worman (KONTROLA LOGOV) NOVÉ ..

[worman]

Zdravim Vas, dlho som tu nebol lebo som nemusel Mam novy notebook aj novu pracu v NL a nejako som zanedbal ochranu pocitaca, hlavne nemam poriadny antivirus. Momentalne som dost infikovany a neda sa mi an i naistalovat ci spustit nejakz program. Chcel som si naistalovat hijackthislog abz ste vedeli co sa deje ale neda sa to. Prosim vas poradte mi, cely vecer som tu. Vopred vam fakt dakujem.

[worman]

Tak nakoniec po restartovani a naistalovani aktualizacii s microsoft sa mi da uz instalovat, tak prikladam LOG.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:36:43, on 29. 9. 2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files (x86)\ICQ7.2\ICQ.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home?AF=66015
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:27811
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: FancyStart daemon.lnk = ?
O4 - Global Startup: SRS Premium Sound.lnk = ?
O9 - Extra button: Pridať do blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Pridať do blogu v programe Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C896668-AA5F-480E-944B-87C7D2072C85}: NameServer = 195.146.100.100,195.146.100.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{5C896668-AA5F-480E-944B-87C7D2072C85}: NameServer = 195.146.100.100,195.146.100.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{5C896668-AA5F-480E-944B-87C7D2072C85}: NameServer = 195.146.100.100,195.146.100.5
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9757 bytes

[worman]

Aj mne niekto pomoze?

[motji]

Dobrý večer
Určitě by Vám rád někdo pomohl, ale když si dopovídáte v 2 roky starém topicu, rádce už Vás nevidí .

Poprosím vás o log ze rsitu, viz můj podpis . Je důkladnější než HJT

[worman]

Dobrý večer
Určitě by Vám rád někdo pomohl, ale když si dopovídáte v 2 roky starém topicu, rádce už Vás nevidí .

Poprosím vás o log ze rsitu, viz můj podpis . Je důkladnější než HJT

Nechcel som zbytocne zakladat novu temu ked, tu uz jednu staru mam:)
Nech sa paci, Tvoj pozadovany LOG.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Prekos at 2010-09-30 00:27:37
Microsoft Windows 7 Home Premium
System drive C: has 47 GB (39%) free of 119 GB
Total RAM: 4095 MB (59% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE 0x2d0
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Windows\system32\FBAgent.exe"
"C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files\ATKGFNEX\GFNEXSrv.exe"
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe"
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
"C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
WLIDSvcM.exe 1032
atieclxx
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {0A282EEF-D227-4458-9E43-F1027DBF3A37}
"C:\Program Files\P4G\BatteryLife.exe"
"C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe"
"C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe"
"C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe"
"C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe"
"C:\Program Files (x86)\ASUS\Splendid\ACMON.exe"
"C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"
"C:\Windows\SysWOW64\ACEngSvr.exe" -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe"
"C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe"
ATKOSD.exe
KBFiltr.exe
WDC.exe
"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
"C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
"C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4
"C:\Windows\AsScrPro.exe"
"C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" -r
"C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe"
"C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe"
"C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe"
"C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
"C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe" /f=srs_premium_sound_nopreset.zip
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=4520.90b3da0.399217645 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" 4520 plugin \\.\pipe\gecko-crash-server-pipe.4520
taskeng.exe {CC238686-107D-400B-AE1C-89F9E31CB4E6}
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Prekos\Downloads\RSITx64.exe"
"c:\program files\windows defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey FA04B276-5488-8188-4C10-3176237A4153 -Reinvoke

