Gen:Trojan.Heur.GZ, Gen:Trojan.Heur.TP

[wgs]

Dobré odpoledne!

Prosím o pomoc s očistou kompjůtru, nedaří se mi. Trochu jsem googlil a zkusil desítku různých prográmků a skenerů, nicméně bez efektu. Prosím o radu.

Jev: začaly "mizet" aplikace, jako by byly odinstalovány (možná taky byly). FF, Ccleaner, QIP, antispyware, winamp, odstraněna nějaká asi klíčová část Office, takže místo spuštění se pouštějí do jakési nefunkční instalace.

Log z MWAV:

File C:\Windows\System32\Hpservice.exe infected by "Gen:Trojan.Heur.TP.bqW@bmM9uof (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\Hpservice.exe infected by "Gen:Trojan.Heur.TP.bqW@bmM9uof (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\debug.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\edit.com infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\edlin.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\exe2bin.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\fastopen.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\hpservice.exe infected by "Gen:Trojan.Heur.TP.bqW@bmM9uof (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\mem.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\nlsfunc.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Windows\System32\share.exe infected by "Gen:Trojan.Heur.GZ.aaW@batuXB (DB)" Virus! Action Taken: No Action Taken.
File C:\Users\admin\AppData\Local\Temp\is-NF871.tmp\InnoMonitor.exe infected by "DeepScan:Generic.Malware.P!Pk.B9FCE314 (DB)" Virus! Action Taken: No Action Taken.
File C:\Users\admin\AppData\Local\Temp\pv.exe infected by "Gen:Trojan.Heur.GZ.emW@baIMbqd (DB)" Virus! Action Taken: No Action Taken.
File F:\AUTORUN.INF infected by "Fujack" Virus! Action Taken: No Action Taken.

Log z RSIT:

Logfile of random's system information tool 1.07 (written by random/random)
Run by admin at 2010-05-07 13:11:12
Microsoft® Windows Vista™ Business
System drive C: has 33 GB (32%) free of 105 GB
Total RAM: 1015 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:11:33, on 7.5.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16916)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\Explorer.EXE
C:\Windows\SMINST\scheduler.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\admin\Desktop\DOWNLOAD\RSIT.exe
C:\Program Files\trend micro\admin.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: APSHook.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Unknown owner - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (file missing)
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Unknown owner - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - Unknown owner - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 6635 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{8A2538FA-A777-4208-B00B-E58FD98163CA}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
Credential Manager for HP ProtectTools - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll [2006-11-21 71192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-05-11 472632]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-05-02 163840]
"HP Software Update"=c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-09-13 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-09-13 154136]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-09-13 129560]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-02-21 1183744]
"Samsung PanelMgr"=C:\Windows\Samsung\PanelMgr\SSMMgr.exe [2008-04-14 536576]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"=C:\Windows\SMINST\launcher.exe [2007-03-09 44168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-05-07 3037696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete]
C:\Program Files\PDF Complete\pdfsty.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\Windows\Samsung\PanelMgr\SSMMgr.exe [2008-04-14 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe /systray /nologon []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="APSHook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-09-13 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ASWLNPkg

