Spusťte combofix podle tohoto návoduhttp://www.bleepingcomputer.com/combofi ... t-combofix
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
prosím o kontrolu logu,comp se neustále hryže
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: prosím o kontrolu logu,comp se neustále hryže
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: prosím o kontrolu logu,comp se neustále hryže
ComboFix 10-09-30.01 - mirek 30.09.2010 20:44:08.3.2 - x86
Spuštěný z: c:\users\mirek\Downloads\ComboFix.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-28 do 2010-09-30 )))))))))))))))))))))))))))))))
.
2010-09-30 18:50 . 2010-09-30 18:50 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-09-30 18:50 . 2010-09-30 18:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-16 06:38 . 2010-08-31 22:57 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D926AD6A-571D-4866-A605-E20346A58CDF}\gapaengine.dll
2010-09-15 20:18 . 2010-09-15 20:18 -------- d-----w- c:\users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 20:18 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-15 20:18 . 2010-09-15 20:18 -------- d-----w- c:\programdata\Malwarebytes
2010-09-15 20:18 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-15 20:18 . 2010-09-29 20:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-15 15:27 . 2010-09-15 15:27 -------- d-----w- c:\program files\WinDjView
2010-09-15 12:46 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-14 18:34 . 2010-09-29 19:57 -------- d-----w- c:\program files\trend micro
2010-09-13 10:35 . 2010-09-13 10:35 -------- d-----w- c:\program files\PowerDataRecovery
2010-09-12 20:29 . 2010-09-12 20:29 -------- d-----w- c:\program files\Flash File Recovery
2010-09-12 19:37 . 2010-09-12 19:37 -------- d-----w- c:\program files\GetData
2010-09-12 19:17 . 2010-09-12 23:27 -------- d-----w- c:\program files\RestoreDeletedFilesNow
2010-09-12 18:34 . 2010-09-12 18:34 34 ---ha-w- c:\windows\system32\Removable Data Recovery_sysquict.dat
2010-09-12 18:34 . 2010-09-12 18:34 -------- d-----w- C:\Removable Data Recovery
2010-09-09 18:24 . 2010-09-12 21:15 -------- d--h--w- c:\programdata\CanonIJScan
2010-09-09 18:24 . 2010-09-12 21:15 -------- d-----w- c:\users\mirek\AppData\Roaming\Canon
2010-09-09 18:03 . 2010-09-09 18:03 -------- d-----w- c:\program files\Common Files\CANON
2010-09-09 17:58 . 2008-08-25 16:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2010-09-09 17:57 . 2009-03-24 03:00 272384 ----a-w- c:\windows\system32\CNMLMA0.DLL
2010-09-09 17:57 . 2010-09-09 17:57 -------- d-----w- c:\windows\system32\STRING
2010-09-09 17:57 . 2009-04-03 16:51 137216 ----a-w- c:\windows\system32\CNMNPUI.DLL
2010-09-09 17:57 . 2009-04-03 16:51 353792 ----a-w- c:\windows\system32\CNMNPPM.DLL
2010-09-09 17:57 . 2010-09-09 17:57 -------- d-----w- c:\windows\system32\CHM
2010-09-09 17:56 . 2010-09-12 21:24 -------- d-----w- c:\program files\Canon
2010-09-09 17:07 . 2010-09-09 17:07 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-08-31 22:58 . 2010-08-31 22:57 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 18:38 . 2010-03-07 09:59 -------- d-----w- c:\users\mirek\AppData\Roaming\ICQ
2010-09-30 01:20 . 2010-03-07 10:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-30 01:18 . 2010-03-07 10:07 -------- d-----w- c:\users\mirek\AppData\Roaming\Skype
2010-09-29 22:04 . 2010-03-07 10:08 -------- d-----w- c:\users\mirek\AppData\Roaming\skypePM
2010-09-27 17:12 . 2010-03-07 17:55 1 ----a-w- c:\users\mirek\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-22 06:59 . 2010-03-07 09:47 628886 ----a-w- c:\windows\system32\perfh005.dat
2010-09-22 06:59 . 2010-03-07 09:47 121940 ----a-w- c:\windows\system32\perfc005.dat
2010-09-14 18:33 . 2010-03-12 07:01 -------- d-----w- c:\program files\trademanager
2010-09-12 21:35 . 2010-05-20 05:25 -------- d-----w- c:\program files\Google
2010-09-08 10:00 . 2010-03-11 07:17 72940376 ----a-w- c:\users\mirek\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
2010-09-07 15:12 . 2010-07-15 09:25 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-03-07 09:56 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-03-07 09:57 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-03-07 09:57 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-03-07 09:57 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-03-07 09:57 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-09-07 14:47 . 2010-03-07 09:57 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-08-25 18:35 . 2010-07-20 18:25 -------- d-----w- c:\program files\ICQ7.1
2010-08-23 16:35 . 2010-08-23 16:35 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-08-15 22:48 . 2010-08-15 18:31 2276 ----a-w- c:\users\mirek\AppData\Roaming\mdbu.bin
2010-08-15 21:02 . 2010-08-15 21:02 -------- d-----w- c:\users\mirek\AppData\Roaming\Happy Foto
2010-08-15 21:02 . 2010-08-15 21:02 -------- d-----w- c:\program files\HappyFoto
2010-08-15 20:06 . 2010-08-15 20:04 -------- d-----w- c:\program files\PDFCreator
2010-08-15 19:34 . 2010-08-15 19:34 -------- d-----w- c:\users\mirek\AppData\Roaming\ABBYY
2010-08-15 19:32 . 2010-08-15 19:19 -------- d-----w- c:\program files\ABBYY FineReader 10
2010-08-15 19:24 . 2010-08-15 19:24 -------- d-----w- c:\program files\Common Files\ABBYY
2010-08-15 19:19 . 2010-08-15 19:19 -------- d-----w- c:\programdata\ABBYY
2010-08-15 18:31 . 2010-08-15 18:30 -------- d-----w- c:\users\mirek\AppData\Roaming\GetRightToGo
2010-08-15 18:14 . 2010-08-15 18:09 -------- d-----w- c:\users\mirek\AppData\Roaming\gtk-2.0
2010-08-15 18:10 . 2010-04-25 15:14 -------- d-----w- c:\users\mirek\AppData\Roaming\VSO
2010-07-29 06:30 . 2010-08-11 12:44 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:44 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-16 10:55 . 2010-07-16 10:55 239104 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libtheora0.dll
2010-07-16 10:55 . 2010-07-16 10:55 170496 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libspeex0.dll
2010-07-16 10:55 . 2010-07-16 10:55 107008 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libspeexdsp0.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
2010-06-26 21:03 88960 ----a-w- c:\program files\Microsoft Security Client\Antimalware\MpBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
"ICQ"="c:\program files\ICQ7.1\ICQ.exe" [2010-08-22 133432]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-3-7 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\mirek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
2009-12-22 04:29 222552 ----a-w- c:\program files\trademanager\AliIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
2009-07-07 14:29 282624 ----a-w- c:\program files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
2009-12-24 06:57 941320 ----a-w- c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 17:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2010-07-14 13:26 957776 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:45 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-02-05 12:45 385856 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 17:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-07-14 01:14 1173504 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2009-10-26 12:46 1458176 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ser2at;ATEN USB to Serial port driver;c:\windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
S1 aswSP;aswSP; [x]
S2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-21 814344]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
--- Ostatní služby/ovladače v paměti ---
*Deregistered* - MBAMSwissArmy
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
Trusted Zone: alipay.com
Trusted Zone: alisoft.com
Trusted Zone: taobao.com
TCP: {078E2232-B641-4B50-8845-BFDE625BEE55} = 192.168.42.1,81.19.33.2
FF - ProfilePath - c:\users\mirek\AppData\Roaming\Mozilla\Firefox\Profiles\xafodm85.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npww.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\Wat\npWatWeb.dll
.
