Prosim o kontrolu logu

[BigKozy112]

Dobrý den, prosím o kontrolu logu. PC je zpomalené a občas "skáčou" okénka s problémy Rundll32..

Děkuji předem!

Logfile of random's system information tool 1.08 (written by random/random)
Run by kozy at 2010-10-28 12:13:36
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive C: has 13 GB (13%) free of 102 GB
Total RAM: 3326 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:13:52, on 28.10.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wuauclt.exe
C:\Users\kozy\Desktop\Programs\Miranda IM Bagr pack\miranda32.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Xfire\Xfire.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Users\kozy\AppData\Local\Temp\uninst1.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\kozy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\kozy\Downloads\RSIT.exe
C:\Program Files\trend micro\kozy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O1 - Hosts: ::1 localhost
O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [sysinfo] C:\Windows\system32\rundll32.exe C:\Users\kozy\AppData\Local\Temp\767992014Wsy.dll,Sets
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5810 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
TorrentMan Toolbar - C:\Program Files\TorrentMan\tbTor0.dll [2009-12-19 2166296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7c5c0f58-e061-457d-9033-77307f5ed00c} - TorrentMan Toolbar - C:\Program Files\TorrentMan\tbTor0.dll [2009-12-19 2166296]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-04-19 1008184]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [2009-03-04 17141760]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-04 98304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-04-19 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-04-19 125952]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-12 1414144]
"sysinfo"=C:\Users\kozy\AppData\Local\Temp\767992014Wsy.dll [2010-10-20 23272448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7.0\ICQ.exe [2010-08-22 133432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-28 12:13:36 ----D---- C:\rsit
2010-10-27 14:18:52 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-10-27 14:18:51 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-10-14 21:23:33 ----A---- C:\Windows\system32\msshsq.dll
2010-10-14 20:04:35 ----D---- C:\Program Files\Common Files\Skype
2010-10-14 18:20:40 ----A---- C:\Windows\system32\wmp.dll
2010-10-14 18:20:37 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-14 18:20:26 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-14 18:20:26 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-14 18:20:26 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-14 18:20:26 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-14 18:20:25 ----A---- C:\Windows\system32\netevent.dll
2010-10-14 18:20:23 ----A---- C:\Windows\system32\schannel.dll
2010-10-14 18:20:20 ----A---- C:\Windows\system32\ole32.dll
2010-10-14 18:20:19 ----A---- C:\Windows\system32\t2embed.dll
2010-10-14 18:20:17 ----A---- C:\Windows\system32\mshtml.dll
2010-10-14 18:20:16 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-14 18:20:16 ----A---- C:\Windows\system32\licmgr10.dll
2010-10-14 18:20:16 ----A---- C:\Windows\system32\ieframe.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\wininet.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\urlmon.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\occache.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\mstime.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\msfeedssync.exe
2010-10-14 18:20:15 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\jsproxy.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\ieUnatt.exe
2010-10-14 18:20:15 ----A---- C:\Windows\system32\ieui.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iesysprep.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iesetup.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iertutil.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iernonce.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iepeers.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\iedkcs32.dll
2010-10-14 18:20:15 ----A---- C:\Windows\system32\ie4uinit.exe
2010-10-14 18:20:12 ----A---- C:\Windows\system32\mfc40u.dll
2010-10-14 18:20:12 ----A---- C:\Windows\system32\mfc40.dll
2010-10-14 18:20:10 ----A---- C:\Windows\system32\win32k.sys
2010-10-14 18:20:09 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-14 18:20:07 ----A---- C:\Windows\system32\comctl32.dll
2010-10-01 18:29:26 ----D---- C:\Program Files\MobMapUpdater
2010-10-01 16:34:54 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-09-29 19:26:21 ----A---- C:\Windows\system32\tzres.dll
2010-09-29 16:16:47 ----A---- C:\Windows\adiras.ini
2010-09-29 16:15:00 ----A---- C:\Windows\system32\adinst32.dll

======List of files/folders modified in the last 1 months======

2010-10-28 12:13:52 ----D---- C:\Program Files\Trend Micro
2010-10-28 12:13:48 ----D---- C:\Windows\Prefetch
2010-10-28 12:13:44 ----D---- C:\Windows\temp
2010-10-28 11:29:31 ----D---- C:\Windows\System32
2010-10-28 11:29:31 ----D---- C:\Windows\inf
2010-10-28 11:29:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-27 23:32:53 ----D---- C:\Windows\winsxs
2010-10-27 23:32:53 ----D---- C:\Windows\AppPatch
2010-10-27 23:32:37 ----SHD---- C:\System Volume Information
2010-10-27 22:23:39 ----D---- C:\Users\kozy\AppData\Roaming\ICQ
2010-10-27 14:17:15 ----D---- C:\Windows\system32\catroot
2010-10-27 14:17:11 ----D---- C:\Windows\system32\catroot2
2010-10-26 21:43:07 ----D---- C:\Users\kozy\AppData\Roaming\Xfire
2010-10-25 19:21:00 ----A---- C:\Windows\system32\PnkBstrB.exe
2010-10-23 17:46:48 ----D---- C:\ProgramData\Xfire
2010-10-21 21:42:02 ----D---- C:\Users\kozy\AppData\Roaming\Skype
2010-10-21 17:29:23 ----D---- C:\Users\kozy\AppData\Roaming\skypePM
2010-10-19 11:41:44 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-17 21:29:26 ----D---- C:\Users\kozy\AppData\Roaming\mIRC
2010-10-15 14:29:26 ----D---- C:\Windows\rescache
2010-10-15 14:12:25 ----D---- C:\Windows\system32\en-US
2010-10-15 14:12:25 ----D---- C:\Windows\system32\drivers
2010-10-15 14:12:25 ----D---- C:\Windows\system32\cs-CZ
2010-10-15 14:12:25 ----D---- C:\Program Files\Windows Media Player
2010-10-15 14:12:24 ----D---- C:\Windows\system32\migration
2010-10-15 14:12:24 ----D---- C:\Program Files\Internet Explorer
2010-10-14 21:23:44 ----D---- C:\Windows\Debug
2010-10-14 21:23:42 ----A---- C:\Windows\system32\mrt.exe
2010-10-14 20:04:39 ----SHD---- C:\Windows\Installer
2010-10-14 20:04:37 ----D---- C:\Windows\system32\Tasks
2010-10-14 20:04:35 ----D---- C:\Program Files\Common Files
2010-10-08 20:02:07 ----D---- C:\Windows\Microsoft.NET
2010-10-08 20:01:53 ----RSD---- C:\Windows\assembly
2010-10-08 14:56:18 ----D---- C:\Windows
2010-10-01 18:29:26 ----RD---- C:\Program Files
2010-10-01 16:53:03 ----D---- C:\Windows\system32\appmgmt
2010-10-01 16:41:53 ----HD---- C:\Program Files\InstallShield Installation Information
2010-10-01 16:36:34 ----D---- C:\gPotato.eu
2010-09-30 05:26:26 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-29 16:15:28 ----D---- C:\Program Files\Common Files\InstallShield

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fvevol;BitLocker Drive Encryption Filter Driver; C:\Windows\System32\DRIVERS\fvevol.sys [2008-04-19 145464]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-06-06 721904]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2009-09-30 103440]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-11-04 5079040]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-11-19 25280]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-17 7680]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-08-01 1052704]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2008-08-24 15872]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2009-02-16 983552]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\Windows\System32\Drivers\adildr.sys []
S3 adiusbaw;USB ADSL WAN Adapter; C:\Windows\system32\DRIVERS\adiusbaw.sys []
S3 adn3j3x1;adn3j3x1; C:\Windows\system32\drivers\adn3j3x1.sys []
S3 catchme;catchme; \??\C:\Users\kozy\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-04-19 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-04-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-04-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-04-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-04-19 6016]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys []
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-04-19 35328]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2008-04-19 28160]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-04-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-04-19 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-04-19 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-04-19 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-11-04 172032]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [2008-09-08 450560]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [2008-09-08 184320]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-06-13 75064]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-27 34312]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-06 655624]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe []
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