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-05-07 13:11:13 ----D---- C:\Program Files\trend micro
2010-05-07 12:11:55 ----SHD---- C:\Config.Msi
2010-05-07 11:40:50 ----D---- C:\Users\admin\AppData\Roaming\Spyware Terminator
2010-05-07 11:40:33 ----D---- C:\ProgramData\Spyware Terminator
2010-05-07 11:40:30 ----D---- C:\Program Files\Spyware Terminator
2010-05-07 11:39:01 ----D---- C:\Users\admin\AppData\Roaming\Malwarebytes
2010-05-07 11:38:46 ----D---- C:\ProgramData\Malwarebytes
2010-05-07 11:38:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-05-07 10:47:41 ----AD---- C:\Windows\VDLL.DLL
2010-05-07 10:47:41 ----AD---- C:\Windows\system32\runouce.exe
2010-05-07 10:47:41 ----AD---- C:\Windows\RUNDL132.EXE
2010-05-07 10:47:41 ----AD---- C:\Windows\logo_1.exe
2010-05-07 10:44:21 ----A---- C:\Windows\system32\msvcr80.dll
2010-05-07 10:44:20 ----A---- C:\Windows\system32\msvcp80.dll
2010-05-07 10:44:18 ----A---- C:\Windows\system32\eEmpty.exe
2010-05-07 10:44:13 ----D---- C:\Program Files\Common Files\MicroWorld
2010-05-07 10:44:12 ----D---- C:\ProgramData\MicroWorld
2010-05-06 22:38:11 ----SHD---- C:\$RECYCLE.BIN
2010-05-06 22:21:31 ----D---- C:\ProgramData\DivX
2010-05-02 18:42:46 ----D---- C:\Users\admin\AppData\Roaming\Playrix Entertainment

======List of files/folders modified in the last 1 months======

2010-05-07 13:11:26 ----D---- C:\Windows\Prefetch
2010-05-07 13:11:13 ----RD---- C:\Program Files
2010-05-07 13:10:52 ----D---- C:\Windows\Temp
2010-05-07 13:10:51 ----SHD---- C:\Windows\Installer
2010-05-07 13:09:34 ----D---- C:\Windows\SMINST
2010-05-07 13:08:20 ----D---- C:\Program Files\Common Files
2010-05-07 12:11:57 ----D---- C:\Program Files\SUPERAntiSpyware
2010-05-07 12:11:28 ----AD---- C:\ProgramData\TEMP
2010-05-07 12:11:22 ----HD---- C:\ProgramData
2010-05-07 12:11:21 ----D---- C:\Windows\system32\drivers
2010-05-07 12:11:15 ----D---- C:\Windows
2010-05-07 11:20:36 ----D---- C:\Windows\winsxs
2010-05-07 11:19:55 ----D---- C:\Program Files\Common Files\microsoft shared
2010-05-07 10:47:41 ----D---- C:\Windows\System32
2010-05-07 10:32:56 ----D---- C:\Users\admin\AppData\Roaming\uniblue
2010-05-07 10:23:21 ----D---- C:\ProgramData\Microsoft Help
2010-05-07 10:23:18 ----D---- C:\Program Files\Microsoft Office
2010-05-07 04:31:44 ----D---- C:\Program Files\uTorrent
2010-05-07 01:51:02 ----D---- C:\Program Files\The KMPlayer
2010-05-07 01:31:02 ----D---- C:\Program Files\Windows Media Player
2010-05-07 01:23:27 ----D---- C:\Program Files\Mozilla Firefox
2010-05-07 01:16:16 ----D---- C:\Program Files\PDF Complete
2010-05-07 01:12:26 ----D---- C:\Program Files\Movie Maker
2010-05-07 01:12:09 ----D---- C:\Program Files\Microsoft Small Business
2010-05-07 01:01:32 ----D---- C:\Program Files\Microsoft Games
2010-05-07 01:01:28 ----D---- C:\Program Files\IZArc
2010-05-07 01:01:07 ----D---- C:\Program Files\Internet Explorer
2010-05-07 01:00:49 ----D---- C:\Program Files\Hp
2010-05-07 01:00:48 ----D---- C:\Program Files\Hewlett-Packard
2010-05-06 23:45:51 ----D---- C:\Program Files\Common Files\System
2010-05-06 23:40:05 ----D---- C:\Program Files\Common Files\LightScribe
2010-05-06 22:55:33 ----D---- C:\Program Files\CCleaner
2010-05-06 22:37:50 ----SHD---- C:\boot
2010-05-06 22:24:13 ----D---- C:\Users\admin\AppData\Roaming\DivX
2010-05-05 22:49:04 ----A---- C:\Windows\NeroDigital.ini
2010-05-05 17:04:07 ----D---- C:\Windows\inf
2010-05-05 17:04:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-05-03 23:10:19 ----D---- C:\Windows\Minidump
2010-04-18 21:04:36 ----D---- C:\Users\admin\AppData\Roaming\SolSuite
2010-04-12 18:22:52 ----D---- C:\Windows\system32\catroot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2008-02-03 320000]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2010-05-07 142592]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328]
R2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2008-01-10 41984]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2008-01-10 5120]
R3 Accelerometer;HP Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [2007-01-05 27136]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\ADIHdAud.sys [2008-03-27 309248]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2007-04-16 1161152]
R3 ATSWPDRV;(****DEBUG****) AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2007-04-10 140808]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-26 179712]
R3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-04-29 19456]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2006-11-02 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2008-04-29 29184]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-02-03 14208]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-09-13 1925632]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2006-11-02 49664]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2006-11-02 41064]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-02-03 11264]
S1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
S3 ATE_PROCMON;ATE_PROCMON; \??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2008-04-29 220160]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945BG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 usb_rndis;USB Remote NDIS Device Driver; C:\Windows\system32\DRIVERS\usb8023.sys [2006-11-02 14848]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2006-11-02 128104]
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AEADIFilters;Andrea ADI Filters Service; C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2007-04-16 9216]
R2 ASBroker;Logon Session Broker; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 ASChannel;Local Communication Channel; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 BcmSqlStartupSvc;Služba spouštění serveru SQL Server aplikace Business Contact Manager; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2007-01-05 18944]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-05-07 488960]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe []
S3 CscService;Soubory offline; C:\Windows\System32\svchost.exe [2006-11-02 22016]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe []
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe []
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe []
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE []
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE []
S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe []
S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe []
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2006-11-02 22016]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2006-11-02 562176]