.
Celkový čas: 2010-09-30 20:53:14
ComboFix-quarantined-files.txt 2010-09-30 18:53
Před spuštěním: Volných bajtů: 36 165 107 712
Po spuštění: Volných bajtů: 36 143 837 184
- - End Of File - - 630BB6D5BFCEEC0A13216FBE51763198
Spuštěný z: c:\users\mirek\Downloads\ComboFix.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-28 do 2010-09-30 )))))))))))))))))))))))))))))))
.
2010-09-30 18:50 . 2010-09-30 18:50 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-09-30 18:50 . 2010-09-30 18:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-16 06:38 . 2010-08-31 22:57 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D926AD6A-571D-4866-A605-E20346A58CDF}\gapaengine.dll
2010-09-15 20:18 . 2010-09-15 20:18 -------- d-----w- c:\users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 20:18 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-15 20:18 . 2010-09-15 20:18 -------- d-----w- c:\programdata\Malwarebytes
2010-09-15 20:18 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-15 20:18 . 2010-09-29 20:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-15 15:27 . 2010-09-15 15:27 -------- d-----w- c:\program files\WinDjView
2010-09-15 12:46 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-14 18:34 . 2010-09-29 19:57 -------- d-----w- c:\program files\trend micro
2010-09-13 10:35 . 2010-09-13 10:35 -------- d-----w- c:\program files\PowerDataRecovery
2010-09-12 20:29 . 2010-09-12 20:29 -------- d-----w- c:\program files\Flash File Recovery
2010-09-12 19:37 . 2010-09-12 19:37 -------- d-----w- c:\program files\GetData
2010-09-12 19:17 . 2010-09-12 23:27 -------- d-----w- c:\program files\RestoreDeletedFilesNow
2010-09-12 18:34 . 2010-09-12 18:34 34 ---ha-w- c:\windows\system32\Removable Data Recovery_sysquict.dat
2010-09-12 18:34 . 2010-09-12 18:34 -------- d-----w- C:\Removable Data Recovery
2010-09-09 18:24 . 2010-09-12 21:15 -------- d--h--w- c:\programdata\CanonIJScan
2010-09-09 18:24 . 2010-09-12 21:15 -------- d-----w- c:\users\mirek\AppData\Roaming\Canon
2010-09-09 18:03 . 2010-09-09 18:03 -------- d-----w- c:\program files\Common Files\CANON
2010-09-09 17:58 . 2008-08-25 16:02 15872 ----a-w- c:\windows\system32\CNHMCA.dll
2010-09-09 17:57 . 2009-03-24 03:00 272384 ----a-w- c:\windows\system32\CNMLMA0.DLL
2010-09-09 17:57 . 2010-09-09 17:57 -------- d-----w- c:\windows\system32\STRING
2010-09-09 17:57 . 2009-04-03 16:51 137216 ----a-w- c:\windows\system32\CNMNPUI.DLL
2010-09-09 17:57 . 2009-04-03 16:51 353792 ----a-w- c:\windows\system32\CNMNPPM.DLL
2010-09-09 17:57 . 2010-09-09 17:57 -------- d-----w- c:\windows\system32\CHM
2010-09-09 17:56 . 2010-09-12 21:24 -------- d-----w- c:\program files\Canon
2010-09-09 17:07 . 2010-09-09 17:07 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-08-31 22:58 . 2010-08-31 22:57 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 18:38 . 2010-03-07 09:59 -------- d-----w- c:\users\mirek\AppData\Roaming\ICQ
2010-09-30 01:20 . 2010-03-07 10:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-30 01:18 . 2010-03-07 10:07 -------- d-----w- c:\users\mirek\AppData\Roaming\Skype
2010-09-29 22:04 . 2010-03-07 10:08 -------- d-----w- c:\users\mirek\AppData\Roaming\skypePM
2010-09-27 17:12 . 2010-03-07 17:55 1 ----a-w- c:\users\mirek\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-22 06:59 . 2010-03-07 09:47 628886 ----a-w- c:\windows\system32\perfh005.dat
2010-09-22 06:59 . 2010-03-07 09:47 121940 ----a-w- c:\windows\system32\perfc005.dat
2010-09-14 18:33 . 2010-03-12 07:01 -------- d-----w- c:\program files\trademanager
2010-09-12 21:35 . 2010-05-20 05:25 -------- d-----w- c:\program files\Google
2010-09-08 10:00 . 2010-03-11 07:17 72940376 ----a-w- c:\users\mirek\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
2010-09-07 15:12 . 2010-07-15 09:25 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-03-07 09:56 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-03-07 09:57 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-03-07 09:57 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-03-07 09:57 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-03-07 09:57 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-09-07 14:47 . 2010-03-07 09:57 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-08-25 18:35 . 2010-07-20 18:25 -------- d-----w- c:\program files\ICQ7.1
2010-08-23 16:35 . 2010-08-23 16:35 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-08-15 22:48 . 2010-08-15 18:31 2276 ----a-w- c:\users\mirek\AppData\Roaming\mdbu.bin
2010-08-15 21:02 . 2010-08-15 21:02 -------- d-----w- c:\users\mirek\AppData\Roaming\Happy Foto
2010-08-15 21:02 . 2010-08-15 21:02 -------- d-----w- c:\program files\HappyFoto
2010-08-15 20:06 . 2010-08-15 20:04 -------- d-----w- c:\program files\PDFCreator
2010-08-15 19:34 . 2010-08-15 19:34 -------- d-----w- c:\users\mirek\AppData\Roaming\ABBYY
2010-08-15 19:32 . 2010-08-15 19:19 -------- d-----w- c:\program files\ABBYY FineReader 10
2010-08-15 19:24 . 2010-08-15 19:24 -------- d-----w- c:\program files\Common Files\ABBYY
2010-08-15 19:19 . 2010-08-15 19:19 -------- d-----w- c:\programdata\ABBYY
2010-08-15 18:31 . 2010-08-15 18:30 -------- d-----w- c:\users\mirek\AppData\Roaming\GetRightToGo
2010-08-15 18:14 . 2010-08-15 18:09 -------- d-----w- c:\users\mirek\AppData\Roaming\gtk-2.0
2010-08-15 18:10 . 2010-04-25 15:14 -------- d-----w- c:\users\mirek\AppData\Roaming\VSO
2010-07-29 06:30 . 2010-08-11 12:44 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:44 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-16 10:55 . 2010-07-16 10:55 239104 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libtheora0.dll
2010-07-16 10:55 . 2010-07-16 10:55 170496 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libspeex0.dll
2010-07-16 10:55 . 2010-07-16 10:55 107008 ----a-w- c:\users\mirek\AppData\Roaming\Meriel\libspeexdsp0.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
2010-06-26 21:03 88960 ----a-w- c:\program files\Microsoft Security Client\Antimalware\MpBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
"ICQ"="c:\program files\ICQ7.1\ICQ.exe" [2010-08-22 133432]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-3-7 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\mirek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
2009-12-22 04:29 222552 ----a-w- c:\program files\trademanager\AliIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
2009-07-07 14:29 282624 ----a-w- c:\program files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
2009-12-24 06:57 941320 ----a-w- c:\program files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 17:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2010-07-14 13:26 957776 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:45 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-02-05 12:45 385856 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 17:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-07-14 01:14 1173504 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2009-10-26 12:46 1458176 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ser2at;ATEN USB to Serial port driver;c:\windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
S1 aswSP;aswSP; [x]
S2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-21 814344]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
--- Ostatní služby/ovladače v paměti ---
*Deregistered* - MBAMSwissArmy
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
Trusted Zone: alipay.com
Trusted Zone: alisoft.com
Trusted Zone: taobao.com
TCP: {078E2232-B641-4B50-8845-BFDE625BEE55} = 192.168.42.1,81.19.33.2
FF - ProfilePath - c:\users\mirek\AppData\Roaming\Mozilla\Firefox\Profiles\xafodm85.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npww.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\Wat\npWatWeb.dll
.
.
Celkový čas: 2010-09-30 20:53:14
ComboFix-quarantined-files.txt 2010-09-30 18:53
Před spuštěním: Volných bajtů: 36 165 107 712
Po spuštění: Volných bajtů: 36 143 837 184
- - End Of File - - 630BB6D5BFCEEC0A13216FBE51763198
Re: prosím o kontrolu logu,comp se neustále hryže
koukám,že se tam vrátily dřív smazaný záložky Trusted Zone: alipay.com
Trusted Zone: alisoft.com
Trusted Zone: taobao.com
Trusted Zone: alisoft.com
Trusted Zone: taobao.com
Re: prosím o kontrolu logu,comp se neustále hryže
Ty položky chcete fixnout?
Odinstalujte c:\program files\Microsoft Security Client.
Jak to vypadá s počítačem?
Odinstalujte c:\program files\Microsoft Security Client.
Jak to vypadá s počítačem?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: prosím o kontrolu logu,comp se neustále hryže
Děkuji,uvidím zítra večer až se vrátím z akce ještě zasílám nový log Logfile of random's system information tool 1.08 (written by random/random)
Run by mirek at 2010-09-30 22:07:40
Microsoft Windows 7 Ultimate
System drive C: has 35 GB (30%) free of 114 GB
Total RAM: 2038 MB (61% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:08:16, on 30.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\ICQ7.1\ICQ.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\mirek\Downloads\RSIT(6).exe
C:\Program Files\trend micro\mirek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Antimalware Script Scanner - {97055CD1-F6C4-40F8-AF50-932F1890E7F5} - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.1\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ABBYY FineReader 10 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 4988 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
Microsoft Antimalware Script Scanner - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll [2010-06-26 88960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-17 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"ICQ"=C:\Program Files\ICQ7.1\ICQ.exe [2010-08-22 133432]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
C:\Program Files\trademanager\aliim.exe [2009-12-22 222552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
C:\Program Files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2009-12-24 941320]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
c:\Program Files\Microsoft Security Client\msseces.exe [2010-07-14 957776]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-02-05 385856]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-10-26 1458176]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-02-16 384512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 months======
2010-09-30 20:57:11 ----D---- C:\Windows\temp
2010-09-30 20:53:15 ----A---- C:\ComboFix.txt
2010-09-30 20:52:32 ----SHD---- C:\$RECYCLE.BIN
2010-09-30 20:40:18 ----A---- C:\Windows\zip.exe
2010-09-30 20:40:18 ----A---- C:\Windows\SWREG.exe
2010-09-30 20:40:18 ----A---- C:\Windows\sed.exe
2010-09-30 20:40:18 ----A---- C:\Windows\PEV.exe
2010-09-30 20:40:18 ----A---- C:\Windows\NIRCMD.exe
2010-09-30 20:40:18 ----A---- C:\Windows\MBR.exe
2010-09-30 20:40:18 ----A---- C:\Windows\grep.exe
2010-09-30 20:40:17 ----A---- C:\Windows\SWSC.exe
2010-09-30 20:40:07 ----D---- C:\ComboFix
2010-09-30 20:39:57 ----D---- C:\Qoobox
2010-09-30 20:39:19 ----A---- C:\Windows\SWXCACLS.exe
2010-09-30 03:01:02 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 09:46:53 ----A---- C:\Windows\system32\tzres.dll
2010-09-20 21:16:04 ----D---- C:\rsit
2010-09-16 23:18:28 ----D---- C:\Windows\ERDNT
2010-09-16 08:17:53 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 22:18:11 ----D---- C:\Users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 22:18:03 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-15 22:18:02 ----D---- C:\ProgramData\Malwarebytes
2010-09-15 22:18:02 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-15 22:18:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-15 17:27:13 ----D---- C:\Program Files\WinDjView
2010-09-15 14:46:33 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-14 20:34:10 ----D---- C:\Program Files\trend micro
2010-09-13 12:35:18 ----D---- C:\Program Files\PowerDataRecovery
2010-09-12 23:35:02 ----D---- C:\ProgramData\Google
2010-09-12 22:29:23 ----D---- C:\Program Files\Flash File Recovery
2010-09-12 21:37:13 ----D---- C:\Program Files\GetData
2010-09-12 21:17:37 ----D---- C:\Program Files\RestoreDeletedFilesNow
2010-09-12 20:34:43 ----D---- C:\Removable Data Recovery
2010-09-09 20:24:37 ----HD---- C:\ProgramData\CanonIJScan
2010-09-09 20:24:22 ----D---- C:\Users\mirek\AppData\Roaming\Canon
2010-09-09 20:03:12 ----D---- C:\Program Files\Common Files\CANON
2010-09-09 19:58:33 ----A---- C:\Windows\system32\CNHMCA.dll
2010-09-09 19:57:37 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-09-09 19:57:05 ----D---- C:\Windows\system32\STRING
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPUI.DLL
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPPM.DLL
2010-09-09 19:57:04 ----D---- C:\Windows\system32\CHM
2010-09-09 19:56:09 ----D---- C:\Program Files\Canon
2010-09-09 19:07:49 ----D---- C:\Program Files\Mozilla Thunderbird
======List of files/folders modified in the last 1 months======
2010-09-30 21:10:57 ----D---- C:\Windows\system32\config
2010-09-30 20:58:25 ----D---- C:\Users\mirek\AppData\Roaming\ICQ
2010-09-30 20:57:11 ----D---- C:\Windows
2010-09-30 20:51:06 ----A---- C:\Windows\system.ini
2010-09-30 20:47:53 ----D---- C:\Windows\System32
2010-09-30 20:47:53 ----D---- C:\Windows\AppPatch
2010-09-30 20:47:53 ----AD---- C:\Windows\system32\drivers
2010-09-30 20:47:51 ----D---- C:\Program Files\Common Files
2010-09-30 20:40:05 ----D---- C:\Windows\Prefetch
2010-09-30 19:11:10 ----SHD---- C:\System Volume Information
2010-09-30 04:26:52 ----D---- C:\Windows\rescache
2010-09-30 03:22:12 ----D---- C:\Windows\winsxs
2010-09-30 03:20:11 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 03:20:08 ----RD---- C:\Program Files
2010-09-30 03:18:52 ----D---- C:\Windows\system32\en-US
2010-09-30 03:18:52 ----D---- C:\Windows\system32\DriverStore
2010-09-30 03:18:52 ----D---- C:\Windows\system32\cs-CZ
2010-09-30 03:18:25 ----D---- C:\Users\mirek\AppData\Roaming\Skype
2010-09-30 03:03:02 ----SHD---- C:\Windows\Installer
2010-09-30 03:01:07 ----D---- C:\Windows\system32\catroot
2010-09-30 03:00:53 ----D---- C:\Program Files\Internet Explorer
2010-09-30 00:04:26 ----D---- C:\Users\mirek\AppData\Roaming\skypePM
2010-09-29 22:29:39 ----D---- C:\ProgramData
2010-09-22 08:59:37 ----D---- C:\Windows\inf
2010-09-22 08:59:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-21 09:42:00 ----D---- C:\Windows\system32\NDF
2010-09-20 21:04:47 ----D---- C:\Windows\debug
2010-09-20 20:48:02 ----D---- C:\Windows\system32\catroot2
2010-09-16 23:37:37 ----D---- C:\Program Files\Mozilla Firefox
2010-09-16 23:33:19 ----D---- C:\Windows\system32\drivers\etc
2010-09-16 08:18:19 ----A---- C:\Windows\system32\MRT.exe
2010-09-14 20:33:03 ----D---- C:\Program Files\trademanager
2010-09-14 20:15:45 ----AD---- C:\ProgramData\TEMP
2010-09-12 23:35:03 ----D---- C:\Windows\system32\Tasks
2010-09-12 23:35:02 ----D---- C:\Windows\Tasks
2010-09-12 23:35:02 ----D---- C:\Program Files\Google
2010-09-12 23:15:07 ----D---- C:\Windows\twain_32
2010-09-09 20:23:29 ----D---- C:\Windows\system32\FxsTmp
2010-09-09 20:11:01 ----RSD---- C:\Windows\Media
2010-09-08 21:31:55 ----D---- C:\Windows\Logs
2010-09-07 17:11:54 ----A---- C:\Windows\system32\aswBoot.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-06-29 165520]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 18432]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2008-07-22 51200]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\Windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-10-26 1095936]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2010-06-21 483200]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 catchme;catchme; \??\C:\Users\mirek\AppData\Local\Temp\catchme.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 ser2at;ATEN USB to Serial port driver; C:\Windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-22 814344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-06-26 10688]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
-----------------EOF-----------------
Run by mirek at 2010-09-30 22:07:40
Microsoft Windows 7 Ultimate
System drive C: has 35 GB (30%) free of 114 GB
Total RAM: 2038 MB (61% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:08:16, on 30.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\ICQ7.1\ICQ.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\mirek\Downloads\RSIT(6).exe
C:\Program Files\trend micro\mirek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Antimalware Script Scanner - {97055CD1-F6C4-40F8-AF50-932F1890E7F5} - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.1\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ABBYY FineReader 10 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 4988 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
Microsoft Antimalware Script Scanner - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll [2010-06-26 88960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-17 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"ICQ"=C:\Program Files\ICQ7.1\ICQ.exe [2010-08-22 133432]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
C:\Program Files\trademanager\aliim.exe [2009-12-22 222552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
C:\Program Files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2009-12-24 941320]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
c:\Program Files\Microsoft Security Client\msseces.exe [2010-07-14 957776]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-02-05 385856]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-10-26 1458176]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-02-16 384512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 months======
2010-09-30 20:57:11 ----D---- C:\Windows\temp
2010-09-30 20:53:15 ----A---- C:\ComboFix.txt
2010-09-30 20:52:32 ----SHD---- C:\$RECYCLE.BIN
