Spoštění zp1, zp2.exe atd.

Zpráva

ghostik · #1 Příspěvek od **ghostik** » 31 říj 2010 09:31

Zdravím, neustále antivir hlásí neplechu. Jená se o soubor zp2.exe zpl.exe zpe3.exe, když ho vymažu, zastavím proces atd. po restartu je to tam zase. V procesech je popis STEELS. Můžete prosím projet log.
Děkuji

Logfile of random's system information tool 1.08 (written by random/random)
Run by Romana at 2010-10-31 09:01:13
Microsoft Windows 7 Professional
System drive C: has 86 GB (86%) free of 100 GB
Total RAM: 766 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:01:31, on 31.10.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Users\Romana\AppData\Local\Temp\Zp2.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
C:\Program Files\Bluetooth Suite\BtvStack.exe
C:\Program Files\Bluetooth Suite\AthBtTray.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Brownie\BrStsWnd.exe
C:\Program Files\Brownie\Brnipmon.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Public\Documents\RSIT.exe
C:\Program Files\trend micro\Romana.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\ProgramData\LangSoft\WebIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\ProgramData\LangSoft\WebIE.dll
O3 - Toolbar: PandoraTV Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe
O4 - HKLM\..\Run: [AtherosBtStack] "C:\Program Files\Bluetooth Suite\BtvStack.exe"
O4 - HKLM\..\Run: [AthBtTray] "C:\Program Files\Bluetooth Suite\AthBtTray.exe"
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe Autorun
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Metropolis] rundll32.exe C:\Users\Romana\AppData\Local\Temp\sshnas21.dll,GetHandle
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AtherosSvc - Atheros Communications - C:\Program Files\Bluetooth Suite\adminservice.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: GenericMount Helper Service - Symantec - C:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SymSnapService - Symantec - C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe

--
End of file - 7755 bytes

======Scheduled tasks folder======

C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\ProgramData\LangSoft\WebIE.dll [2010-10-29 798771]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
PandoraTV Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\ProgramData\LangSoft\WebIE.dll [2010-10-29 798771]
{D4027C7F-154A-4066-A1AD-4243D8127440} - PandoraTV Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-17 98304]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe [2010-03-04 496184]
"AtherosBtStack"=C:\Program Files\Bluetooth Suite\BtvStack.exe [2010-04-01 445528]
"AthBtTray"=C:\Program Files\Bluetooth Suite\AthBtTray.exe [2010-04-01 285784]
"AmIcoSinglun"=C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [2010-02-05 233472]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-02-26 1713448]
"Acer ePower Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2010-04-23 715296]
"MSSE"=C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-09-15 1094224]
"BrStsWnd"=C:\Program Files\Brownie\BrstsWnd.exe [2008-09-18 880640]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-10-11 14940040]
"Metropolis"=C:\Users\Romana\AppData\Local\Temp\sshnas21.dll [2010-10-29 315392]
""= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-09-02 672632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
C:\Program Files\Norton Ghost\Agent\VProTray.exe [2009-10-01 2596712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\U36VRSFLG6]
C:\Users\Romana\AppData\Local\Temp\Zpx.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-31 08:33:57 ----D---- C:\Program Files\trend micro
2010-10-31 08:33:56 ----D---- C:\rsit
2010-10-30 15:38:52 ----D---- C:\ProgramData\Nokia
2010-10-30 12:32:00 ----D---- C:\Windows\WindowsMobile
2010-10-30 09:18:45 ----D---- C:\Symantec
2010-10-30 09:14:52 ----D---- C:\Users\Romana\AppData\Roaming\URSoft
2010-10-30 09:14:51 ----AD---- C:\ProgramData\TEMP
2010-10-30 09:14:37 ----D---- C:\Program Files\Your Uninstaller 2010
2010-10-30 08:29:58 ----D---- C:\Program Files\MSXML 4.0
2010-10-29 22:44:31 ----D---- C:\Program Files\Ask.com
2010-10-29 22:42:33 ----D---- C:\Program Files\The KMPlayer
2010-10-29 22:34:27 ----A---- C:\Windows\WTRDCTM.INI
2010-10-29 22:27:47 ----D---- C:\TRANSLAT
2010-10-29 22:27:44 ----D---- C:\ProgramData\LangSoft
2010-10-29 22:27:25 ----D---- C:\Users\Romana\AppData\Roaming\LangSoft
2010-10-29 21:56:53 ----D---- C:\Users\Romana\AppData\Roaming\Nokia Ovi Suite
2010-10-29 21:29:04 ----D---- C:\Users\Romana\AppData\Roaming\Nokia
2010-10-29 21:27:29 ----D---- C:\ProgramData\PC Suite
2010-10-29 21:27:27 ----D---- C:\Users\Romana\AppData\Roaming\PC Suite
2010-10-29 21:24:00 ----D---- C:\Program Files\Common Files\Nokia
2010-10-29 21:23:04 ----A---- C:\Windows\system32\drivers\pccsmcfd.sys
2010-10-29 21:22:35 ----D---- C:\Program Files\PC Connectivity Solution
2010-10-29 21:21:48 ----A---- C:\Windows\system32\nmwcdcls.dll
2010-10-29 21:19:38 ----D---- C:\Users\Romana\AppData\Roaming\Symantec
2010-10-29 21:19:21 ----D---- C:\ProgramData\NokiaInstallerCache
2010-10-29 21:19:21 ----D---- C:\Program Files\Nokia
2010-10-29 20:48:21 ----D---- C:\Users\Romana\AppData\Roaming\Macromedia
2010-10-29 20:48:21 ----D---- C:\Users\Romana\AppData\Roaming\Adobe
2010-10-29 20:47:53 ----A---- C:\Windows\system32\capicom.dll
2010-10-29 20:47:52 ----D---- C:\Program Files\Symantec
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MSVCR71.DLL
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MSVCP71.DLL
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MFC71.DLL
2010-10-29 20:47:18 ----A---- C:\Windows\system32\drivers\WimFltr.sys
2010-10-29 20:46:16 ----A---- C:\Windows\system32\drivers\symsnap.sys
2010-10-29 20:45:59 ----A---- C:\Windows\system32\drivers\vproeventmonitor.sys
2010-10-29 20:45:45 ----A---- C:\Windows\system32\GEARAspi.dll
2010-10-29 20:45:45 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 20:43:54 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-10-29 20:42:53 ----D---- C:\ProgramData\Symantec
2010-10-29 20:42:53 ----D---- C:\ProgramData\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 20:42:53 ----D---- C:\Program Files\Norton Ghost
2010-10-29 20:34:26 ----D---- C:\Program Files\Microsoft Works
2010-10-29 20:33:52 ----D---- C:\Program Files\Microsoft Visual Studio
2010-10-29 20:33:51 ----D---- C:\Program Files\Common Files\DESIGNER
2010-10-29 20:32:36 ----D---- C:\Windows\PCHEALTH
2010-10-29 20:32:36 ----D---- C:\Program Files\Microsoft.NET
2010-10-29 20:27:52 ----D---- C:\Program Files\Microsoft Office
2010-10-29 20:27:50 ----D---- C:\ProgramData\Microsoft Help
2010-10-29 20:27:13 ----RHD---- C:\MSOCache
2010-10-29 20:25:07 ----A---- C:\Windows\BRVIDEO.INI
2010-10-29 20:25:07 ----A---- C:\Windows\brmx2001.ini
2010-10-29 20:25:04 ----A---- C:\Windows\BRWMARK.INI
2010-10-29 20:24:52 ----N---- C:\Windows\system32\brlmw03a.ini
2010-10-29 20:24:52 ----N---- C:\Windows\system32\brlmw03a.dll
2010-10-29 20:24:50 ----D---- C:\Program Files\Brownie
2010-10-29 20:24:50 ----A---- C:\Windows\HL-2150N.INI
2010-10-29 20:24:39 ----N---- C:\Windows\system32\Pdrvinst.dll
2010-10-29 20:24:39 ----N---- C:\Windows\system32\BRWEBUP.EXE
2010-10-29 20:24:39 ----N---- C:\Windows\system32\BrWebIns.dll
2010-10-29 20:24:39 ----D---- C:\Program Files\Brother
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BRRBTOOL.EXE
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BROSNMP.DLL
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BRLM03A.DLL
2010-10-29 20:24:10 ----A---- C:\Windows\Brownie.ini
2010-10-29 20:24:03 ----D---- C:\Program Files\Common Files\InstallShield
2010-10-29 20:18:40 ----D---- C:\Users\Romana\AppData\Roaming\skypePM
