pro vyosek

[hannah11]

screen?

Problém ActiveX/com ehGLID.GLIDPlugInUDCR - {C3F8B282-5B69-47F0-80C3-A22A97FF2EB5} HKCR\ehGLID.GLIDPlugInUDCR

Problém ActiveX/com ehGLID.GLIDPlugInUDCR.1 - {C3F8B282-5B69-47F0-80C3-A22A97FF2EB5} HKCR\ehGLID.GLIDPlugInUDCR.1


Logfile of random's system information tool 1.08 (written by random/random)
Run by Hanka at 2010-08-22 17:04:32
Microsoft Windows 7 Home Premium
System drive C: has 45 GB (43%) free of 102 GB
Total RAM: 1791 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:04:59, on 22.8.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\AsScrPro.exe
C:\Program Files\ASUS\Asus WebStorage\BackupService.exe
C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\ASUS\LivCam\LivCam.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Hanka\AppData\Local\Seznam.cz\postak.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\ASUS\Asus WebStorage\EeeStorageUploader.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\windows\system32\SearchFilterHost.exe
C:\Users\Hanka\Downloads\RSIT.exe
C:\Program Files\trend micro\Hanka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: ArcIEVideoUp - {4E18E9A4-95B3-4F8B-AE3B-AB7478DE92EE} - C:\PROGRA~1\ArcSoft\TOTALM~1\codec\ArcIEVideoUp.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HotkeyMon] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
O4 - HKLM\..\Run: [HotkeyService] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
O4 - HKLM\..\Run: [SuperHybridEngine] AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EeeStorageBackup] C:\Program Files\ASUS\Asus WebStorage\BackupService.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe autorun
O4 - HKLM\..\Run: [LiveUpdate] AsusSender.exe C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto
O4 - HKLM\..\Run: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKLM\..\Run: [DTRun] C:\Program Files\ArcSoft\TotalMedia Theatre 3\uDTRun.exe
O4 - HKLM\..\Run: [LivCam] "C:\Program Files\ASUS\LivCam\LivCam.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [OOBESetup] C:\Program Files\asus\OOBERegBackup\OOBERegBackup.exe /restore -"C:\Program Files\asus\OOBERegBackup\OOBEReg.ini"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Seznam Postak] "C:\Users\Hanka\AppData\Local\Seznam.cz\postak.exe" -s
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B27A386C-6BDF-4780-9150-1FC0732DE136}: NameServer = 62.141.0.2 88.86.110.18
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Asus Launcher Service (AsusService) - Unknown owner - C:\Windows\System32\AsusService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: FsUsbExService - Teruten - C:\windows\system32\FsUsbExService.Exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Oberon Media Game Console service (OberonGameConsoleService) - Unknown owner - C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8789 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-07-15 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E18E9A4-95B3-4F8B-AE3B-AB7478DE92EE}]
ArcSoft Video Helper - C:\PROGRA~1\ArcSoft\TOTALM~1\codec\ArcIEVideoUp.dll [2009-09-10 113152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-03 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-07-20 1545512]
"HotkeyMon"=AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe []
"HotkeyService"=AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe []
"SuperHybridEngine"=AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe []
"ASUS Screen Saver Protector"=C:\Windows\AsScrPro.exe [2009-11-04 3058304]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-28 35696]
"EeeStorageBackup"=C:\Program Files\ASUS\Asus WebStorage\BackupService.exe [2009-08-25 947472]
"UCam_Menu"=C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]
"Eee Docking"=C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [2009-09-26 402608]
"LiveUpdate"=AsusSender.exe C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto []
"SynAsusAcpi"=C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [2009-07-20 83240]
"DTRun"=C:\Program Files\ArcSoft\TotalMedia Theatre 3\uDTRun.exe [2009-08-18 512000]
"LivCam"=C:\Program Files\ASUS\LivCam\LivCam.exe [2009-10-17 284160]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-09-29 7744032]
"OOBESetup"=C:\Program Files\asus\OOBERegBackup\OOBERegBackup.exe [2009-09-30 338096]
"avast!"=C:\Program Files\Alwil Software\Avast4\ashDisp.exe [2009-11-25 81000]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-07-12 74752]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"NPSStartup"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"Seznam Postak"=C:\Users\Hanka\AppData\Local\Seznam.cz\postak.exe [2010-03-01 451224]
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-12-17 116056]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-08-09 133432]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-22 17:04:32 ----D---- C:\rsit
2010-08-22 15:28:24 ----D---- C:\Users\Hanka\AppData\Roaming\Malwarebytes
2010-08-22 15:28:13 ----A---- C:\windows\system32\drivers\mbamswissarmy.sys
2010-08-22 15:28:10 ----D---- C:\ProgramData\Malwarebytes
2010-08-22 15:28:10 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-08-22 15:28:10 ----A---- C:\windows\system32\drivers\mbam.sys
2010-08-18 20:46:35 ----D---- C:\Program Files\Defraggler
2010-08-18 20:36:00 ----D---- C:\Program Files\CCleaner
2010-08-17 21:14:13 ----D---- C:\Program Files\trend micro
2010-08-13 17:28:40 ----A---- C:\windows\system32\drivers\tcpip.sys
2010-08-13 17:27:39 ----A---- C:\windows\system32\ir32_32.dll
2010-08-13 17:27:39 ----A---- C:\windows\system32\iccvid.dll
2010-08-13 17:27:33 ----A---- C:\windows\system32\rtutils.dll
2010-08-13 17:27:26 ----A---- C:\windows\system32\msxml3.dll
2010-08-13 17:27:22 ----A---- C:\windows\system32\drivers\srv2.sys
2010-08-13 17:27:22 ----A---- C:\windows\system32\drivers\srv.sys
2010-08-13 17:27:21 ----A---- C:\windows\system32\drivers\srvnet.sys
2010-08-13 17:27:00 ----A---- C:\windows\system32\mshtml.dll
2010-08-13 17:26:58 ----A---- C:\windows\system32\ieframe.dll
2010-08-13 17:26:54 ----A---- C:\windows\system32\urlmon.dll
2010-08-13 17:26:53 ----A---- C:\windows\system32\wininet.dll
2010-08-13 17:26:52 ----A---- C:\windows\system32\iepeers.dll
2010-08-13 17:26:51 ----A---- C:\windows\system32\mstime.dll
2010-08-13 17:26:51 ----A---- C:\windows\system32\iedkcs32.dll
2010-08-13 17:26:50 ----A---- C:\windows\system32\msfeedsbs.dll
2010-08-13 17:26:50 ----A---- C:\windows\system32\ieui.dll
2010-08-13 17:26:49 ----A---- C:\windows\system32\msfeedssync.exe
2010-08-13 17:26:49 ----A---- C:\windows\system32\jsproxy.dll
2010-08-13 17:26:16 ----A---- C:\windows\system32\ntkrnlpa.exe
2010-08-13 17:26:13 ----A---- C:\windows\system32\ntoskrnl.exe
2010-08-13 17:26:04 ----A---- C:\windows\system32\schannel.dll
2010-08-13 17:26:00 ----A---- C:\windows\system32\win32k.sys
2010-08-03 19:07:57 ----A---- C:\windows\system32\shell32.dll
2010-07-23 18:11:32 ----D---- C:\Program Files\Common Files\Skype

======List of files/folders modified in the last 1 months======

2010-08-22 17:04:52 ----D---- C:\windows\Temp
2010-08-22 17:04:46 ----D---- C:\windows\Prefetch
2010-08-22 16:59:32 ----D---- C:\Windows
2010-08-22 16:57:16 ----D---- C:\windows\system32\config
2010-08-22 15:28:13 ----D---- C:\windows\system32\drivers
2010-08-22 15:28:10 ----RD---- C:\Program Files
2010-08-22 15:28:10 ----HD---- C:\ProgramData
2010-08-22 15:20:55 ----D---- C:\windows\system32\drivers\etc
2010-08-22 15:20:55 ----D---- C:\Program Files\Windows Live
2010-08-22 13:16:40 ----D---- C:\Users\Hanka\AppData\Roaming\ICQ
2010-08-21 21:53:59 ----SHD---- C:\System Volume Information
2010-08-19 21:03:34 ----D---- C:\windows\System32
2010-08-19 21:03:34 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-08-19 21:03:33 ----D---- C:\windows\inf
2010-08-19 20:43:00 ----D---- C:\Users\Hanka\AppData\Roaming\Skype
2010-08-19 20:42:00 ----D---- C:\Users\Hanka\AppData\Roaming\skypePM
2010-08-18 22:11:59 ----SHD---- C:\windows\Installer
2010-08-18 22:11:54 ----D---- C:\Program Files\Opera
2010-08-18 20:37:04 ----D---- C:\windows\debug
2010-08-18 20:21:50 ----D---- C:\windows\winsxs
2010-08-15 20:21:38 ----D---- C:\windows\Microsoft.NET
2010-08-15 20:21:01 ----RSD---- C:\windows\assembly
2010-08-14 15:19:05 ----D---- C:\Program Files\ICQ7.0
2010-08-13 23:16:43 ----D---- C:\Program Files\Internet Explorer
2010-08-13 23:16:42 ----D---- C:\windows\system32\migration
2010-08-13 18:25:07 ----D---- C:\ProgramData\Microsoft Help
2010-08-13 17:25:51 ----D---- C:\windows\system32\catroot
2010-08-13 17:25:38 ----D---- C:\windows\system32\catroot2
2010-08-06 17:55:01 ----D---- C:\windows\system32\wdi
2010-08-03 20:09:31 ----A---- C:\windows\system32\MRT.exe
2010-07-26 19:21:00 ----D---- C:\Program Files\Mozilla Firefox
2010-07-23 18:11:45 ----D---- C:\windows\system32\Tasks
2010-07-23 18:11:32 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 AsUpIO;AsUpIO; C:\windows\system32\drivers\AsUpIO.sys [2009-07-06 11448]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\windows\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328]
R3 BthEnum;Bluetooth Request Block Driver; C:\windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 btusbflt;Bluetooth USB Filter; C:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]
R3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys [2009-07-01 86056]
R3 btwavdt;Bluetooth AVDT Service; C:\windows\system32\DRIVERS\btwavdt.sys [2009-07-01 108072]
R3 btwl2cap;Bluetooth L2CAP Service; C:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys [2009-07-01 18344]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\windows\system32\FsUsbExDisk.SYS [2009-12-14 36608]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2009-09-29 2776672]
R3 kbfiltr;Keyboard Filter; C:\windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 13880]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\windows\system32\drivers\nvhda32v.sys [2009-08-11 66592]
R3 nvsmu;nvsmu; C:\windows\system32\DRIVERS\nvsmu.sys [2009-06-28 17920]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver; C:\windows\system32\DRIVERS\rtl8192se.sys [2010-03-02 1006624]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2009-07-20 213552]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athr.sys [2009-10-05 1221632]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BTHPORT;Bluetooth Port Driver; C:\windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
S3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 sisagp;SIS AGP Bus Filter; C:\windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-21 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-21 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-21 121856]
S3 viaagp;VIA AGP Bus Filter; C:\windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AsusService;Asus Launcher Service; C:\Windows\System32\AsusService.exe [2009-08-19 219136]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-08-03 582944]
R2 FsUsbExService;FsUsbExService; C:\windows\system32\FsUsbExService.Exe [2009-12-17 238952]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-08-07 211488]
R2 OberonGameConsoleService;Oberon Media Game Console service; C:\Program Files\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [2009-09-15 44312]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-27 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2010-05-27 1343400]