2010-09-30 20:40:18 ----A---- C:\Windows\zip.exe
2010-09-30 20:40:18 ----A---- C:\Windows\SWREG.exe
2010-09-30 20:40:18 ----A---- C:\Windows\sed.exe
2010-09-30 20:40:18 ----A---- C:\Windows\PEV.exe
2010-09-30 20:40:18 ----A---- C:\Windows\NIRCMD.exe
2010-09-30 20:40:18 ----A---- C:\Windows\MBR.exe
2010-09-30 20:40:18 ----A---- C:\Windows\grep.exe
2010-09-30 20:40:17 ----A---- C:\Windows\SWSC.exe
2010-09-30 20:40:07 ----D---- C:\ComboFix
2010-09-30 20:39:57 ----D---- C:\Qoobox
2010-09-30 20:39:19 ----A---- C:\Windows\SWXCACLS.exe
2010-09-30 03:01:02 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 09:46:53 ----A---- C:\Windows\system32\tzres.dll
2010-09-20 21:16:04 ----D---- C:\rsit
2010-09-16 23:18:28 ----D---- C:\Windows\ERDNT
2010-09-16 08:17:53 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 22:18:11 ----D---- C:\Users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 22:18:03 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-15 22:18:02 ----D---- C:\ProgramData\Malwarebytes
2010-09-15 22:18:02 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-15 22:18:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-15 17:27:13 ----D---- C:\Program Files\WinDjView
2010-09-15 14:46:33 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-14 20:34:10 ----D---- C:\Program Files\trend micro
2010-09-13 12:35:18 ----D---- C:\Program Files\PowerDataRecovery
2010-09-12 23:35:02 ----D---- C:\ProgramData\Google
2010-09-12 22:29:23 ----D---- C:\Program Files\Flash File Recovery
2010-09-12 21:37:13 ----D---- C:\Program Files\GetData
2010-09-12 21:17:37 ----D---- C:\Program Files\RestoreDeletedFilesNow
2010-09-12 20:34:43 ----D---- C:\Removable Data Recovery
2010-09-09 20:24:37 ----HD---- C:\ProgramData\CanonIJScan
2010-09-09 20:24:22 ----D---- C:\Users\mirek\AppData\Roaming\Canon
2010-09-09 20:03:12 ----D---- C:\Program Files\Common Files\CANON
2010-09-09 19:58:33 ----A---- C:\Windows\system32\CNHMCA.dll
2010-09-09 19:57:37 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-09-09 19:57:05 ----D---- C:\Windows\system32\STRING
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPUI.DLL
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPPM.DLL
2010-09-09 19:57:04 ----D---- C:\Windows\system32\CHM
2010-09-09 19:56:09 ----D---- C:\Program Files\Canon
2010-09-09 19:07:49 ----D---- C:\Program Files\Mozilla Thunderbird
======List of files/folders modified in the last 1 months======
2010-09-30 21:10:57 ----D---- C:\Windows\system32\config
2010-09-30 20:58:25 ----D---- C:\Users\mirek\AppData\Roaming\ICQ
2010-09-30 20:57:11 ----D---- C:\Windows
2010-09-30 20:51:06 ----A---- C:\Windows\system.ini
2010-09-30 20:47:53 ----D---- C:\Windows\System32
2010-09-30 20:47:53 ----D---- C:\Windows\AppPatch
2010-09-30 20:47:53 ----AD---- C:\Windows\system32\drivers
2010-09-30 20:47:51 ----D---- C:\Program Files\Common Files
2010-09-30 20:40:05 ----D---- C:\Windows\Prefetch
2010-09-30 19:11:10 ----SHD---- C:\System Volume Information
2010-09-30 04:26:52 ----D---- C:\Windows\rescache
2010-09-30 03:22:12 ----D---- C:\Windows\winsxs
2010-09-30 03:20:11 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 03:20:08 ----RD---- C:\Program Files
2010-09-30 03:18:52 ----D---- C:\Windows\system32\en-US
2010-09-30 03:18:52 ----D---- C:\Windows\system32\DriverStore
2010-09-30 03:18:52 ----D---- C:\Windows\system32\cs-CZ
2010-09-30 03:18:25 ----D---- C:\Users\mirek\AppData\Roaming\Skype
2010-09-30 03:03:02 ----SHD---- C:\Windows\Installer
2010-09-30 03:01:07 ----D---- C:\Windows\system32\catroot
2010-09-30 03:00:53 ----D---- C:\Program Files\Internet Explorer
2010-09-30 00:04:26 ----D---- C:\Users\mirek\AppData\Roaming\skypePM
2010-09-29 22:29:39 ----D---- C:\ProgramData
2010-09-22 08:59:37 ----D---- C:\Windows\inf
2010-09-22 08:59:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-21 09:42:00 ----D---- C:\Windows\system32\NDF
2010-09-20 21:04:47 ----D---- C:\Windows\debug
2010-09-20 20:48:02 ----D---- C:\Windows\system32\catroot2
2010-09-16 23:37:37 ----D---- C:\Program Files\Mozilla Firefox
2010-09-16 23:33:19 ----D---- C:\Windows\system32\drivers\etc
2010-09-16 08:18:19 ----A---- C:\Windows\system32\MRT.exe
2010-09-14 20:33:03 ----D---- C:\Program Files\trademanager
2010-09-14 20:15:45 ----AD---- C:\ProgramData\TEMP
2010-09-12 23:35:03 ----D---- C:\Windows\system32\Tasks
2010-09-12 23:35:02 ----D---- C:\Windows\Tasks
2010-09-12 23:35:02 ----D---- C:\Program Files\Google
2010-09-12 23:15:07 ----D---- C:\Windows\twain_32
2010-09-09 20:23:29 ----D---- C:\Windows\system32\FxsTmp
2010-09-09 20:11:01 ----RSD---- C:\Windows\Media
2010-09-08 21:31:55 ----D---- C:\Windows\Logs
2010-09-07 17:11:54 ----A---- C:\Windows\system32\aswBoot.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-06-29 165520]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 18432]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2008-07-22 51200]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\Windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-10-26 1095936]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2010-06-21 483200]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 catchme;catchme; \??\C:\Users\mirek\AppData\Local\Temp\catchme.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 ser2at;ATEN USB to Serial port driver; C:\Windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-22 814344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-06-26 10688]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
-----------------EOF-----------------
Re: prosím o kontrolu logu,comp se neustále hryže
Z mého podpisu stahněte Ccleaner- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru
záložka čistič- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner
záložka Registry- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy
ok zavřít Záložka Nástroje- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.
Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.
