antivir mi našel win32:malware - gen

[denisa.s]

prosím poraďte mi někdo co s tím , do truhly mi dát nešel, tak jsem to smazala, teď projíždím pc znovu Avastem jde nějak zjistit jestli to skutečně zmizelo

[vyosek]

Zdravim a peknou noc preji

Takze to dopadlo jak jsem psal v SZ - prispevek Vam byl v sekci viry.cz zamitnut - spravne jste jej dala sem

Ovsem dalsi cas SZ jste uz nejak neudelala, hlavne jste nedala log z RSIT, abychom mohli zjistit co se Avastu nelibi

takze dejte log z RSIT - navod zde http://www.viry.cz/forum/viewtopic.php?f=24&t=81939 a podivame se na to

Vite kde Avast hlasil problem

[denisa.s]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Denda at 2010-10-04 23:30:28
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 26 GB (28%) free of 92 GB
Total RAM: 3071 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:31:02, on 4.10.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\MODPS2KEY.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Windows\mHotkey.exe
C:\Windows\OSDShow.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\PROGRA~1\WinTV\HCWCITray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Denda\Desktop\RSIT.exe
C:\Program Files\trend micro\Denda.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=14597&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ShowOSD] OSDShow.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WinTV-CI CAM Menu.lnk = ?
O4 - Global Startup: BDARemote.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Mouse Driver\KMWDSrv.exe

--
End of file - 5852 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{1F3C73C1-3723-45FA-B43B-FCF6636E7808}.job
C:\Windows\tasks\User_Feed_Synchronization-{5C643080-4DAB-402C-A2DD-87102D7769E3}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"KMCONFIG"=C:\Program Files\Mouse Driver\StartAutorun.exe [2008-05-30 212992]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]
"CHotkey"=C:\Windows\mHotkey.exe [2007-01-15 550912]
"ShowOSD"=C:\Windows\OSDShow.exe [2007-01-15 28672]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-07-18 77824]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
BDARemote.lnk - C:\Program Files\USB TV\EM28XX\BDARemote.exe

C:\Users\Denda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
WinTV-CI CAM Menu.lnk - C:\PROGRA~1\WinTV\HCWCITray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-04 23:30:28 ----D---- C:\rsit
2010-10-04 23:30:28 ----D---- C:\Program Files\trend micro
2010-10-02 16:46:15 ----RHD---- C:\Users\Denda\AppData\Roaming\SecuROM
2010-10-01 11:42:10 ----A---- C:\Windows\system32\xinput1_2.dll
2010-10-01 11:42:10 ----A---- C:\Windows\system32\xinput1_1.dll
2010-10-01 11:42:10 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-10-01 11:42:10 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-10-01 11:42:09 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-10-01 11:42:04 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-10-01 11:42:04 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-10-01 11:42:04 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-10-01 11:42:04 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-10-01 11:42:03 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-10-01 11:42:03 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-10-01 11:42:03 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-10-01 11:42:03 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-10-01 11:42:02 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-09-29 08:16:37 ----A---- C:\Windows\system32\tzres.dll
2010-09-28 23:18:39 ----HD---- C:\ProgramData\CanonBJ
2010-09-28 23:17:31 ----A---- C:\Windows\system32\CNMLM8R.DLL
2010-09-20 18:34:58 ----D---- C:\ProgramData\vsosdk
2010-09-20 15:07:39 ----D---- C:\Program Files\Ashampoo
2010-09-20 15:06:28 ----D---- C:\Users\Denda\AppData\Roaming\Vso
2010-09-20 15:05:55 ----A---- C:\Windows\system32\sipr3260.dll
2010-09-20 15:05:55 ----A---- C:\Windows\system32\drv43260.dll
2010-09-20 15:05:55 ----A---- C:\Windows\system32\drv33260.dll
2010-09-20 15:05:55 ----A---- C:\Windows\system32\drv23260.dll
2010-09-20 15:05:55 ----A---- C:\Windows\system32\cook3260.dll
2010-09-20 15:05:52 ----A---- C:\Windows\system32\vp7vfw.dll
2010-09-20 15:05:51 ----A---- C:\Windows\system32\wvc1dmod.dll
2010-09-20 15:05:50 ----D---- C:\Program Files\VSO
2010-09-15 16:29:51 ----A---- C:\Windows\system32\usp10.dll
2010-09-15 16:29:48 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-15 16:29:46 ----A---- C:\Windows\system32\MP4SDECD.DLL
2010-09-15 16:29:41 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 months======