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Norton Security Scan for Prekos.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
Windows Live Family Safety Browser Helper Class - C:\Program Files\Windows Live\Family Safety\fssbho.dll [2010-04-28 132456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2010-04-16 1067872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2010-04-16 1067872]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2010-04-12 1018616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2009-04-09 320000]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2009-09-30 621440]
"UfSeAgnt.exe"=C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe [2010-02-23 1022904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OE"=C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe [2009-09-29 842504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-12-03 35184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
C:\Windows\AsScrPro.exe [2010-07-21 3058304]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-12-11 98304]
"HDAudDeck"=C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2009-09-17 2245120]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [2010-01-13 7109248]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [2010-01-05 170624]
"DivXUpdate"=C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2010-09-01 1164584]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
FancyStart daemon.lnk - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe
SRS Premium Sound.lnk - C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2010-09-30 00:27:37 ----D---- C:\rsit
2010-09-29 19:36:12 ----D---- C:\Program Files (x86)\Trend Micro
2010-09-29 19:26:57 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-09-29 19:26:56 ----A---- C:\Windows\system32\drivers\ks.sys
2010-09-29 19:05:00 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-09-29 19:05:00 ----A---- C:\Windows\system32\tzres.dll
2010-09-28 14:06:52 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-09-28 14:06:51 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-09-28 14:06:50 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-09-28 14:06:48 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-09-28 14:06:45 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-09-28 14:05:37 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2010-09-28 13:58:48 ----D---- C:\ProgramData\Alwil Software
2010-09-28 13:58:48 ----D---- C:\Program Files\Alwil Software
2010-09-28 13:49:18 ----D---- C:\ProgramData\MFAData
2010-09-27 21:01:05 ----D---- C:\Users\Prekos\AppData\Roaming\WinRAR
2010-09-27 21:00:26 ----D---- C:\Program Files (x86)\WinRAR
2010-09-27 15:44:29 ----D---- C:\Users\Prekos\AppData\Roaming\marketaccess_cz
2010-09-27 15:16:15 ----D---- C:\Program Files (x86)\marketaccess_cz
2010-09-23 10:41:15 ----D---- C:\Program Files (x86)\CCleaner
2010-09-22 19:37:14 ----N---- C:\Windows\system32\MpSigStub.exe
2010-09-16 00:27:30 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2010-09-16 00:27:30 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 22:18:36 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-09 10:39:16 ----D---- C:\Windows\system32\drivers\NSSx64
2010-09-09 10:39:16 ----D---- C:\ProgramData\Symantec
2010-09-09 10:39:16 ----D---- C:\ProgramData\Norton
2010-09-09 10:39:16 ----D---- C:\Program Files (x86)\Norton Security Scan
2010-09-09 10:39:14 ----D---- C:\ProgramData\NortonInstaller
2010-09-09 10:39:14 ----D---- C:\Program Files (x86)\NortonInstaller
2010-09-01 20:00:27 ----D---- C:\Program Files (x86)\Full Tilt Poker
2010-09-01 12:30:30 ----A---- C:\Windows\system32\drivers\vsapint.sys
2010-09-01 12:30:30 ----A---- C:\Windows\system32\drivers\tmxpflt.sys
2010-09-01 12:30:29 ----A---- C:\Windows\system32\drivers\tmpreflt.sys
2010-08-26 19:47:24 ----D---- C:\Program Files (x86)\Conduit
2010-08-26 19:47:21 ----D---- C:\Program Files (x86)\Babylon
2010-08-25 17:17:21 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2010-08-25 17:17:21 ----A---- C:\Windows\system32\oleaut32.dll