***********
Stahněte OTC a použijtehttp://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech
Otevřete si Poznámkový blok a zkopírujte do něj text Kód: Vybrat vše
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
[-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
klikněte na uložit, pak na soubor standardně 2X klikněte a potvrďte dialogové okno.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: prosím o kontrolu logu,comp se neustále hryže
Tak jsem vše udělal a tady je nový log Logfile of random's system information tool 1.08 (written by random/random)
Run by mirek at 2010-09-30 23:23:02
Microsoft Windows 7 Ultimate
System drive C: has 34 GB (30%) free of 114 GB
Total RAM: 2038 MB (61% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:23:37, on 30.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\ICQ7.1\ICQ.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\mirek\Downloads\RSIT.exe
C:\Program Files\trend micro\mirek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Antimalware Script Scanner - {97055CD1-F6C4-40F8-AF50-932F1890E7F5} - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.1\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ABBYY FineReader 10 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5025 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
Microsoft Antimalware Script Scanner - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll [2010-06-26 88960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-17 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"ICQ"=C:\Program Files\ICQ7.1\ICQ.exe [2010-08-22 133432]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
C:\Program Files\trademanager\aliim.exe [2009-12-22 222552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
C:\Program Files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2009-12-24 941320]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-02-05 385856]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-10-26 1458176]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-02-16 384512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 months======
2010-09-30 23:23:02 ----D---- C:\rsit
2010-09-30 20:57:11 ----D---- C:\Windows\temp
2010-09-30 20:52:32 ----SHD---- C:\$RECYCLE.BIN
2010-09-30 03:01:02 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 09:46:53 ----A---- C:\Windows\system32\tzres.dll
2010-09-16 23:18:28 ----D---- C:\Windows\ERDNT
2010-09-16 08:17:53 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 22:18:11 ----D---- C:\Users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 22:18:03 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-15 22:18:02 ----D---- C:\ProgramData\Malwarebytes
2010-09-15 22:18:02 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-15 22:18:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-15 17:27:13 ----D---- C:\Program Files\WinDjView
2010-09-15 14:46:33 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-14 20:34:10 ----D---- C:\Program Files\trend micro
2010-09-13 12:35:18 ----D---- C:\Program Files\PowerDataRecovery
2010-09-12 23:35:02 ----D---- C:\ProgramData\Google
2010-09-12 22:29:23 ----D---- C:\Program Files\Flash File Recovery
2010-09-12 21:37:13 ----D---- C:\Program Files\GetData
2010-09-12 21:17:37 ----D---- C:\Program Files\RestoreDeletedFilesNow
2010-09-12 20:34:43 ----D---- C:\Removable Data Recovery
2010-09-09 20:24:37 ----HD---- C:\ProgramData\CanonIJScan
2010-09-09 20:24:22 ----D---- C:\Users\mirek\AppData\Roaming\Canon
2010-09-09 20:03:12 ----D---- C:\Program Files\Common Files\CANON
2010-09-09 19:58:33 ----A---- C:\Windows\system32\CNHMCA.dll
2010-09-09 19:57:37 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-09-09 19:57:05 ----D---- C:\Windows\system32\STRING
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPUI.DLL
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPPM.DLL
2010-09-09 19:57:04 ----D---- C:\Windows\system32\CHM
2010-09-09 19:56:09 ----D---- C:\Program Files\Canon
2010-09-09 19:07:49 ----D---- C:\Program Files\Mozilla Thunderbird
======List of files/folders modified in the last 1 months======
2010-09-30 23:22:21 ----D---- C:\Windows\system32\config
2010-09-30 23:21:19 ----D---- C:\Windows
2010-09-30 23:19:37 ----D---- C:\Users\mirek\AppData\Roaming\ICQ
2010-09-30 20:51:06 ----A---- C:\Windows\system.ini
2010-09-30 20:47:53 ----D---- C:\Windows\System32
2010-09-30 20:47:53 ----D---- C:\Windows\AppPatch
2010-09-30 20:47:53 ----AD---- C:\Windows\system32\drivers
2010-09-30 20:47:51 ----D---- C:\Program Files\Common Files
2010-09-30 20:40:05 ----D---- C:\Windows\Prefetch
2010-09-30 19:11:10 ----SHD---- C:\System Volume Information
2010-09-30 04:26:52 ----D---- C:\Windows\rescache
2010-09-30 03:22:12 ----D---- C:\Windows\winsxs
2010-09-30 03:20:11 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 03:20:08 ----RD---- C:\Program Files
2010-09-30 03:18:52 ----D---- C:\Windows\system32\en-US
2010-09-30 03:18:52 ----D---- C:\Windows\system32\DriverStore
2010-09-30 03:18:52 ----D---- C:\Windows\system32\cs-CZ
2010-09-30 03:18:25 ----D---- C:\Users\mirek\AppData\Roaming\Skype
2010-09-30 03:03:02 ----SHD---- C:\Windows\Installer
2010-09-30 03:01:07 ----D---- C:\Windows\system32\catroot
2010-09-30 03:00:53 ----D---- C:\Program Files\Internet Explorer
2010-09-30 00:04:26 ----D---- C:\Users\mirek\AppData\Roaming\skypePM
2010-09-29 22:29:39 ----D---- C:\ProgramData
2010-09-22 08:59:37 ----D---- C:\Windows\inf
2010-09-22 08:59:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-21 09:42:00 ----D---- C:\Windows\system32\NDF
2010-09-20 21:04:47 ----D---- C:\Windows\debug
2010-09-20 20:48:02 ----D---- C:\Windows\system32\catroot2
2010-09-16 23:37:37 ----D---- C:\Program Files\Mozilla Firefox
2010-09-16 23:33:19 ----D---- C:\Windows\system32\drivers\etc
2010-09-16 08:18:19 ----A---- C:\Windows\system32\MRT.exe
2010-09-14 20:33:03 ----D---- C:\Program Files\trademanager
2010-09-14 20:15:45 ----AD---- C:\ProgramData\TEMP
2010-09-12 23:35:03 ----D---- C:\Windows\system32\Tasks
2010-09-12 23:35:02 ----D---- C:\Windows\Tasks
2010-09-12 23:35:02 ----D---- C:\Program Files\Google
2010-09-12 23:15:07 ----D---- C:\Windows\twain_32
2010-09-09 20:23:29 ----D---- C:\Windows\system32\FxsTmp
2010-09-09 20:11:01 ----RSD---- C:\Windows\Media
2010-09-08 21:31:55 ----D---- C:\Windows\Logs
2010-09-07 17:11:54 ----A---- C:\Windows\system32\aswBoot.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-06-29 165520]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 18432]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2008-07-22 51200]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\Windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-10-26 1095936]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2010-06-21 483200]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 ser2at;ATEN USB to Serial port driver; C:\Windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-22 814344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-06-26 10688]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
-----------------EOF-----------------
Run by mirek at 2010-09-30 23:23:02
Microsoft Windows 7 Ultimate
System drive C: has 34 GB (30%) free of 114 GB
