RelevantKnowledge a mozna i neco vic.

Zpráva

PachezZ · #1 Příspěvek od **PachezZ** » 22 zář 2010 22:25

Dravím pánové. Objevil sem v pc tenhle smejd, snazil sem se ho s pomoci internetu odstranit sám nicméně nakonec sem usoudil že se obrátím na Vás, odbornější.
Hlavní problém je že připojení jde hlemýždím tempem i po všech krocích co jsem již udělal. Přehrát si něco na youtube či soundcloudu je nemožný. Stáhnout nějaký anti-malware nastroj o veliksoti několika MB taky... downloady se vyšlhají na rychlost maximálně 15 kB/s a většinou se stejně v půlce přeruší. Web jakžtakž prohlížet jde. IRC, jabber taky...

zde log z RSIT:

Kód: Vybrat vše

Logfile of random's system information tool 1.08 (written by random/random)
Run by PachezZ at 2010-09-22 23:09:14
Microsoft Windows 7 Ultimate  
System drive C: has 5 GB (7%) free of 65 GB
Total RAM: 2807 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:10:15, on 22.9.2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Users\PachezZ\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\!miranda 2010\miranda32.exe
C:\Program Files (x86)\Opera\opera.exe
C:\totalcmd\TOTALCMD.EXE
G:\Downloads\HijackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files\trend micro\PachezZ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Microsoft copyright - {32C620D6-CC10-4e6a-9715-BACACD5B0E61} - sxmg4.dll (file missing)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\PachezZ\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = PachezZ\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files (x86)\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files (x86)\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\coolhandMPP\MPPoker.exe (file missing) (HKCU)
O16 - DPF: Justin.tv Publisher - http://www.justin.tv/plugins/justintv_publisher.CAB
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://kitchenplanner.ikea.com/CZ/Core/Player/2020PlayerAX_Win32.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O21 - SSODL: WebProxy - {A744F16C-B2D5-4138-81A2-085CDFCDE83A} - sxmg4.dll (file missing)
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\SysWow64\DreamScene.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Unsigned Themes (UnsignedThemes) - The Within Network, LLC - C:\Windows\UnsignedThemesSvc.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Unknown owner - C:\Windows\System32\Drivers\WTSRV.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8815 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\UnsignedThemesSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe"
"C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe"
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe"
"C:\Windows\System32\Drivers\WTSRV.EXE"
C:\Windows\system32\svchost.exe -k bthsvcs
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-45f51fed-5082-4080-bfef-3ce99b4795e5 -SystemEventPortName:HostProcess-7e7fbc9b-1c6d-4275-b4de-670365a8f6ec -IoCancelEventPortName:HostProcess-e02b85f4-1db1-40d9-8a87-668a048f59f1 -NonStateChangingEventPortName:HostProcess-ba41a9bb-5f0d-44b2-9687-0deb3c01fee0 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8bcc6297-8086-428f-95c8-749e686b4925
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe" 
"C:\Users\PachezZ\AppData\Roaming\Dropbox\bin\Dropbox.exe" 
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"C:\!miranda 2010\miranda32.exe" 
"C:\Program Files (x86)\Opera\opera.exe" 
"C:\totalcmd\TOTALCMD.EXE" 
"C:\Windows\regedit.exe" 
"C:\Windows\system32\cmd.exe" 
\??\C:\Windows\system32\conhost.exe
C:\Windows\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding
C:\Windows\system32\DllHost.exe /Processid:{A4B07E49-6567-4FB8-8D39-01920E3B2357}
"C:\Windows\system32\taskmgr.exe" /4
"G:\Downloads\HijackThis.exe" 
"C:\Windows\system32\NOTEPAD.EXE" G:\Downloads\hijackthis.log
taskhost.exe $(Arg0)
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" 
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524 
"G:\Downloads\RSITx64.exe" 
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1870494541-2806494135-1199450710-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1870494541-2806494135-1199450710-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32C620D6-CC10-4e6a-9715-BACACD5B0E61}]
Microsoft copyright - sxmg4.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-03-24 2184520]
"CanonSolutionMenu"=C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"Google Update"=C:\Users\PachezZ\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-31 135664]
"mRouterConfig"=C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe [2006-03-02 290816]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"PC Suite for Smartphones"=C:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe [2007-12-25 548864]
"!AVG Anti-Spyware"=C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [2007-06-11 6731312]

C:\Users\PachezZ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\PachezZ\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-06-16 259072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2009-05-12 275360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDFSTab"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Windows\svchosts.exe"="C:\Windows\svchosts.exe:*:Enabled:Microsoft Corp"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2010-09-22 23:09:15 ----D---- C:\Program Files\trend micro
2010-09-22 23:09:14 ----D---- C:\rsit
2010-09-22 20:41:16 ----A---- C:\Windows\SYSWOW64\WFD_List.ini
2010-09-22 20:32:15 ----SHD---- C:\Config.Msi
2010-09-22 19:08:30 ----D---- C:\Users\PachezZ\AppData\Roaming\Grisoft
2010-09-22 19:08:23 ----A---- C:\Windows\system32\drivers\AvgAsC64.sys
2010-09-22 19:08:22 ----D---- C:\ProgramData\Grisoft
2010-09-22 19:08:22 ----D---- C:\Program Files (x86)\Grisoft
2010-09-22 18:33:14 ----D---- C:\ProgramData\Sun
2010-09-22 18:33:05 ----A---- C:\Windows\SYSWOW64\javaws.exe
2010-09-22 18:33:05 ----A---- C:\Windows\SYSWOW64\javaw.exe
2010-09-22 18:33:05 ----A---- C:\Windows\SYSWOW64\java.exe
2010-09-22 18:33:05 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2010-09-22 18:17:39 ----ASH---- C:\pagefile.sys
2010-09-04 15:08:48 ----D---- C:\Users\PachezZ\AppData\Roaming\HD Tune Pro
2010-09-04 12:14:05 ----D---- C:\Program Files (x86)\HD Tune Pro
2010-09-03 03:07:37 ----D---- C:\Users\PachezZ\AppData\Roaming\innoPlus
2010-09-03 03:01:49 ----D---- C:\Program Files (x86)\INNOVA-engineering GmbH
2010-09-03 02:19:20 ----D---- C:\Windows\SYSWOW64\20-20 Technologies
2010-09-02 22:34:44 ----HD---- C:\ProgramData\CanonIJScan
2010-09-02 22:34:11 ----D---- C:\Users\PachezZ\AppData\Roaming\Canon
2010-08-21 20:47:13 ----D---- C:\Program Files\temp
2010-08-21 20:46:45 ----D---- C:\Windows\SYSWOW64\Plugins
2010-08-21 20:46:45 ----D---- C:\Windows\SYSWOW64\ocr
2010-08-21 20:46:45 ----D---- C:\Windows\SYSWOW64\Data
2010-08-21 20:46:45 ----D---- C:\Program Files (x86)\Ford Racing 3.exe
2010-08-21 20:07:45 ----D---- C:\Program Files (x86)\Empire Interactive
2010-08-10 16:06:20 ----D---- C:\obnova
2010-08-10 15:46:21 ----D---- C:\Program Files\Recuva
2010-08-09 18:25:23 ----D---- C:\Program Files\Canon
2010-08-09 18:25:10 ----HD---- C:\ProgramData\CanonBJ
2010-08-09 18:25:03 ----HD---- C:\Windows\system32\CanonIJ Uninstaller Information
2010-08-09 18:24:56 ----A---- C:\Windows\SYSWOW64\CNHMCA.dll
2010-08-09 18:24:56 ----A---- C:\Windows\SYSWOW64\CNC560U.dll
2010-08-09 18:24:56 ----A---- C:\Windows\SYSWOW64\CNC560L.dll
2010-08-09 18:24:56 ----A---- C:\Windows\system32\CNHMCA6.dll
2010-08-09 18:24:56 ----A---- C:\Windows\system32\CNC560L.dll
2010-08-09 18:24:56 ----A---- C:\Windows\system32\CNC560I.dll
2010-08-09 18:24:56 ----A---- C:\Windows\system32\CNC560C.dll
2010-08-09 18:24:45 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-08-09 18:24:41 ----A---- C:\Windows\system32\CNC560O.dll
2010-08-09 18:24:38 ----A---- C:\Windows\system32\CNMIUA0.DLL
2010-08-09 18:24:31 ----HD---- C:\Program Files\CanonBJ
2010-08-09 18:24:18 ----D---- C:\Windows\system32\STRING
2010-08-09 18:24:18 ----A---- C:\Windows\system32\CNMN6UI.DLL
2010-08-09 18:24:18 ----A---- C:\Windows\system32\CNMN6PPM.DLL
2010-08-09 18:24:17 ----D---- C:\Windows\system32\CHM
2010-08-09 18:22:59 ----D---- C:\Program Files (x86)\Canon
2010-07-27 19:20:42 ----D---- C:\ProgramData\HappyFoto
2010-07-27 19:20:12 ----D---- C:\Program Files (x86)\HappyFoto
2010-07-20 00:45:37 ----D---- C:\Program Files (x86)\BookSmart
2010-07-06 09:15:23 ----D---- C:\Users\PachezZ\AppData\Roaming\MapBuilder
2010-07-06 09:11:51 ----D---- C:\Users\PachezZ\AppData\Roaming\QuickGPS
2010-07-05 21:10:20 ----D---- C:\Users\PachezZ\AppData\Roaming\NAVIGON Fresh
2010-07-05 21:08:08 ----D---- C:\Program Files (x86)\NAVIGON

======List of files/folders modified in the last 3 months======

2010-09-22 23:10:13 ----D---- C:\Windows\Temp
2010-09-22 23:09:15 ----RD---- C:\Program Files
2010-09-22 22:33:21 ----D---- C:\Program Files (x86)\RelevantKnowledge
2010-09-22 22:25:26 ----D---- C:\Users\PachezZ\AppData\Roaming\Dropbox
2010-09-22 22:19:56 ----D---- C:\Windows\system32\NDF
2010-09-22 21:57:32 ----D---- C:\Users\PachezZ\AppData\Roaming\Teleca
2010-09-22 21:54:05 ----D---- C:\Users\PachezZ\AppData\Roaming\foobar2000
2010-09-22 20:50:46 ----D---- C:\Windows\WindowsMobile
2010-09-22 20:50:25 ----RD---- C:\Program Files (x86)
2010-09-22 20:50:24 ----D---- C:\Windows\SysWOW64
2010-09-22 20:49:40 ----SHD---- C:\Windows\Installer
2010-09-22 20:49:38 ----D---- C:\Windows\system32\catroot2
2010-09-22 20:49:38 ----D---- C:\Windows\system32\catroot
2010-09-22 20:49:36 ----D---- C:\Windows\system32\DriverStore
2010-09-22 20:49:35 ----D---- C:\Windows\inf
2010-09-22 20:48:35 ----D---- C:\Windows\system32\config
2010-09-22 20:48:17 ----SHD---- C:\System Volume Information
2010-09-22 20:47:49 ----D---- C:\Windows\winsxs
2010-09-22 20:45:21 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-09-22 20:41:31 ----D---- C:\Windows\SYSWOW64\WinFast
2010-09-22 20:41:19 ----D---- C:\Windows\system32\drivers
2010-09-22 20:41:03 ----DC---- C:\Windows\system32\DRVSTORE
2010-09-22 20:40:17 ----D---- C:\Windows
2010-09-22 20:39:11 ----D---- C:\ProgramData\InstallShield
2010-09-22 20:37:13 ----D---- C:\Program Files (x86)\Nokia
2010-09-22 20:37:13 ----D---- C:\Program Files (x86)\Common Files
2010-09-22 20:35:21 ----D---- C:\Windows\System32
2010-09-22 20:33:25 ----D---- C:\ProgramData\Installations
2010-09-22 20:31:04 ----D---- C:\Program Files (x86)\ChrisTV PVR
2010-09-22 20:13:40 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-22 20:09:19 ----D---- C:\Windows\system32\appmgmt
2010-09-22 19:08:22 ----HD---- C:\ProgramData
2010-09-22 18:53:26 ----D---- C:\Windows\Prefetch
2010-09-22 18:33:01 ----D---- C:\Program Files (x86)\Java
2010-09-21 21:40:20 ----D---- C:\Users\PachezZ\AppData\Roaming\gtk-2.0
2010-09-20 14:06:13 ----D---- C:\Windows\system32\FxsTmp
2010-09-19 01:23:12 ----D---- C:\Windows\system32\wdi
2010-09-13 19:04:41 ----D---- C:\Program Files (x86)\Opera
2010-09-04 16:39:03 ----D---- C:\Windows\Minidump
2010-09-03 02:19:21 ----D---- C:\Windows\Downloaded Program Files
2010-08-29 02:40:58 ----D---- C:\Users\PachezZ\AppData\Roaming\uTorrent
2010-08-09 18:27:51 ----RSD---- C:\Windows\Media
2010-08-09 18:27:47 ----D---- C:\Windows\twain_32
2010-06-24 23:50:43 ----D---- C:\Users\PachezZ\AppData\Roaming\dvdcss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver; \??\C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard64.sys [2007-05-30 12024]
R1 AvgAsC64;AVG Anti-Spyware Clean Driver; C:\Windows\System32\DRIVERS\AvgAsC64.sys [2007-05-30 14072]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [2009-02-10 115600]
R1 vmm;Virtual Machine Monitor; \??\C:\Windows\system32\Drivers\vmm.sys [2009-07-19 294248]
R2 uxpatch;uxpatch; \??\C:\Windows\system32\drivers\uxpatch.sys [2009-07-13 30568]
R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 79360]
R3 dc3d;MS Hardware Device Detection Driver; C:\Windows\system32\DRIVERS\dc3d.sys [2009-03-23 20992]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-05-06 6108416]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2005-03-29 8192]
R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2009-05-09 15752]
R3 PTSimBus;PenTablet Bus Enumerator; C:\Windows\system32\DRIVERS\PTSimBus.sys [2007-06-08 28672]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-06-21 34032]
R3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM); C:\Windows\system32\DRIVERS\zebrceb.sys [2010-06-21 81280]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-02-11 5352960]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 551936]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 PTSimHid;PenTablet Simulated HID MiniDriver; C:\Windows\system32\DRIVERS\PTSimHid.sys [2007-04-24 14336]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 Tablet2k;Serial Tablet Port Driver; C:\Windows\System32\Drivers\Tablet2k.sys [2007-04-16 26112]
S3 TClass2k;Tablet Class Driver; C:\Windows\system32\DRIVERS\TClass2k.sys [2007-04-16 28160]
S3 UCTblHid;HID Tablet Port Driver; C:\Windows\system32\DRIVERS\UCTblHid.sys [2007-06-01 18432]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WFLR6654;WinFast TV2000 XP Global/Global TV (Video); C:\Windows\system32\drivers\wfeaglxt.sys []
S3 zebrbus;Sony Ericsson Composite Device driver; C:\Windows\system32\DRIVERS\zebrbus.sys [2010-06-21 108544]
S3 zebrmdfl;Sony Ericsson Modem Filter; C:\Windows\system32\DRIVERS\zebrmdfl.sys [2010-06-21 18944]
S3 zebrmdm;Sony Ericsson Modem Driver; C:\Windows\system32\DRIVERS\zebrmdm.sys [2010-06-21 145408]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM); C:\Windows\system32\DRIVERS\zebrmdmc.sys [2010-06-21 145408]
S3 zebrsce;Sony Ericsson PC-Connect Port; C:\Windows\system32\DRIVERS\zebrsce.sys [2010-06-21 120832]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2010-03-06 72704]
R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard; C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe [2007-05-30 312880]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 UnsignedThemes;Unsigned Themes; C:\Windows\UnsignedThemesSvc.exe [2009-07-13 24168]
R2 WinTabService;WinTab Service; C:\Windows\System32\Drivers\WTSRV.EXE [2007-05-31 53248]
S2 mi-raysat_3dsmax9_32;mental ray 3.5 Satellite (32-bit); C:\Program Files (x86)\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe [2006-09-29 65536]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2010-02-11 952320]
S4 PSI_SVC_2;Protexis Licensing V2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]

