Prosím o kontrolu logu

[Kolcek93]

Zdravím,
chtěl bych poprosit o kontrolu logu.
Logfile of random's system information tool 1.08 (written by random/random)
Run by Marek at 2010-10-20 15:58:08
Microsoft Windows 7 Ultimate
System drive C: has 14 GB (12%) free of 117 GB
Total RAM: 4096 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:58:12, on 20.10.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
C:\Windows\nvsvc32.exe
C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe
C:\Users\Public\S-3685-5437-5687\winsrvn.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Users\Marek\Desktop\hijackthis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Users\Marek\AppData\Local\Temp\1680918.exe
C:\Program Files\trend micro\Marek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NVIDIA driver monitor] C:\Windows\nvsvc32.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [NVIDIA driver monitor] C:\Windows\nvsvc32.exe
O4 - HKCU\..\Run: [WindowsDriverControl] C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe
O4 - HKCU\..\Run: [MSNUpdateServices] C:\Users\Public\S-3685-5437-5687\winsrvn.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6598 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
C:\Windows\SysWOW64\PnkBstrA.exe
"taskhost.exe"
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun
C:\Windows\nvsvc32.exe
"C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Users\Public\S-3685-5437-5687\winsrvn.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
taskmgr.exe /2
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\msiexec.exe /V
C:\Windows\System32\svchost.exe -k swprv
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Program Files (x86)\Opera\opera.exe"
"C:\Users\Marek\Desktop\hijackthis.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Marek\Desktop\hijackthis.log
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:\Users\Marek\AppData\Local\Temp\1680918.exe"
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
"C:\Users\Marek\Desktop\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2008-12-11 6952480]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2008-12-11 1833504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"Steam"=c:\program files (x86)\steam\steam.exe [2010-08-27 1242448]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"NVIDIA driver monitor"=C:\Windows\nvsvc32.exe [2010-10-04 58880]
"WindowsDriverControl"=C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe [2010-10-10 225280]
"MSNUpdateServices"=C:\Users\Public\S-3685-5437-5687\winsrvn.exe [2010-10-20 208896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2006-11-17 77824]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-02 98304]
"NVIDIA driver monitor"=C:\Windows\nvsvc32.exe [2010-10-04 58880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"ForceActiveDesktopOn"=0
"NoActiveDesktopChanges"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\Marek\AppData\Local\Opera\Opera\temporary_downloads\P1753577.JPG-www.facebook.exe"="C:\Windows\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe"="C:\Users\Public\C-76947-8457-2745\wincdrsvn.exe:*:Enabled:WindowsDriverControl"
"C:\Users\Public\S-3685-5437-5687\winsrvn.exe"="C:\Users\Public\S-3685-5437-5687\winsrvn.exe:*:Enabled:MSNUpdateServices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-20 15:58:08 ----D---- C:\Program Files\trend micro
2010-10-20 15:48:07 ----AH---- C:\Users\Marek\AppData\Roaming\wimknrncds.txt
2010-10-10 17:52:15 ----A---- C:\tn.exe
2010-10-10 16:50:58 ----AH---- C:\Windows\SYSWOW64\winrtsnr.txt
2010-10-10 16:50:49 ----A---- C:\photo.exe
2010-10-04 18:00:09 ----RSH---- C:\Windows\nvsvc32.exe
2010-09-29 19:23:46 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-09-29 19:23:46 ----A---- C:\Windows\system32\tzres.dll