2010-08-14 14:47:54 ----D---- C:\ProgramData\HP
2010-08-14 14:34:33 ----D---- C:\Program Files (x86)\HP
2010-08-14 14:34:17 ----D---- C:\Program Files\HP
2010-08-11 06:46:12 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-08-11 06:46:12 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-11 06:46:12 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-11 06:46:10 ----A---- C:\Windows\SYSWOW64\schannel.dll
2010-08-11 06:46:10 ----A---- C:\Windows\system32\schannel.dll
2010-08-11 06:46:01 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-11 06:45:59 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-11 06:45:58 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2010-08-11 06:45:58 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2010-08-11 06:45:55 ----A---- C:\Windows\system32\mshtml.dll
2010-08-11 06:45:54 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2010-08-11 06:45:54 ----A---- C:\Windows\system32\ieframe.dll
2010-08-11 06:45:53 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2010-08-11 06:45:53 ----A---- C:\Windows\system32\wininet.dll
2010-08-11 06:45:53 ----A---- C:\Windows\system32\urlmon.dll
2010-08-11 06:45:52 ----A---- C:\Windows\SYSWOW64\wininet.dll
2010-08-11 06:45:52 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2010-08-11 06:45:52 ----A---- C:\Windows\SYSWOW64\mstime.dll
2010-08-11 06:45:52 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2010-08-11 06:45:52 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2010-08-11 06:45:52 ----A---- C:\Windows\system32\mstime.dll
2010-08-11 06:45:52 ----A---- C:\Windows\system32\iepeers.dll
2010-08-11 06:45:52 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-11 06:45:51 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2010-08-11 06:45:51 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2010-08-11 06:45:51 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2010-08-11 06:45:51 ----A---- C:\Windows\SYSWOW64\ieui.dll
2010-08-11 06:45:51 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-11 06:45:51 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-11 06:45:51 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-11 06:45:51 ----A---- C:\Windows\system32\ieui.dll
2010-08-11 06:45:49 ----A---- C:\Windows\SYSWOW64\rtutils.dll
2010-08-11 06:45:49 ----A---- C:\Windows\system32\rtutils.dll
2010-08-11 06:45:48 ----A---- C:\Windows\SYSWOW64\iccvid.dll
2010-08-11 06:45:46 ----A---- C:\Windows\system32\win32k.sys
2010-08-11 06:45:43 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2010-08-11 06:45:43 ----A---- C:\Windows\system32\msxml3.dll
2010-08-06 20:22:17 ----D---- C:\Users\Prekos\AppData\Roaming\DivX
2010-08-06 20:21:57 ----D---- C:\Program Files\DivX
2010-08-06 20:19:17 ----D---- C:\Program Files (x86)\Google
2010-08-06 20:19:07 ----D---- C:\Program Files (x86)\DivX
2010-08-06 20:17:56 ----D---- C:\ProgramData\DivX
2010-08-03 05:20:19 ----A---- C:\Windows\system32\shell32.dll
2010-08-03 05:20:18 ----A---- C:\Windows\SYSWOW64\shell32.dll
2010-07-28 22:36:48 ----A---- C:\Windows\system32\acovcnt.exe
2010-07-26 23:22:46 ----D---- C:\Program Files (x86)\ICQ6Toolbar
2010-07-26 23:22:44 ----D---- C:\ProgramData\ICQ
2010-07-26 23:15:46 ----D---- C:\Users\Prekos\AppData\Roaming\ICQ
2010-07-26 23:15:38 ----D---- C:\Program Files (x86)\ICQ7.2
2010-07-26 13:36:59 ----A---- C:\Windows\system32\drivers\fssfltr.sys
2010-07-26 13:36:58 ----D---- C:\Program Files\Windows Live
2010-07-26 13:36:21 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2010-07-26 13:35:24 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2010-07-26 13:35:24 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-07-26 13:34:56 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2010-07-26 13:33:59 ----D---- C:\Program Files (x86)\Microsoft
2010-07-26 13:33:48 ----D---- C:\Program Files (x86)\Windows Live SkyDrive
2010-07-26 13:33:41 ----D---- C:\Program Files (x86)\Windows Live
2010-07-26 13:33:21 ----D---- C:\Windows\PCHEALTH
2010-07-26 13:19:37 ----A---- C:\Windows\ATKPF.ini
2010-07-26 12:07:14 ----D---- C:\Users\Prekos\AppData\Roaming\Mozilla