[JaRon]

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"sysinfo"=-

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[BigKozy112]

Zde :


ComboFix 10-10-27.05 - kozy 28.10.2010 12:41:16.3.3 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.420.1029.18.3326.2263 [GMT 2:00]
Spuštěný z: c:\users\kozy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\kozy\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\kozy\AppData\Roaming\Desktopicon
c:\users\kozy\AppData\Roaming\Desktopicon\config.ini

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-28 )))))))))))))))))))))))))))))))
.

2010-10-28 10:46 . 2010-10-28 10:47 -------- d-----w- c:\users\kozy\AppData\Local\temp
2010-10-28 10:46 . 2010-10-28 10:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-28 10:13 . 2010-10-28 10:13 -------- d-----w- C:\rsit
2010-10-27 12:18 . 2010-08-26 16:01 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-10-27 12:18 . 2010-08-26 14:11 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-10-26 19:45 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8152C883-484F-4553-9099-B6D4AFF4654E}\mpengine.dll
2010-10-14 19:23 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2010-10-14 18:04 . 2010-10-14 18:04 -------- d-----w- c:\program files\Common Files\Skype
2010-10-01 16:29 . 2010-10-01 16:32 -------- d-----w- c:\program files\MobMapUpdater
2010-10-01 14:34 . 2010-10-01 14:52 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-09-29 17:26 . 2010-06-22 12:57 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-29 17:26 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-29 14:15 . 2001-09-05 02:18 77824 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2010-09-29 14:15 . 2001-09-05 02:18 225280 ----a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2010-09-29 14:15 . 2001-09-05 02:14 176128 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2010-09-29 14:15 . 2001-09-05 02:13 32768 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2010-09-29 14:15 . 2003-01-30 13:46 28672 ----a-w- c:\windows\system32\adinst32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-25 17:21 . 2009-06-06 17:21 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-10-25 17:21 . 2009-06-06 17:20 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-10-25 16:59 . 2009-06-06 17:21 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-10-19 09:41 . 2009-10-03 10:38 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-08-26 16:01 . 2010-10-27 12:18 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2010-08-26 16:01 . 2010-10-27 12:18 459776 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2010-08-26 16:01 . 2010-10-27 12:18 541696 ----a-w- c:\windows\apppatch\AcLayers.dll
2010-08-26 16:01 . 2010-10-27 12:18 2153984 ----a-w- c:\windows\apppatch\AcGenral.dll
2010-08-17 13:32 . 2010-09-15 12:31 126464 ----a-w- c:\windows\system32\spoolsv.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-12-19 2166296]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2009-12-19 13:15 2166296 ----a-w- c:\program files\TorrentMan\tbTor0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-12-19 2166296]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7C5C0F58-E061-457D-9033-77307F5ED00C}"= "c:\program files\TorrentMan\tbTor0.dll" [2009-12-19 2166296]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-04-19 125952]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-19 1008184]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-03-04 17141760]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-04 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-08-22 11:02 133432 ----a-w- c:\program files\ICQ7.0\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-12 10:34 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-06-06 721904]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-04 172032]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-02-16 983552]

.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-28 12:47
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\VDeck\VDeck.exe -r???????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-10-28 12:48:33
ComboFix-quarantined-files.txt 2010-10-28 10:48

Před spuštěním: Volných bajtů: 13 803 528 192
Po spuštění: Volných bajtů: 13 636 161 536

- - End Of File - - 421C2DAD3589C50DD9C5138CF35DB5ED

[JaRon]

no fajn, prescanuj PC s CureIT