======List of files/folders modified in the last 1 months======

2010-10-20 16:43:39 ----D---- C:\Windows\system32\config
2010-10-20 16:43:34 ----D---- C:\wow
2010-10-20 16:43:34 ----D---- C:\Windows\Tasks
2010-10-20 16:43:34 ----D---- C:\Windows\SysWOW64
2010-10-20 16:43:34 ----D---- C:\Windows\system32\wfp
2010-10-20 16:43:34 ----D---- C:\Windows\system32\Tasks
2010-10-20 16:43:34 ----D---- C:\Windows\system32\catroot2
2010-10-20 16:43:34 ----D---- C:\Windows\System32
2010-10-20 16:43:34 ----D---- C:\Windows
2010-10-20 16:43:31 ----D---- C:\Windows\inf
2010-10-20 16:43:30 ----D---- C:\Users\Marek\AppData\Roaming\My Battle for Middle-earth Files
2010-10-20 16:43:29 ----D---- C:\Windows\registration
2010-10-20 16:43:17 ----D---- C:\Users\Marek\AppData\Roaming\Skype
2010-10-20 15:58:11 ----D---- C:\Windows\Temp
2010-10-20 15:58:08 ----RD---- C:\Program Files
2010-10-20 15:54:42 ----SHD---- C:\Windows\Installer
2010-10-20 15:54:33 ----D---- C:\Program Files (x86)\Opera
2010-10-20 15:53:48 ----SHD---- C:\System Volume Information
2010-10-20 15:48:09 ----D---- C:\Program Files (x86)\Steam
2010-10-16 10:13:08 ----D---- C:\Windows\system32\LogFiles
2010-10-16 09:29:47 ----D---- C:\Users\Marek\AppData\Roaming\skypePM
2010-09-29 20:20:54 ----D---- C:\Windows\winsxs
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\tr-TR
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\sr-Latn-CS
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\sl-SI
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\sk-SK
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\ro-RO
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\pt-PT
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\pt-BR
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\nl-NL
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\nb-NO
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\lt-LT
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\ja-JP
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\it-IT
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\hr-HR
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\fr-FR
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\fi-FI
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\en-US
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\el-GR
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\de-DE
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\cs-CZ
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\bg-BG
2010-09-29 20:20:45 ----D---- C:\Windows\SYSWOW64\ar-SA
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\zh-CN
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\th-TH
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\sv-SE
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\ru-RU
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\pl-PL
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\ko-KR
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\hu-HU
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\et-EE
2010-09-29 20:20:44 ----D---- C:\Windows\SYSWOW64\da-DK
2010-09-29 20:20:43 ----D---- C:\Windows\system32\tr-TR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\th-TH
2010-09-29 20:20:43 ----D---- C:\Windows\system32\sr-Latn-CS
2010-09-29 20:20:43 ----D---- C:\Windows\system32\sl-SI
2010-09-29 20:20:43 ----D---- C:\Windows\system32\sk-SK
2010-09-29 20:20:43 ----D---- C:\Windows\system32\ro-RO
2010-09-29 20:20:43 ----D---- C:\Windows\system32\pt-PT
2010-09-29 20:20:43 ----D---- C:\Windows\system32\pt-BR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\pl-PL
2010-09-29 20:20:43 ----D---- C:\Windows\system32\nl-NL
2010-09-29 20:20:43 ----D---- C:\Windows\system32\nb-NO
2010-09-29 20:20:43 ----D---- C:\Windows\system32\lt-LT
2010-09-29 20:20:43 ----D---- C:\Windows\system32\ko-KR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\ja-JP
2010-09-29 20:20:43 ----D---- C:\Windows\system32\it-IT
2010-09-29 20:20:43 ----D---- C:\Windows\system32\hu-HU
2010-09-29 20:20:43 ----D---- C:\Windows\system32\hr-HR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\fr-FR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\fi-FI
2010-09-29 20:20:43 ----D---- C:\Windows\system32\et-EE
2010-09-29 20:20:43 ----D---- C:\Windows\system32\en-US
2010-09-29 20:20:43 ----D---- C:\Windows\system32\el-GR
2010-09-29 20:20:43 ----D---- C:\Windows\system32\de-DE
2010-09-29 20:20:43 ----D---- C:\Windows\system32\da-DK
2010-09-29 20:20:43 ----D---- C:\Windows\system32\cs-CZ
2010-09-29 20:20:43 ----D---- C:\Windows\system32\bg-BG
2010-09-29 20:20:43 ----D---- C:\Windows\system32\ar-SA
2010-09-29 20:20:42 ----D---- C:\Windows\system32\zh-CN
2010-09-29 20:20:42 ----D---- C:\Windows\system32\sv-SE
2010-09-29 20:20:42 ----D---- C:\Windows\system32\ru-RU
2010-09-29 19:06:38 ----D---- C:\Windows\system32\catroot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor64;nvstor64; C:\Windows\system32\DRIVERS\nvstor64.sys [2008-08-18 170528]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-06-04 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-05-14 134024]
R2 cpuz132;cpuz132; \??\C:\Windows\system32\drivers\cpuz132_x64.sys [2009-03-27 19432]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-05-14 142776]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-05-14 165960]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-03-03 6402560]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-03 188928]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 116736]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-09-23 33856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2008-12-11 1577120]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx64.sys [2007-11-18 1484448]
S3 afobz6zs;afobz6zs; C:\Windows\system32\drivers\afobz6zs.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-03-03 6402560]
S3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-05-14 33608]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-08-31 23080]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-03 202752]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1823112]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2009-09-01 66872]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-09-12 841984]
S2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-11-01 320760]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-09-12 506624]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-08 1255736]
S4 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2009-05-14 731840]

-----------------EOF-----------------

[Kolcek93]

Log z MBAM
Malwarebytes' Anti-Malware 1.44
Verze databáze: 3688
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

20.10.2010 20:03:14
mbam-log-2010-10-20 (20-03-05).txt

Typ kontroly: Kompletní kontrola (C:\|)
Zkontrolované objekty: 658388
Uplynulý čas: 3 hour(s), 49 minute(s), 0 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 1
Infikované klíče registru: 2
Infikované hodnoty registru: 1
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> No action taken.

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Trojan.FakeAlert) -> No action taken.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Program Files (x86)\EA GAMES\The Battle for Middle-earth (tm)\LotR BfME 1.03 NoDVD.exe (Trojan.Downloader) -> No action taken.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> No action taken.

[motji]

Dobrý večer
Vše smažte.

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT 

- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde

[Kolcek93]

Tak scan pomocí OTL skončil chybou, že nejde vytvořit nějaký .bat soubor(tuším cmd.bat, ale nejsem si jistej). OTL.txt a Extras.txt mám hledat kde? Ve složce s programem? Protože tam není...

[motji]

Spusťte ho znovu v nuzovém režimu