-----------------EOF-----------------

#2 Příspěvek od **Rudy** » 23 zář 2010 16:07

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

PachezZ · #3 Příspěvek od **PachezZ** » 25 zář 2010 13:24

Tady to je.

Kód: Vybrat vše

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4674

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

25.9.2010 14:22:03
mbam-log-2010-09-25 (14-22-03).txt

Typ skenu: Úplný sken (C:\|D:\|E:\|F:\|G:\|M:\|P:\|)
Skenované objekty: 588764
Uplynulý čas: 1 hodina(y), 55 minuta(y), 23 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Users\PachezZ\AppData\Local\VirtualStore\Windows\SysWOW64\WindoŐs °p§aé˙ (Backdoor.MoSucker) -> No action taken.
G:\Downloads\BestSpywareScanner_Setup.exe (Rogue.BestSpywareScanner) -> No action taken.
G:\Downloads\miranda-v090a5w64\Plugins\scriver.dll (Adware.NaviPromo) -> No action taken.
M:\Users\PachezZ\AppData\Roaming\AD ON Multimedia\eBay Shortcuts\eBayShortcuts.exe (Adware.ADON) -> No action taken.

#4 Příspěvek od **Rudy** » 25 zář 2010 19:11

Vše, co MBAM nalezl, smažte.

VIRY.CZ

RelevantKnowledge a mozna i neco vic.

RelevantKnowledge a mozna i neco vic.

Re: RelevantKnowledge a mozna i neco vic.

Re: RelevantKnowledge a mozna i neco vic.

Re: RelevantKnowledge a mozna i neco vic.