Total RAM: 2038 MB (61% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:23:37, on 30.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\ICQ7.1\ICQ.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\mirek\Downloads\RSIT.exe
C:\Program Files\trend micro\mirek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Antimalware Script Scanner - {97055CD1-F6C4-40F8-AF50-932F1890E7F5} - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.1\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{078E2232-B641-4B50-8845-BFDE625BEE55}: NameServer = 192.168.42.1,81.19.33.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ABBYY FineReader 10 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5025 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97055CD1-F6C4-40F8-AF50-932F1890E7F5}]
Microsoft Antimalware Script Scanner - c:\Program Files\Microsoft Security Client\Antimalware\MpBHO.dll [2010-06-26 88960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-17 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-05-13 26192168]
"ICQ"=C:\Program Files\ICQ7.1\ICQ.exe [2010-08-22 133432]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aliim]
C:\Program Files\trademanager\aliim.exe [2009-12-22 222552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
C:\Program Files\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe [2009-07-07 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2009-12-24 941320]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-02-05 385856]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2009-10-26 1458176]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^mirek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-02-16 384512]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 months======
2010-09-30 23:23:02 ----D---- C:\rsit
2010-09-30 20:57:11 ----D---- C:\Windows\temp
2010-09-30 20:52:32 ----SHD---- C:\$RECYCLE.BIN
2010-09-30 03:01:02 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 09:46:53 ----A---- C:\Windows\system32\tzres.dll
2010-09-16 23:18:28 ----D---- C:\Windows\ERDNT
2010-09-16 08:17:53 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 22:18:11 ----D---- C:\Users\mirek\AppData\Roaming\Malwarebytes
2010-09-15 22:18:03 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-09-15 22:18:02 ----D---- C:\ProgramData\Malwarebytes
2010-09-15 22:18:02 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-09-15 22:18:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-09-15 17:27:13 ----D---- C:\Program Files\WinDjView
2010-09-15 14:46:33 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-14 20:34:10 ----D---- C:\Program Files\trend micro
2010-09-13 12:35:18 ----D---- C:\Program Files\PowerDataRecovery
2010-09-12 23:35:02 ----D---- C:\ProgramData\Google
2010-09-12 22:29:23 ----D---- C:\Program Files\Flash File Recovery
2010-09-12 21:37:13 ----D---- C:\Program Files\GetData
2010-09-12 21:17:37 ----D---- C:\Program Files\RestoreDeletedFilesNow
2010-09-12 20:34:43 ----D---- C:\Removable Data Recovery
2010-09-09 20:24:37 ----HD---- C:\ProgramData\CanonIJScan
2010-09-09 20:24:22 ----D---- C:\Users\mirek\AppData\Roaming\Canon
2010-09-09 20:03:12 ----D---- C:\Program Files\Common Files\CANON
2010-09-09 19:58:33 ----A---- C:\Windows\system32\CNHMCA.dll
2010-09-09 19:57:37 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-09-09 19:57:05 ----D---- C:\Windows\system32\STRING
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPUI.DLL
2010-09-09 19:57:05 ----A---- C:\Windows\system32\CNMNPPM.DLL
2010-09-09 19:57:04 ----D---- C:\Windows\system32\CHM
2010-09-09 19:56:09 ----D---- C:\Program Files\Canon
2010-09-09 19:07:49 ----D---- C:\Program Files\Mozilla Thunderbird
======List of files/folders modified in the last 1 months======
2010-09-30 23:22:21 ----D---- C:\Windows\system32\config
2010-09-30 23:21:19 ----D---- C:\Windows
2010-09-30 23:19:37 ----D---- C:\Users\mirek\AppData\Roaming\ICQ
2010-09-30 20:51:06 ----A---- C:\Windows\system.ini
2010-09-30 20:47:53 ----D---- C:\Windows\System32
2010-09-30 20:47:53 ----D---- C:\Windows\AppPatch
2010-09-30 20:47:53 ----AD---- C:\Windows\system32\drivers
2010-09-30 20:47:51 ----D---- C:\Program Files\Common Files
2010-09-30 20:40:05 ----D---- C:\Windows\Prefetch
2010-09-30 19:11:10 ----SHD---- C:\System Volume Information
2010-09-30 04:26:52 ----D---- C:\Windows\rescache
2010-09-30 03:22:12 ----D---- C:\Windows\winsxs
2010-09-30 03:20:11 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 03:20:08 ----RD---- C:\Program Files
2010-09-30 03:18:52 ----D---- C:\Windows\system32\en-US
2010-09-30 03:18:52 ----D---- C:\Windows\system32\DriverStore
2010-09-30 03:18:52 ----D---- C:\Windows\system32\cs-CZ
2010-09-30 03:18:25 ----D---- C:\Users\mirek\AppData\Roaming\Skype
2010-09-30 03:03:02 ----SHD---- C:\Windows\Installer
2010-09-30 03:01:07 ----D---- C:\Windows\system32\catroot
2010-09-30 03:00:53 ----D---- C:\Program Files\Internet Explorer
2010-09-30 00:04:26 ----D---- C:\Users\mirek\AppData\Roaming\skypePM
2010-09-29 22:29:39 ----D---- C:\ProgramData
2010-09-22 08:59:37 ----D---- C:\Windows\inf
2010-09-22 08:59:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-21 09:42:00 ----D---- C:\Windows\system32\NDF
2010-09-20 21:04:47 ----D---- C:\Windows\debug
2010-09-20 20:48:02 ----D---- C:\Windows\system32\catroot2
2010-09-16 23:37:37 ----D---- C:\Program Files\Mozilla Firefox
2010-09-16 23:33:19 ----D---- C:\Windows\system32\drivers\etc
2010-09-16 08:18:19 ----A---- C:\Windows\system32\MRT.exe
2010-09-14 20:33:03 ----D---- C:\Program Files\trademanager
2010-09-14 20:15:45 ----AD---- C:\ProgramData\TEMP
2010-09-12 23:35:03 ----D---- C:\Windows\system32\Tasks
2010-09-12 23:35:02 ----D---- C:\Windows\Tasks
2010-09-12 23:35:02 ----D---- C:\Program Files\Google
2010-09-12 23:15:07 ----D---- C:\Windows\twain_32
2010-09-09 20:23:29 ----D---- C:\Windows\system32\FxsTmp
2010-09-09 20:11:01 ----RSD---- C:\Windows\Media
2010-09-08 21:31:55 ----D---- C:\Windows\Logs
2010-09-07 17:11:54 ----A---- C:\Windows\system32\aswBoot.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-06-29 165520]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 18432]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-06-29 43392]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-06-29 54400]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2008-07-22 51200]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\Windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-10-26 1095936]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2010-06-21 483200]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 ser2at;ATEN USB to Serial port driver; C:\Windows\system32\DRIVERS\ser2at.sys [2009-10-15 80896]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-22 814344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-06-26 10688]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-06-26 261992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-19 1343400]
-----------------EOF-----------------
Re: prosím o kontrolu logu,comp se neustále hryže
Ještě otestujte na www.virustotal.com
C:\Windows\system32\drivers\ks.sys
-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.