2010-10-04 23:30:41 ----D---- C:\Windows\Temp
2010-10-04 23:30:40 ----D---- C:\Windows\Prefetch
2010-10-04 23:30:28 ----RD---- C:\Program Files
2010-10-04 22:18:47 ----D---- C:\Windows\System32
2010-10-04 20:59:36 ----D---- C:\Users\Denda\AppData\Roaming\vlc
2010-10-04 20:59:06 ----D---- C:\Users\Denda\AppData\Roaming\dvdcss
2010-10-02 19:26:37 ----SHD---- C:\System Volume Information
2010-10-02 16:20:25 ----D---- C:\Windows\inf
2010-10-02 16:20:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-01 12:10:22 ----D---- C:\Windows\rescache
2010-10-01 11:42:09 ----RSD---- C:\Windows\assembly
2010-10-01 11:42:05 ----D---- C:\Windows\Microsoft.NET
2010-10-01 11:41:33 ----D---- C:\Windows
2010-09-30 03:01:28 ----D---- C:\Windows\winsxs
2010-09-30 03:01:28 ----D---- C:\Windows\system32\cs-CZ
2010-09-30 03:01:06 ----D---- C:\Program Files\Internet Explorer
2010-09-29 08:16:22 ----D---- C:\Windows\system32\catroot
2010-09-28 23:18:39 ----HD---- C:\ProgramData
2010-09-28 23:18:33 ----D---- C:\Windows\system32\catroot2
2010-09-28 23:16:16 ----RSD---- C:\Windows\Media
2010-09-28 23:16:16 ----D---- C:\Windows\system32\drivers
2010-09-28 23:16:10 ----D---- C:\Windows\twain_32
2010-09-24 20:24:13 ----SD---- C:\Users\Denda\AppData\Roaming\Microsoft
2010-09-20 15:08:55 ----D---- C:\Users\Denda\AppData\Roaming\Ashampoo
2010-09-16 22:28:42 ----D---- C:\Program Files\Mozilla Firefox
2010-09-16 03:01:04 ----A---- C:\Windows\system32\mrt.exe
2010-09-16 03:00:57 ----D---- C:\Program Files\Windows Mail
2010-09-15 13:23:10 ----D---- C:\Windows\system32\WDI
2010-09-13 16:53:41 ----SHD---- C:\Windows\Installer
2010-09-07 17:11:54 ----A---- C:\Windows\system32\aswBoot.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-09-30 4450816]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2009-09-11 1440384]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
R3 KMWDFILTERx86;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-30 25088]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
R3 ZY272NV32;ZyXEL 802.11n NWD272N Driver(vista); C:\Windows\system32\DRIVERS\WLANUHN.sys [2010-01-25 475136]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-09-30 4450816]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 ZY271NV32;ZyXEL 802.11n NWD271N Driver(vista); C:\Windows\system32\DRIVERS\WLANUHN.sys [2010-01-25 475136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-09-30 733184]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Program Files\Mouse Driver\KMWDSrv.exe [2009-08-31 1821184]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[vyosek]

Kde Avast hlasil havet

[denisa.s]

windows/system32/unicorn.Src moc se omlouvám nejde mi lomítko na druhou stranu po projetí avastem jsem dala smazat, a projela znovu důkladným testem a je to čisté už to nic nehlásí ale bojím se aby to fakt čisté bylo... fakt se omlouvám za zmatek já se tu nevyznám a vůbec netuším jestli jsem tuto odpověď neflákla i jinam proto kopíruji pro jistotu znovu

[vyosek]

Dala jste to dobre, i pocty prispevku Vam sedi - vzdy dejte jen v tomto tematu "Odpovedet" a piste

Log vypada na havet cisty, ale udelame jeden test - pro jistotu a klid duse

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[denisa.s]

skenuje se moc dík za trpělivost

[vyosek]

Nemate zac, na log kouknu ale asi az rano

[denisa.s]

jo jasně mám postupovat dle pokynů tady Malwarebytes' Anti-Malware tedy... uložit výsledky a okopčit je sem nebo ??....

[vyosek]

Ano presne tak, jen ulozit a dat je sem - nic bez rady nemazte - MBAM obcas miva falesne detekce a mohla byste si i smazat neco co haveti neni - proto na to kouknu a pak budeme az mazat

[denisa.s]

jasně, moc děkuju dobrou noc a nashle zítra

[vyosek]

Dobrou noc i Vam...rano doufam najdu log

[denisa.s]

v to doufám i já

[denisa.s]

tak doufám že to je ono


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4742

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

5.10.2010 0:46:22
mbam-log-2010-10-05 (00-46-22).txt

Typ skenu: Úplný sken (C:\|H:\|K:\|)
Skenované objekty: 269764
Uplynulý čas: 57 minuta(y), 39 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[vyosek]

Sjupr, PC by melo byt ciste, takze udelame neco malinko pro jeho cistotu a rychlost

MBAM muzete odinstalovat nebo nechat na obcasny sken - v pripade nalezu velmi doporucuji dat sem log na posouzeni, at si neodstrelite neco legitimniho

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  services.msc

• Kliknete na OK
• Najdete sluzby nize
• Google Updater Service
• U kazde provedte toto
  • Klik na ni pravym mysidlem a zvolit Vlastnosti
  • Nyní klik na Zastavit
  • Typ spousteni nastavit na Zakazano
  • Potvrdte kliknutim na OK

Otevrete si poznamkovy blok

• Start->spustit->notepad
• Vlozte text nize

• Kód: Vybrat vše

  Windows Registry Editor Version 5.00
  
  [HKCU\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="www.google.com"
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "QuickTime Task"=-
  "SunJavaUpdateSched"=-

• Soubor ulozte jako oprava.reg
• Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
• 
• Zavrit notepad a spustit dvojklikem oprava.reg
• Pripadny dotaz na zmenu registru potvrdte
• Okno jen problikne a opravi regsitry - soubor muzete smazat

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni