32
2010-04-21 07:52:19 ----A---- H:\WINDOWS\system32\PerfStringBackup.INI
2010-04-21 07:48:34 ----RSHDC---- H:\WINDOWS\system32\dllcache
2010-04-21 07:48:34 ----D---- H:\WINDOWS\system32\cs-cz
2010-04-21 07:48:33 ----HD---- H:\WINDOWS\inf
2010-04-21 07:48:33 ----D---- H:\WINDOWS\Help
2010-04-21 07:48:33 ----D---- H:\Program Files\Internet Explorer
2010-04-21 07:47:17 ----D---- H:\Config.Msi
2010-04-21 07:47:15 ----SHD---- H:\WINDOWS\Installer
2010-04-21 07:47:12 ----D---- H:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-04-21 07:46:54 ----D---- H:\WINDOWS\system32\drivers
2010-04-21 07:46:48 ----D---- H:\WINDOWS\system32\wbem
2010-04-21 07:46:26 ----HD---- H:\WINDOWS\$hf_mig$
2010-04-21 07:45:46 ----D---- H:\WINDOWS\Media
2010-04-21 07:44:07 ----D---- H:\WINDOWS\Debug
2010-04-21 07:43:18 ----D---- H:\WINDOWS\security
2010-04-21 07:43:11 ----RSD---- H:\WINDOWS\assembly
2010-04-21 07:42:42 ----D---- H:\WINDOWS\Registration
2010-04-21 07:41:11 ----D---- H:\WINDOWS\system32\CatRoot2
2010-04-21 07:36:36 ----D---- H:\WINDOWS\SoftwareDistribution
2010-04-21 03:32:04 ----D---- H:\WINDOWS\AppPatch
2010-04-21 03:14:46 ----D---- H:\WINDOWS\WinSxS
2010-04-21 03:11:59 ----D---- H:\Program Files\Movie Maker
2010-04-21 03:11:15 ----RD---- H:\Program Files
2010-04-21 03:09:06 ----RSD---- H:\WINDOWS\Fonts
2010-04-21 03:08:59 ----D---- H:\Program Files\Common Files\Microsoft Shared
2010-04-21 03:08:41 ----D---- H:\Program Files\Microsoft Works
2010-04-21 03:08:36 ----D---- H:\WINDOWS\Microsoft.NET
2010-04-21 03:07:22 ----D---- H:\Program Files\Common Files\System
2010-04-21 03:07:22 ----A---- H:\WINDOWS\win.ini
2010-04-21 03:05:59 ----D---- H:\Program Files\Outlook Express
2010-04-20 23:30:40 ----A---- H:\WINDOWS\avgagent.ini
2010-04-20 22:35:33 ----D---- H:\WINDOWS\system32\CatRoot
2010-04-20 22:32:49 ----D---- H:\WINDOWS\system32\config
2010-04-20 22:30:06 ----D---- H:\WINDOWS\system32\Restore
2010-04-20 22:16:32 ----D---- H:\Program Files\Common Files
2010-04-20 22:07:29 ----D---- H:\WINDOWS\Minidump
2010-04-20 22:06:14 ----SD---- H:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-04-20 20:29:14 ----A---- H:\WINDOWS\system.ini
2010-04-20 19:32:38 ----SD---- H:\WINDOWS\Tasks
2010-04-20 18:13:06 ----SHD---- H:\System Volume Information
2010-04-12 16:58:15 ----A---- H:\WINDOWS\avgagent.exe
2010-04-06 10:52:56 ----A---- H:\WINDOWS\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AvgLdx86;AVG AVI Loader Driver x86; H:\WINDOWS\System32\Drivers\avgldx86.sys [2010-04-20 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; H:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-04-20 29512]
R1 AvgTdiX;AVG Network Redirector; H:\WINDOWS\System32\Drivers\avgtdix.sys [2010-04-20 242896]
R1 intelppm;Řadič procesoru Intel; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; H:\WINDOWS\System32\drivers\ws2ifsl.sys [2007-08-02 12032]
R3 Arp1394;Protokol 1394 ARP Client; H:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; H:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-10-31 35840]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-16 4225920]
R3 MTsensor;ATK0110 ACPI UTILITY; H:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; H:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; H:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-06-28 6807328]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; H:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; H:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 a129c789;a129c789; H:\WINDOWS\System32\drivers\a129c789.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; H:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 WpdUsb;WpdUsb; H:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; H:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; H:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avg9wd;AVG WatchDog; H:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-04-20 308064]
R2 avgagent;AVG9 Remote Support Service (AvgAgent); avgagent.exe /srvfsys []
R2 Net Driver HPZ12;Net Driver HPZ12; H:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; H:\WINDOWS\system32\nvsvc32.exe [2007-06-28 155716]
R2 Pml Driver HPZ12;Pml Driver HPZ12; H:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; H:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 odserv;Microsoft Office Diagnostics Service; H:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; H:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
-----------------EOF-----------------
Re: rustock.m
Jak to vypadá? A co dál?
Re: rustock.m
otestoval jsem servicess.exe na virustotal a je tam stýle trojan
http://www.virustotal.com/cs/analisis/f ... 1271879966
http://www.virustotal.com/cs/analisis/f ... 1271879966
Re: rustock.m
Moc prosím o pomoc. Do půlnoci bych to potřeboval vyřeěit
-
Caroprd111
- VIP
- Příspěvky: 13492
- Registrován: 22 bře 2009 20:48
- Bydliště: Třebíč
- Kontaktovat uživatele:
Re: rustock.m
To jsem čekal spíš já od Vás.že mi řeknete,jestli je tam podle logu z RSIT nějaký problém. A dále po otestování servicess na virustotal hlasí trojana
http://www.virustotal.com/cs/analisis/f ... 1271879966
http://www.virustotal.com/cs/analisis/f ... 1271879966
-
Caroprd111
- VIP
- Příspěvky: 13492
- Registrován: 22 bře 2009 20:48
- Bydliště: Třebíč
- Kontaktovat uživatele:
Re: rustock.m
Přečtěte si prosím SZ. 
Ta detekce na virustotalu je falešná. Odinstalujte ComboFix přes:Start >> Spustit, zkopírujte do okénka:
ComboFix /Uninstall
stiskněte Enter
Stáhněte T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe
- Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
- Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.
Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe
- Spusťte.
- Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)
Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe
- Spusťte.
- Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)
Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478
- Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.
Záložka Čistič - Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
Záložka Registry - Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít
Přispějete na provoz fóra?