2010-07-26 12:05:02 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-07-25 14:15:06 ----HD---- C:\Program Files (x86)\Zero G Registry
2010-07-25 14:15:06 ----D---- C:\Program Files (x86)\Sports Interactive
2010-07-25 14:14:04 ----D---- C:\Users\Prekos\AppData\Roaming\Sports Interactive
2010-07-24 17:38:01 ----D---- C:\Program Files (x86)\TopCD
2010-07-24 11:18:42 ----A---- C:\Windows\system32\MRT.exe
2010-07-24 10:56:32 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2010-07-23 23:48:34 ----D---- C:\Windows\system32\Service
2010-07-23 04:58:08 ----D---- C:\Windows\SYSWOW64\Wat
2010-07-23 04:58:07 ----D---- C:\Windows\system32\Wat
2010-07-22 21:23:49 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2010-07-22 21:23:49 ----A---- C:\Windows\system32\msv1_0.dll
2010-07-22 21:20:19 ----A---- C:\Windows\SYSWOW64\PresentationHostProxy.dll
2010-07-22 21:20:19 ----A---- C:\Windows\SYSWOW64\PresentationHost.exe
2010-07-22 21:20:19 ----A---- C:\Windows\SYSWOW64\netfxperf.dll
2010-07-22 21:20:19 ----A---- C:\Windows\SYSWOW64\mscoree.dll
2010-07-22 21:20:19 ----A---- C:\Windows\SYSWOW64\dfshim.dll
2010-07-22 21:20:19 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-07-22 21:20:19 ----A---- C:\Windows\system32\PresentationHost.exe
2010-07-22 21:20:19 ----A---- C:\Windows\system32\mscoree.dll
2010-07-22 21:20:18 ----A---- C:\Windows\system32\netfxperf.dll
2010-07-22 21:20:18 ----A---- C:\Windows\system32\dfshim.dll
2010-07-22 21:19:44 ----A---- C:\Windows\system32\browserchoice.exe
2010-07-22 05:37:16 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2010-07-22 05:37:16 ----A---- C:\Windows\system32\ntdll.dll
2010-07-22 05:37:14 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2010-07-22 05:37:14 ----A---- C:\Windows\system32\asycfilt.dll
2010-07-22 05:36:30 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2010-07-22 05:36:30 ----A---- C:\Windows\system32\vbscript.dll
2010-07-22 05:35:38 ----A---- C:\Windows\system32\wmp.dll
2010-07-22 05:35:37 ----A---- C:\Windows\SYSWOW64\wmp.dll
2010-07-22 05:35:34 ----A---- C:\Windows\system32\CertEnroll.dll
2010-07-22 05:35:33 ----A---- C:\Windows\SYSWOW64\CertEnroll.dll
2010-07-22 05:35:32 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2010-07-22 05:35:31 ----A---- C:\Windows\system32\wmploc.DLL
2010-07-22 05:34:49 ----A---- C:\Windows\SYSWOW64\explorer.exe
2010-07-22 05:34:49 ----A---- C:\Windows\explorer.exe
2010-07-22 05:34:48 ----A---- C:\Windows\system32\winlogon.exe
2010-07-22 05:34:45 ----A---- C:\Windows\SYSWOW64\wow32.dll
2010-07-22 05:34:45 ----A---- C:\Windows\SYSWOW64\user.exe
2010-07-22 05:34:45 ----A---- C:\Windows\SYSWOW64\setup16.exe
2010-07-22 05:34:45 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2010-07-22 05:34:45 ----A---- C:\Windows\SYSWOW64\instnm.exe
2010-07-22 05:34:45 ----A---- C:\Windows\system32\wow64.dll
2010-07-22 05:34:43 ----A---- C:\Windows\SYSWOW64\secproc_isv.dll
2010-07-22 05:34:43 ----A---- C:\Windows\SYSWOW64\secproc.dll
2010-07-22 05:34:43 ----A---- C:\Windows\system32\secproc_isv.dll
2010-07-22 05:34:43 ----A---- C:\Windows\system32\secproc.dll
2010-07-22 05:34:43 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\secproc_ssp_isv.dll
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\secproc_ssp.dll
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp_isv.exe
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp.exe
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\RMActivate_isv.exe
2010-07-22 05:34:42 ----A---- C:\Windows\SYSWOW64\RMActivate.exe
2010-07-22 05:34:42 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-07-22 05:34:42 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-07-22 05:34:42 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-07-22 05:34:42 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-07-22 05:34:42 ----A---- C:\Windows\system32\RMActivate.exe
2010-07-22 05:34:40 ----A---- C:\Windows\system32\inetcomm.dll
2010-07-22 05:34:39 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2010-07-22 05:34:37 ----A---- C:\Windows\SYSWOW64\t2embed.dll
2010-07-22 05:34:37 ----A---- C:\Windows\system32\t2embed.dll
2010-07-22 05:30:22 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-07-22 05:30:22 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-07-22 05:30:22 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-07-22 05:30:20 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-07-22 05:30:19 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-07-22 05:30:19 ----A---- C:\Windows\system32\cdd.dll
2010-07-22 05:30:17 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2010-07-22 05:30:17 ----A---- C:\Windows\system32\msdri.dll
2010-07-22 05:30:17 ----A---- C:\Windows\system32\CPFilters.dll
2010-07-22 05:30:16 ----A---- C:\Windows\SYSWOW64\psisdecd.dll
2010-07-22 05:30:16 ----A---- C:\Windows\system32\psisdecd.dll
2010-07-22 05:29:59 ----A---- C:\Windows\SYSWOW64\quartz.dll
2010-07-22 05:29:59 ----A---- C:\Windows\system32\quartz.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\tsbyuv.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\msyuv.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\msvidc32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\msrle32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\mciavi32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\iyuv_32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\SYSWOW64\avifil32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\system32\tsbyuv.dll
2010-07-22 05:29:58 ----A---- C:\Windows\system32\msyuv.dll
2010-07-22 05:29:58 ----A---- C:\Windows\system32\msvidc32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\system32\msrle32.dll
2010-07-22 05:29:58 ----A---- C:\Windows\system32\iyuv_32.dll
2010-07-22 05:29:55 ----A---- C:\Windows\SYSWOW64\jscript.dll
2010-07-22 05:29:55 ----A---- C:\Windows\system32\jscript.dll
2010-07-22 05:29:50 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2010-07-22 05:29:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2010-07-22 05:29:50 ----A---- C:\Windows\system32\lsasrv.dll
2010-07-22 05:29:50 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-07-22 05:29:23 ----A---- C:\Windows\SYSWOW64\msasn1.dll
2010-07-22 05:29:23 ----A---- C:\Windows\system32\msasn1.dll
2010-07-22 05:29:18 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2010-07-22 05:29:18 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2010-07-22 05:29:18 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2010-07-22 05:29:18 ----A---- C:\Windows\system32\fontsub.dll
2010-07-22 05:29:18 ----A---- C:\Windows\system32\atmlib.dll
2010-07-22 05:29:18 ----A---- C:\Windows\system32\atmfd.dll
2010-07-22 05:07:19 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2010-07-22 05:07:19 ----A---- C:\Windows\system32\wintrust.dll
2010-07-22 05:07:11 ----A---- C:\Windows\SYSWOW64\cabview.dll
2010-07-22 05:07:11 ----A---- C:\Windows\system32\cabview.dll
2010-07-21 21:26:08 ----D---- C:\Windows\Panther
2010-07-21 21:13:02 ----D---- C:\Windows.old.001
2010-07-21 21:08:38 ----D---- C:\ProgramData\Trend Micro
2010-07-21 21:06:32 ----D---- C:\Program Files\Trend Micro
2010-07-21 21:05:52 ----D---- C:\Users\Prekos\AppData\Roaming\Macromedia
2010-07-21 21:05:52 ----D---- C:\Users\Prekos\AppData\Roaming\Adobe
2010-07-21 21:05:28 ----D---- C:\ProgramData\Adobe
2010-07-21 21:05:06 ----D---- C:\Program Files (x86)\Adobe
2010-07-21 21:04:54 ----D---- C:\Windows\SYSWOW64\ASUS_Screensaver dir
2010-07-21 21:04:40 ----D---- C:\Windows\SYSWOW64\Macromed
2010-07-21 21:04:13 ----A---- C:\Windows\AsScrPro.exe
2010-07-21 21:04:04 ----D---- C:\ProgramData\ASUS
2010-07-21 21:02:58 ----A---- C:\Windows\SYSWOW64\LogonStart.dll
2010-07-21 21:02:09 ----A---- C:\Windows\SYSWOW64\ACEngSvr.exe
2010-07-21 21:01:42 ----D---- C:\Program Files\ASUS
2010-07-21 21:01:42 ----A---- C:\Windows\system32\ServiceFilter.ini
2010-07-21 21:01:42 ----A---- C:\Windows\system32\RemoveFont.ini
2010-07-21 21:01:42 ----A---- C:\Windows\system32\FBAgent.exe
2010-07-21 21:01:42 ----A---- C:\Windows\system32\FastBoot.ini
2010-07-21 21:01:42 ----A---- C:\Windows\system32\Defrag.ini