-----------------EOF-----------------

[Unlimited_Killer]

Dobré odpoledne.

1) ComboFix

• Stáhněte a uložte na Plochu ComboFix.
• Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
• Spusťte ho s administrátorským oprávněním.
• Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'.
• Budete také dotázáni na instalaci konzole pro zotavení, taktéž klikněte na 'Ano'.
• Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat.
• Váš PC bude pravděpodobně restartován, tak se toho nelekněte.
• Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
• Po skončení skenu (či následném restartu) na Vás 'vypadne' log, který vkopírujete ve formě textu sem.
• Pokud žádný log 'nevypadne', naleznete jej v umístění C:\ComboFix.txt

[wgs]

Combofix použit, nicméně nepodařilo se mi deaktivovat Norton Internet Security antivir a antispyware a SuperAntiSpyware. Ba jsem ani nevěděl, že běží či dokonce že v počítači vůbec jsou, ComboFix mě dvakrát upozornil, pak se "na vlastní nebezpečí" spustil, tak jsem ho nechal. Norton Internet Security ani SAS nejsou podle ovládací panely - programy ani nainstalované, tak nevím.

Zde je log:

ComboFix 10-05-06.05 - admin 07.05.2010 17:14:42.1.2 - x86
Microsoft® Windows Vista™ Business 6.0.6000.0.1250.420.1029.18.1015.333 [GMT 2:00]
Spuštěný z: c:\users\admin\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100507-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: avast! antivirus 4.8.1368 [VPS 100507-0] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Spyware Terminator *disabled* (Updated) {55EE49A8-16BE-4601-BBE6-607B7F7317DE}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\admin\AppData\Roaming\.#
c:\users\admin\AppData\Roaming\.#\MBX@1008@1312918.###
c:\users\admin\AppData\Roaming\.#\MBX@1008@1312948.###
c:\users\admin\AppData\Roaming\.#\MBX@1008@1312978.###
c:\users\admin\AppData\Roaming\.#\MBX@1154@3D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@1154@3D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@1154@3D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@1578@1582918.###
c:\users\admin\AppData\Roaming\.#\MBX@1578@1582948.###
c:\users\admin\AppData\Roaming\.#\MBX@1578@1582978.###
c:\users\admin\AppData\Roaming\.#\MBX@19A0@DD2918.###
c:\users\admin\AppData\Roaming\.#\MBX@19A0@DD2948.###
c:\users\admin\AppData\Roaming\.#\MBX@19A0@DD2978.###
c:\users\admin\AppData\Roaming\.#\MBX@19C8@252918.###
c:\users\admin\AppData\Roaming\.#\MBX@19C8@252948.###
c:\users\admin\AppData\Roaming\.#\MBX@19C8@252978.###
c:\users\admin\AppData\Roaming\.#\MBX@1AFC@2B2918.###
c:\users\admin\AppData\Roaming\.#\MBX@1AFC@2B2948.###
c:\users\admin\AppData\Roaming\.#\MBX@1AFC@2B2978.###
c:\users\admin\AppData\Roaming\.#\MBX@1CC@11E2918.###
c:\users\admin\AppData\Roaming\.#\MBX@1CC@11E2948.###
c:\users\admin\AppData\Roaming\.#\MBX@1CC@11E2978.###
c:\users\admin\AppData\Roaming\.#\MBX@1D24@162918.###
c:\users\admin\AppData\Roaming\.#\MBX@1D24@162948.###
c:\users\admin\AppData\Roaming\.#\MBX@1D24@162978.###
c:\users\admin\AppData\Roaming\.#\MBX@1EE4@E72918.###
c:\users\admin\AppData\Roaming\.#\MBX@1EE4@E72948.###
c:\users\admin\AppData\Roaming\.#\MBX@1EE4@E72978.###