Jak to vypadá s počítačem?
C:\Windows\system32\drivers\ks.sys
-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.
Jak to vypadá s počítačem?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Re: prosím o kontrolu logu,comp se neustále hryže
vypadlo z toho tohle
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
ks.sys
Submission date:
2010-09-30 21:40:22 (UTC)
Current status:
queued (#1) queued (#2) analysing finished
Result:
0/ 43 (0.0%)
VT Community
not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.01.00 2010.09.30 -
AntiVir 7.10.12.92 2010.09.30 -
Antiy-AVL 2.0.3.7 2010.09.30 -
Authentium 5.2.0.5 2010.09.30 -
Avast 4.8.1351.0 2010.09.30 -
Avast5 5.0.594.0 2010.09.30 -
AVG 9.0.0.851 2010.09.30 -
BitDefender 7.2 2010.09.30 -
CAT-QuickHeal 11.00 2010.09.30 -
ClamAV 0.96.2.0-git 2010.09.30 -
Comodo 6246 2010.09.30 -
DrWeb 5.0.2.03300 2010.09.30 -
Emsisoft 5.0.0.50 2010.09.30 -
eSafe 7.0.17.0 2010.09.30 -
eTrust-Vet 36.1.7885 2010.09.30 -
F-Prot 4.6.2.117 2010.09.30 -
F-Secure 9.0.15370.0 2010.09.30 -
Fortinet 4.1.143.0 2010.09.30 -
GData 21 2010.09.30 -
Ikarus T3.1.1.90.0 2010.09.30 -
Jiangmin 13.0.900 2010.09.30 -
K7AntiVirus 9.63.2648 2010.09.30 -
Kaspersky 7.0.0.125 2010.09.30 -
McAfee 5.400.0.1158 2010.09.30 -
McAfee-GW-Edition 2010.1C 2010.09.30 -
Microsoft 1.6201 2010.09.30 -
NOD32 5493 2010.09.30 -
Norman 6.06.07 2010.09.30 -
nProtect 2010-09-30.01 2010.09.30 -
Panda 10.0.2.7 2010.09.30 -
PCTools 7.0.3.5 2010.09.30 -
Prevx 3.0 2010.09.30 -
Rising 22.67.02.07 2010.09.30 -
Sophos 4.58.0 2010.09.30 -
Sunbelt 6952 2010.09.30 -
SUPERAntiSpyware 4.40.0.1006 2010.09.30 -
Symantec 20101.2.0.161 2010.09.30 -
TheHacker 6.7.0.1.041 2010.09.30 -
TrendMicro 9.120.0.1004 2010.09.30 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.30 -
VBA32 3.12.14.1 2010.09.27 -
ViRobot 2010.8.31.4017 2010.09.30 -
VirusBuster 12.66.8.0 2010.09.30 -
Additional information
Show all
MD5 : 9e79e2354301783d5e0d48411c2a7466
SHA1 : d945c6af961d154eb6732465e9fb20576bb191e8
SHA256: 8cd144dae0f492c911bb7c818d38d78d11839a4fbce5c8899b7d95c1cc0f0432
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
ks.sys
Submission date:
2010-09-30 21:40:22 (UTC)
Current status:
queued (#1) queued (#2) analysing finished
Result:
0/ 43 (0.0%)
VT Community
not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.01.00 2010.09.30 -
AntiVir 7.10.12.92 2010.09.30 -
Antiy-AVL 2.0.3.7 2010.09.30 -
Authentium 5.2.0.5 2010.09.30 -
Avast 4.8.1351.0 2010.09.30 -
Avast5 5.0.594.0 2010.09.30 -
AVG 9.0.0.851 2010.09.30 -
BitDefender 7.2 2010.09.30 -
CAT-QuickHeal 11.00 2010.09.30 -
ClamAV 0.96.2.0-git 2010.09.30 -
Comodo 6246 2010.09.30 -
DrWeb 5.0.2.03300 2010.09.30 -
Emsisoft 5.0.0.50 2010.09.30 -
eSafe 7.0.17.0 2010.09.30 -
eTrust-Vet 36.1.7885 2010.09.30 -
F-Prot 4.6.2.117 2010.09.30 -
F-Secure 9.0.15370.0 2010.09.30 -
Fortinet 4.1.143.0 2010.09.30 -
GData 21 2010.09.30 -
Ikarus T3.1.1.90.0 2010.09.30 -
Jiangmin 13.0.900 2010.09.30 -
K7AntiVirus 9.63.2648 2010.09.30 -
Kaspersky 7.0.0.125 2010.09.30 -
McAfee 5.400.0.1158 2010.09.30 -
McAfee-GW-Edition 2010.1C 2010.09.30 -
Microsoft 1.6201 2010.09.30 -
NOD32 5493 2010.09.30 -
Norman 6.06.07 2010.09.30 -
nProtect 2010-09-30.01 2010.09.30 -
Panda 10.0.2.7 2010.09.30 -
PCTools 7.0.3.5 2010.09.30 -
Prevx 3.0 2010.09.30 -
Rising 22.67.02.07 2010.09.30 -
Sophos 4.58.0 2010.09.30 -
Sunbelt 6952 2010.09.30 -
SUPERAntiSpyware 4.40.0.1006 2010.09.30 -
Symantec 20101.2.0.161 2010.09.30 -
TheHacker 6.7.0.1.041 2010.09.30 -
TrendMicro 9.120.0.1004 2010.09.30 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.30 -
VBA32 3.12.14.1 2010.09.27 -
ViRobot 2010.8.31.4017 2010.09.30 -
VirusBuster 12.66.8.0 2010.09.30 -
Additional information
Show all
MD5 : 9e79e2354301783d5e0d48411c2a7466
SHA1 : d945c6af961d154eb6732465e9fb20576bb191e8
SHA256: 8cd144dae0f492c911bb7c818d38d78d11839a4fbce5c8899b7d95c1cc0f0432
Re: prosím o kontrolu logu,comp se neustále hryže
Soubor je ok. Pokud nejsou problémy, je to vše 
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Vždy před odvirováním počítače zazálohujte důležitá data
Chcete podpořit naše forum? Informace zde
K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Přispějete na provoz fóra?