2010-07-21 21:01:42 ----A---- C:\Windows\system32\BootTime.ini
2010-07-21 21:01:42 ----A---- C:\Windows\system32\AutoRunFilter.ini
2010-07-21 20:59:53 ----D---- C:\ProgramData\P4G
2010-07-21 20:59:53 ----D---- C:\Program Files\P4G
2010-07-21 20:59:16 ----D---- C:\Program Files\ATKGFNEX
2010-07-21 20:58:48 ----D---- C:\Users\Prekos\AppData\Roaming\InstallShield
2010-07-21 20:58:29 ----D---- C:\Program Files (x86)\ASUS
2010-07-21 20:56:56 ----A---- C:\Windows\system32\drivers\kbfiltr.sys
2010-07-21 20:56:46 ----A---- C:\Windows\SYSWOW64\vsnp2uvc.dll
2010-07-21 20:56:46 ----A---- C:\Windows\system32\vsnp2uvc.dll
2010-07-21 20:56:46 ----A---- C:\Windows\system32\drivers\snp2uvc.sys
2010-07-21 20:56:46 ----A---- C:\Windows\system32\drivers\sncduvc.sys
2010-07-21 20:56:46 ----A---- C:\Windows\system32\csnp2uvc.dll
2010-07-21 20:56:46 ----A---- C:\Windows\snuninst.exe
2010-07-21 20:56:46 ----A---- C:\Windows\snp2uvc.ini
2010-07-21 20:56:33 ----A---- C:\Windows\system32\drivers\athrx.sys
2010-07-21 20:56:26 ----D---- C:\Program Files\Elantech
2010-07-21 20:56:23 ----A---- C:\Windows\system32\drivers\ETD.sys
2010-07-21 20:56:09 ----D---- C:\ProgramData\AmUStor
2010-07-21 20:56:08 ----D---- C:\Program Files (x86)\AmIcoSingLun
2010-07-21 20:55:16 ----A---- C:\Windows\system32\drivers\L1E62x64.sys
2010-07-21 20:53:41 ----D---- C:\Program Files\SRS Labs
2010-07-21 20:53:39 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-07-21 20:53:08 ----D---- C:\Windows\system32\SRSLabs
2010-07-21 20:53:02 ----A---- C:\Windows\system32\VIASysFx.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\VIAPropPageExt.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\ViaMicArrayPropPageExt.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\ViaMicArrayAPO.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\nQPropPageExt.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\nQAPO.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\Dts2PropPageExt.dll
2010-07-21 20:53:02 ----A---- C:\Windows\system32\drivers\viahduaa.sys
2010-07-21 20:53:00 ----A---- C:\Windows\system32\Dts2APO.dll
2010-07-21 20:52:47 ----N---- C:\Windows\difxapi.dll
2010-07-21 20:52:46 ----D---- C:\Program Files (x86)\VIA
2010-07-21 20:50:56 ----D---- C:\Program Files\DIFX
2010-07-21 20:50:54 ----DC---- C:\Windows\system32\DRVSTORE
2010-07-21 20:50:54 ----D---- C:\Program Files (x86)\AMD
2010-07-21 20:50:54 ----A---- C:\Windows\system32\drivers\usbfilter.sys
2010-07-21 20:49:19 ----A---- C:\Windows\system32\drivers\AtiPcie.sys
2010-07-21 20:47:52 ----A---- C:\Windows\system32\drivers\amdxata.sys
2010-07-21 20:47:52 ----A---- C:\Windows\system32\drivers\amdsata.sys
2010-07-21 20:46:30 ----D---- C:\Users\Prekos\AppData\Roaming\ATI
2010-07-21 20:46:30 ----D---- C:\ProgramData\ATI
2010-07-21 20:45:17 ----A---- C:\Windows\system32\coinst.dll
2010-07-21 20:45:17 ----A---- C:\Windows\system32\ATIDEMGX.dll
2010-07-21 20:45:05 ----D---- C:\Program Files\ATI
2010-07-21 20:45:02 ----D---- C:\Program Files (x86)\ATI Technologies
2010-07-21 20:44:39 ----SHD---- C:\Windows\Installer
2010-07-21 20:38:54 ----D---- C:\Users\Prekos\AppData\Roaming\Identities
2010-07-21 20:38:38 ----SD---- C:\Users\Prekos\AppData\Roaming\Microsoft
2010-07-21 20:38:38 ----D---- C:\Users\Prekos\AppData\Roaming\Media Center Programs
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Šablony
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Plocha
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Oblíbené položky
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Nabídka Start
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Dokumenty
2010-07-21 20:38:25 ----SHD---- C:\ProgramData\Data aplikací
2010-07-21 20:29:36 ----D---- C:\Windows\SoftwareDistribution
2010-07-21 20:26:37 ----D---- C:\Windows\Prefetch
2010-07-21 19:57:00 ----SHD---- C:\Config.Msi
2010-07-21 18:17:46 ----D---- C:\Windows.old.000
2010-07-20 22:08:05 ----D---- C:\Windows.old
2010-07-13 12:48:44 ----ASH---- C:\pagefile.sys
2010-07-13 12:48:38 ----ASH---- C:\hiberfil.sys
2010-07-12 22:04:09 ----HD---- C:\ASUS.DAT