c:\users\admin\AppData\Roaming\.#\MBX@1F5C@9D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@1F5C@9D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@1F5C@9D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@464@1512918.###
c:\users\admin\AppData\Roaming\.#\MBX@464@1512948.###
c:\users\admin\AppData\Roaming\.#\MBX@464@1512978.###
c:\users\admin\AppData\Roaming\.#\MBX@71C@1492918.###
c:\users\admin\AppData\Roaming\.#\MBX@71C@1492948.###
c:\users\admin\AppData\Roaming\.#\MBX@71C@1492978.###
c:\users\admin\AppData\Roaming\.#\MBX@768@11D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@768@11D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@768@11D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@848@F82918.###
c:\users\admin\AppData\Roaming\.#\MBX@848@F82948.###
c:\users\admin\AppData\Roaming\.#\MBX@848@F82978.###
c:\users\admin\AppData\Roaming\.#\MBX@890@13D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@890@13D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@890@13D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@8D0@13F2918.###
c:\users\admin\AppData\Roaming\.#\MBX@8D0@13F2948.###
c:\users\admin\AppData\Roaming\.#\MBX@8D0@13F2978.###
c:\users\admin\AppData\Roaming\.#\MBX@97C@9D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@97C@9D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@97C@9D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@9A0@352918.###
c:\users\admin\AppData\Roaming\.#\MBX@9A0@352948.###
c:\users\admin\AppData\Roaming\.#\MBX@9A0@352978.###
c:\users\admin\AppData\Roaming\.#\MBX@A88@252918.###
c:\users\admin\AppData\Roaming\.#\MBX@A88@252948.###
c:\users\admin\AppData\Roaming\.#\MBX@A88@252978.###
c:\users\admin\AppData\Roaming\.#\MBX@AC8@13D2918.###
c:\users\admin\AppData\Roaming\.#\MBX@AC8@13D2948.###
c:\users\admin\AppData\Roaming\.#\MBX@AC8@13D2978.###
c:\users\admin\AppData\Roaming\.#\MBX@B24@1452918.###
c:\users\admin\AppData\Roaming\.#\MBX@B24@1452948.###
c:\users\admin\AppData\Roaming\.#\MBX@B24@1452978.###
c:\users\admin\AppData\Roaming\.#\MBX@BAC@2B2908.###
c:\users\admin\AppData\Roaming\.#\MBX@BAC@2B2938.###
c:\users\admin\AppData\Roaming\.#\MBX@BAC@2B2968.###
c:\users\admin\AppData\Roaming\.#\MBX@C40@712918.###
c:\users\admin\AppData\Roaming\.#\MBX@C40@712948.###
c:\users\admin\AppData\Roaming\.#\MBX@C40@712978.###
c:\users\admin\AppData\Roaming\.#\MBX@D18@1232918.###
c:\users\admin\AppData\Roaming\.#\MBX@D18@1232948.###
c:\users\admin\AppData\Roaming\.#\MBX@D18@1232978.###
c:\users\admin\AppData\Roaming\.#\MBX@E5C@1462918.###
c:\users\admin\AppData\Roaming\.#\MBX@E5C@1462948.###
c:\users\admin\AppData\Roaming\.#\MBX@E5C@1462978.###
c:\users\admin\AppData\Roaming\.#\MBX@F18@292918.###
c:\users\admin\AppData\Roaming\.#\MBX@F18@292948.###
c:\users\admin\AppData\Roaming\.#\MBX@F18@292978.###
c:\users\admin\AppData\Roaming\.#\MBX@F2C@F52918.###
c:\users\admin\AppData\Roaming\.#\MBX@F2C@F52948.###
c:\users\admin\AppData\Roaming\.#\MBX@F2C@F52978.###
F:\Autorun.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-07 do 2010-05-07 )))))))))))))))))))))))))))))))
.