-----------------EOF-----------------

[vyosek]

Screen kdyz CCleaner ty problemy najde (navod na screen http://www.viry.cz/forum/viewtopic.php?f=15&t=14114).Pise proc je nedokaze odstranit

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

• Do okna vlozte skript nize

• Kód: Vybrat vše

  :regfind
  {C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}
  {C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}

• Kliknete na Look
• Tlacitko Look se zmeni na Scanning a zsedne
• Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
• Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

[hannah11]

ale nemám v počítači malování, takže mi screen stejně nepůjde, jinak nepíše, proč je nedokáže odstranit

[vyosek]

Nevadi, soupnete sem ten SystemLook a odstranime je jinak

[hannah11]

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 17:25 on 22/08/2010 by Hanka (Administrator - Elevation successful)

========== regfind ==========

Searching for "{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"

Searching for "{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"

-=End Of File=-

[vyosek]

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}]
  
  :commands
  [EMPTYTEMP]
  

• Kliknete na cervene tlacitko MoveIt!
• Sem pote dejte obsah okna Results (pod zelenou carou)
• Pokud budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles

[hannah11]

ll processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hanka
->Temp folder emptied: 1562331 bytes
->Temporary Internet Files folder emptied: 66072 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 34603729 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3262 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 35,00 mb


OTM by OldTimer - Version 3.1.15.0 log created on 08222010_174414

Files moved on Reboot...
File move failed. C:\windows\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[vyosek]

Tak jinak, tohle mazani nepomohl

Skript pro SystemLook

Kód: Vybrat vše

:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID /sub
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID /sub

log opet sem...

Je to zdlouhave, ale domazavani registru neni sranda, chce to peclivost

[hannah11]

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 16:54 on 23/08/2010 by Hanka (Administrator - Elevation successful)

========== reg ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID]
@="{C3F8B282-5B69-47F0-80C3-A22A97FF2EB5}"


-=End Of File=-

[vyosek]

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID]
  
  :commands
  [EMPTYTEMP]
  

• Kliknete na cervene tlacitko MoveIt!
• Sem pote dejte obsah okna Results (pod zelenou carou)
• Pokud budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles

[hannah11]

All processes killed
========== REGISTRY ==========
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\ scheduled to be deleted on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hanka
->Temp folder emptied: 2020676 bytes
->Temporary Internet Files folder emptied: 4835819 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 85957207 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 3077 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16632 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 89,00 mb


OTM by OldTimer - Version 3.1.15.0 log created on 08242010_184916

Files moved on Reboot...
File move failed. C:\windows\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID\ scheduled to be deleted on reboot.

[vyosek]

Stahnete Avenger (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na Avenger pravym a dejte Run As Administrator ci Spustit jako spravce
• Po spusteni Vas program upozorni, ze vse co delate, delate na vlastni riziko - Dejte OK
• Po potvrzeni uz na Vas koukne hlavni okno, kam vlozite skript, ktery mate nize

• Kód: Vybrat vše

  Registry keys to delete:
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID

• Do ctverecku u Scan for rootkits a Automatically disable any rootkits found dejte fajecku
• Nyni uz kliknete na Execute a potvrdte Yes v nasledujicim okne - timto potvrdite spusteni skriptu
• Na otazku Reboot now odpovezte opet OK - timto se PC restartuje
• Po restartu by se mel otevrit poznamkovy blok s logem a jeho obsah vlozte sem. Pokud se tak nestane, naleznete pozadovany dokument v C:\avenger.txt

[hannah11]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR.1\CLSID" deleted successfully.
Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInUDCR\CLSID" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[vyosek]

Tak Avenger to dokazal smazat

Procistete registry CCleanerem a dejte vedet jak to vypada s PC

[hannah11]

tak už snad dobrý, ještě jsem se chtěla zeptat, zda-li už zmizel ten Windows live toolbar?