======List of files/folders modified in the last 3 months======

2010-09-30 00:27:37 ----D---- C:\Windows\Temp
2010-09-29 19:54:15 ----D---- C:\Windows\system32\config
2010-09-29 19:53:19 ----D---- C:\Windows\system32\NDF
2010-09-29 19:36:23 ----D---- C:\Windows\system32\Tasks
2010-09-29 19:36:12 ----RD---- C:\Program Files (x86)
2010-09-29 19:35:38 ----D---- C:\Windows
2010-09-29 19:33:23 ----D---- C:\Windows\winsxs
2010-09-29 19:31:41 ----D---- C:\Windows\SYSWOW64\cs-CZ
2010-09-29 19:31:41 ----D---- C:\Windows\SysWOW64
2010-09-29 19:31:39 ----D---- C:\Windows\system32\cs-CZ
2010-09-29 19:31:39 ----D---- C:\Windows\System32
2010-09-29 19:31:38 ----D---- C:\Program Files (x86)\Internet Explorer
2010-09-29 19:31:37 ----D---- C:\Program Files\Internet Explorer
2010-09-29 19:31:33 ----D---- C:\Windows\system32\drivers
2010-09-29 19:31:30 ----D---- C:\Windows\system32\DriverStore
2010-09-29 19:31:10 ----SHD---- C:\System Volume Information
2010-09-29 19:27:04 ----D---- C:\Windows\system32\catroot
2010-09-29 01:53:57 ----SD---- C:\ProgramData\Microsoft
2010-09-28 13:58:48 ----RD---- C:\Program Files
2010-09-28 13:58:48 ----HD---- C:\ProgramData
2010-09-28 13:50:05 ----D---- C:\Windows\system32\catroot2
2010-09-27 21:59:39 ----D---- C:\Windows\inf
2010-09-27 21:59:39 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-23 10:42:25 ----D---- C:\Windows\debug
2010-09-21 12:00:25 ----D---- C:\Windows\system32\drivers\etc
2010-09-21 08:42:58 ----SHD---- C:\$Recycle.Bin
2010-09-21 08:42:48 ----RD---- C:\Users
2010-09-15 17:39:21 ----D---- C:\Windows\system32\wdi
2010-09-13 11:45:09 ----D---- C:\Program Files (x86)\Common Files
2010-09-09 10:39:20 ----D---- C:\Windows\Tasks
2010-08-25 23:07:21 ----D---- C:\Windows\AppPatch
2010-08-11 16:52:11 ----D---- C:\Windows\Microsoft.NET
2010-08-11 16:46:37 ----RSD---- C:\Windows\assembly
2010-08-11 11:14:33 ----D---- C:\Windows\system32\drivers\UMDF
2010-08-11 11:06:42 ----D---- C:\Windows\SYSWOW64\migration
2010-08-11 11:06:40 ----D---- C:\Windows\system32\migration
2010-07-28 12:17:48 ----D---- C:\Windows\Logs
2010-07-26 13:33:22 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-07-23 12:44:45 ----D---- C:\Windows\rescache
2010-07-23 04:58:37 ----D---- C:\Program Files\Windows Media Player
2010-07-23 04:58:37 ----D---- C:\Program Files (x86)\Windows Media Player
2010-07-23 04:58:31 ----D---- C:\Program Files\Windows Mail
2010-07-23 04:58:31 ----D---- C:\Program Files (x86)\Windows Mail
2010-07-23 04:58:07 ----D---- C:\Windows\ehome
2010-07-22 17:26:33 ----D---- C:\Windows\system32\LogFiles
2010-07-21 21:25:56 ----RASH---- C:\BOOTSECT.BAK
2010-07-21 21:25:54 ----SHD---- C:\Boot
2010-07-21 21:12:40 ----D---- C:\Windows\SYSWOW64\drivers
2010-07-21 21:03:42 ----D---- C:\Program Files\Common Files
2010-07-21 20:56:48 ----D---- C:\Windows\twain_32
2010-07-21 20:52:34 ----D---- C:\Windows\system32\restore
2010-07-21 20:44:12 ----D---- C:\Windows\system32\CodeIntegrity
2010-07-21 20:38:25 ----SHD---- C:\Recovery
2010-07-21 20:38:25 ----D---- C:\Windows\system32\Recovery
2010-07-21 20:38:25 ----D---- C:\Program Files\Windows NT
2010-07-21 20:29:58 ----D---- C:\Windows\system32\sysprep