2010-05-07 15:20 . 2010-05-07 15:24 -------- d-----w- c:\users\admin\AppData\Local\temp
2010-05-07 11:11 . 2010-05-07 11:11 -------- d-----w- c:\program files\trend micro
2010-05-07 09:40 . 2010-05-07 09:40 6144 ----a-w- c:\programdata\Spyware Terminator\sp_rsdel.exe
2010-05-07 09:40 . 2010-05-07 09:40 5632 ----a-w- c:\programdata\Spyware Terminator\fileobjinfo.sys
2010-05-07 09:40 . 2010-05-07 09:40 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-05-07 09:40 . 2010-05-07 09:43 -------- d-----w- c:\users\admin\AppData\Roaming\Spyware Terminator
2010-05-07 09:40 . 2010-05-07 09:57 -------- d-----w- c:\programdata\Spyware Terminator
2010-05-07 09:40 . 2010-05-07 13:12 -------- d-----w- c:\program files\Spyware Terminator
2010-05-07 09:38 . 2010-05-07 09:38 -------- d-----w- c:\programdata\Malwarebytes
2010-05-07 09:38 . 2010-05-07 15:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-07 08:47 . 2010-05-07 08:47 -------- d---a-w- c:\windows\VDLL.DLL
2010-05-07 08:47 . 2010-05-07 08:47 -------- d---a-w- c:\windows\system32\runouce.exe
2010-05-07 08:47 . 2010-05-07 08:47 -------- d---a-w- c:\windows\RUNDL132.EXE
2010-05-07 08:47 . 2010-05-07 08:47 -------- d---a-w- c:\windows\logo_1.exe
2010-05-07 08:44 . 2010-05-07 08:44 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-05-07 08:44 . 2010-05-07 08:44 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-05-07 08:44 . 2010-05-07 08:44 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-05-07 08:44 . 2010-05-07 08:44 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-05-07 08:44 . 2010-05-07 08:44 -------- d-----w- c:\programdata\MicroWorld
2010-05-06 20:26 . 2010-05-06 20:26 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-06 20:24 . 2010-05-06 20:21 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-05-06 20:21 . 2010-05-06 20:37 -------- d-----w- c:\programdata\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-07 15:21 . 2007-02-12 11:00 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-07 12:53 . 2008-02-02 14:31 -------- d-----w- c:\program files\CCleaner
2010-05-07 12:52 . 2010-02-19 16:56 -------- d-----w- c:\program files\uTorrent
2010-05-07 11:15 . 2007-01-08 21:12 498342 ----a-w- c:\windows\system32\perfh005.dat
2010-05-07 11:15 . 2007-01-08 21:12 91778 ----a-w- c:\windows\system32\perfc005.dat
2010-05-07 10:11 . 2009-03-29 09:42 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-05-07 08:23 . 2007-07-12 08:57 -------- d-----w- c:\programdata\Microsoft Help
2010-05-06 23:51 . 2009-07-10 19:55 -------- d-----w- c:\program files\The KMPlayer
2010-05-06 23:16 . 2007-07-12 09:05 -------- d-----w- c:\program files\PDF Complete
2010-05-06 23:12 . 2007-07-12 09:03 -------- d-----w- c:\program files\Microsoft Small Business
2010-05-06 23:01 . 2008-02-03 14:33 -------- d-----w- c:\program files\Microsoft Games
2010-05-06 23:01 . 2008-02-17 22:03 -------- d-----w- c:\program files\IZArc
2010-05-06 23:00 . 2007-07-12 09:49 -------- d-----w- c:\program files\Hp
2010-05-06 23:00 . 2007-07-12 08:24 -------- d-----w- c:\program files\Hewlett-Packard
2010-05-06 21:40 . 2007-07-12 09:20 -------- d-----w- c:\program files\Common Files\LightScribe
2010-03-31 01:58 . 2006-09-21 12:28 133616 ------w- c:\windows\system32\PxAFS.DLL
2008-03-01 18:52 . 2008-03-01 18:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-05-07 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-13 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-13 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-13 129560]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-04-14 536576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-09 44168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2008-04-14 05:19 536576 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 ATE_PROCMON;ATE_PROCMON;c:\program files\Anti Trojan Elite\ATEPMon.sys [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S1 aswSP;avast! Self Protection; [x]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2010-05-07 142592]
S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2006-11-02 22016]
S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2006-11-02 22016]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2007-01-05 18944]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2007-05-08 540448]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2008-01-10 5120]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-26 179712]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
.
Obsah adresáře 'Naplánované úlohy'

2010-05-07 c:\windows\Tasks\User_Feed_Synchronization-{8A2538FA-A777-4208-B00B-E58FD98163CA}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9lk6vi2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9lk6vi2.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll
FF - component: c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9lk6vi2.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
MSConfigStartUp-PDF Complete - c:\program files\PDF Complete\pdfsty.exe
MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-WAWifiMessage - c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
ActiveSetup-{10880D85-AAD9-4558-ABDC-2AB1552D831F} - c:\program files\Common Files\LightScribe\LSRunOnce.exe
AddRemove-{290B83AA-093A-45BF-A917-D1C4A1E8D917} - c:\program files\InstallShield Installation Information\{290B83AA-093A-45BF-A917-D1C4A1E8D917}\setup.exe
AddRemove-{34D2AB40-150D-475D-AE32-BD23FB5EE355} - c:\program files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe
AddRemove-{F0A37341-D692-11D4-A984-009027EC0A9C} - c:\program files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe



**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(2120)
c:\windows\system32\APSHook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Hewlett-Packard\IAM\bin\asghost.exe
c:\windows\system32\conime.exe
c:\windows\system32\AEADISRV.EXE
c:\windows\system32\agrsmsvc.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\SMINST\scheduler.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Celkový čas: 2010-05-07 17:31:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-07 15:30

Před spuštěním: Volných bajtů: 60 008 230 912
Po spuštění: Volných bajtů: 59 969 150 976

- - End Of File - - F1E2B415B2CDA0729F287CA822BCB8ED

[wgs]

Tak situaci jsem nakonec vyřešil trochu brutálněji, format C, takže problém je neaktuální. Přesto velké díky za snahu.

[Unlimited_Killer]

Taky možnost.
Ale já se Vám chci omluvit, za to, že jsem nereagoval ihned, neměl jsem moc času.
Bohužel tedy není zač.