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 28752]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 121936]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 51280]
R1 tmtdi;Trend Micro TDI Driver; C:\Windows\system32\DRIVERS\tmtdi.sys [2009-09-29 107536]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 20048]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 17464]
R2 tmpreflt;tmpreflt; C:\Windows\system32\DRIVERS\tmpreflt.sys [2010-07-30 42576]
R2 tmxpflt;tmxpflt; C:\Windows\system32\DRIVERS\tmxpflt.sys [2010-07-30 309840]
R2 vsapint;vsapint; C:\Windows\system32\DRIVERS\vsapint.sys [2010-07-30 1988176]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2009-12-11 6228480]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2009-12-11 160256]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2009-10-05 1542656]
R3 AtiHdmiService;ATI Service for HD Audio Codec; C:\Windows\system32\drivers\AtiHdmi.sys [2009-07-23 119312]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2009-10-15 117760]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 15416]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2009-05-13 15928]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-08-12 1799680]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-07-09 1222144]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-12-11 6228480]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-04-28 61288]
S3 ipswuio;ipswuio; C:\Windows\System32\DRIVERS\ipswuio.sys []
S3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E62x64.sys [2009-08-23 56320]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2008-05-23 154168]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe [2009-12-07 379520]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-12-11 202752]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-04-12 246520]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 SfCtlCom;Trend Micro Central Control Component; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [2010-02-23 859640]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-08-06 135664]
S3 fsssvc;Služba Bezpečnosť rodiny v službe Windows Live; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-04-28 704872]
S3 TMBMServer;Trend Micro Unauthorized Change Prevention Service; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [2009-09-29 570632]
S3 TmProxy;Trend Micro Proxy Service; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2009-09-29 917768]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-22 1255736]

-----------------EOF-----------------

[motji]

Tento program jste si instaloval sám?
C:\Program Files\Trend Micro\Internet Security.
Máte Avast, Trend Micro bych dala pryč.

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[worman]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4721

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30. 9. 2010 11:26:52
mbam-log-2010-09-30 (11-26-52).txt

Typ skenu: Rychlý sken
Skenované objekty: 137380
Uplynulý čas: 2 minuta(y), 33 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Users\Prekos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> No action taken.

[motji]

Nález mbamu smažte

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

[worman]

Nález mbamu smažte

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

Ano smazu to.
A ten program nieje kompatibilny s mojim OS

[motji]

Omlouvám se, špatně jsme koukala .
Jak to vypadá s počítačem?

[worman]

Ocividne je to lepsie, uz mi nevyskakuju ziadne chybove hlasenia.
Mam iba ciastocny antivirus teda trial avast, myslis ze sa oplati si zaplatit poriadny antivirus?

[motji]

Záleží co na počítači děláte. Já mám třeba Avast - home , je zadarmo a uplně mi stačí.

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT 

- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde

[worman]

Ahoj, prosim Ta a ako dlho tom ma skenovat lebo uz mi to ide asi 5 hod, a nic to nerobi.

[motji]

Tak to vypněte s zkuste znovu v nouzovém režimu.
Dejte tomu maximálně hodinu, pokud bude pracovat.

[worman]

Stejne:( neni to nejaka haluz z microsoft?