2010-10-29 20:16:39 ----D---- C:\Program Files\Common Files\Skype
2010-10-29 20:16:30 ----RD---- C:\Program Files\Skype
2010-10-29 20:16:29 ----D---- C:\Users\Romana\AppData\Roaming\Skype
2010-10-29 20:16:23 ----D---- C:\ProgramData\Skype
2010-10-29 20:15:58 ----D---- C:\Windows\system32\Macromed
2010-10-29 19:53:15 ----A---- C:\Windows\system32\msv1_0.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\PresentationHost.exe
2010-10-29 19:50:37 ----A---- C:\Windows\system32\netfxperf.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\mscoree.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\dfshim.dll
2010-10-29 19:48:10 ----D---- C:\Program Files\Microsoft Silverlight
2010-10-29 19:43:29 ----A---- C:\Windows\system32\browserchoice.exe
2010-10-29 19:41:41 ----A---- C:\Windows\system32\MRT.exe
2010-10-29 19:41:19 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-10-29 19:41:14 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-10-29 19:41:14 ----A---- C:\Windows\system32\drivers\ks.sys
2010-10-29 19:40:40 ----A---- C:\Windows\system32\msasn1.dll
2010-10-29 19:40:40 ----A---- C:\Windows\system32\ir32_32.dll
2010-10-29 19:40:40 ----A---- C:\Windows\system32\iccvid.dll
2010-10-29 19:40:39 ----A---- C:\Windows\system32\asycfilt.dll
2010-10-29 19:40:37 ----A---- C:\Windows\system32\mshtml.dll
2010-10-29 19:40:35 ----A---- C:\Windows\system32\ieframe.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\mstime.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\iertutil.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\wininet.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\urlmon.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\licmgr10.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\iedkcs32.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\msfeedssync.exe
2010-10-29 19:40:32 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\jsproxy.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\ieui.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\iepeers.dll
2010-10-29 19:40:21 ----A---- C:\Windows\system32\lsasrv.dll
2010-10-29 19:40:21 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-10-29 19:40:18 ----A---- C:\Windows\system32\tzres.dll
2010-10-29 19:40:02 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-10-29 19:40:01 ----A---- C:\Windows\system32\CertEnroll.dll
2010-10-29 19:40:00 ----A---- C:\Windows\system32\winresume.exe
2010-10-29 19:40:00 ----A---- C:\Windows\system32\winload.exe
2010-10-29 19:39:55 ----A---- C:\Windows\system32\CPFilters.dll
2010-10-29 19:39:54 ----A---- C:\Windows\system32\msdri.dll
2010-10-29 19:39:53 ----A---- C:\Windows\system32\psisdecd.dll
2010-10-29 19:39:48 ----A---- C:\Windows\system32\spoolsv.exe
2010-10-29 19:39:46 ----A---- C:\Windows\system32\winlogon.exe
2010-10-29 19:39:46 ----A---- C:\Windows\explorer.exe
2010-10-29 19:39:44 ----A---- C:\Windows\system32\ole32.dll
2010-10-29 19:39:42 ----A---- C:\Windows\system32\shell32.dll
2010-10-29 19:39:40 ----A---- C:\Windows\system32\inetcomm.dll
2010-10-29 19:39:39 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-10-29 19:39:38 ----A---- C:\Windows\system32\ntdll.dll
2010-10-29 19:39:37 ----A---- C:\Windows\system32\t2embed.dll
2010-10-29 19:39:36 ----A---- C:\Windows\system32\msxml3.dll
2010-10-29 19:39:36 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-10-29 19:39:35 ----A---- C:\Windows\system32\schannel.dll
2010-10-29 19:39:34 ----A---- C:\Windows\system32\rtutils.dll
2010-10-29 19:39:32 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-10-29 19:39:23 ----A---- C:\Windows\system32\mfc40u.dll
2010-10-29 19:39:23 ----A---- C:\Windows\system32\mfc40.dll
2010-10-29 19:39:20 ----A---- C:\Windows\system32\wmp.dll
2010-10-29 19:39:18 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-29 19:39:16 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-29 19:39:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-10-29 19:39:14 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-10-29 19:39:10 ----A---- C:\Windows\system32\tsbyuv.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\quartz.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msyuv.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msvidc32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msrle32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\mciavi32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\iyuv_32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\avifil32.dll
2010-10-29 19:39:08 ----A---- C:\Windows\system32\kernel32.dll
2010-10-29 19:39:07 ----A---- C:\Windows\system32\apphelp.dll
2010-10-29 19:39:06 ----A---- C:\Windows\system32\jscript.dll
2010-10-29 19:39:04 ----A---- C:\Windows\system32\comctl32.dll
2010-10-29 19:39:03 ----A---- C:\Windows\system32\win32k.sys
2010-10-29 19:33:37 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-29 19:33:24 ----A---- C:\Windows\system32\secproc_isv.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate.exe
2010-10-29 19:33:22 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-10-29 19:33:21 ----A---- C:\Windows\system32\vbscript.dll
2010-10-29 19:33:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-10-29 19:33:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-10-29 19:33:20 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-10-29 19:33:18 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-10-29 19:32:35 ----A---- C:\Windows\system32\fontsub.dll
2010-10-29 19:32:35 ----A---- C:\Windows\system32\atmfd.dll
2010-10-29 19:32:34 ----A---- C:\Windows\system32\atmlib.dll
2010-10-29 19:32:05 ----A---- C:\Windows\system32\wintrust.dll
2010-10-29 19:31:54 ----A---- C:\Windows\system32\cabview.dll
2010-10-29 19:09:48 ----D---- C:\Users\Romana\AppData\Roaming\Zoner
2010-10-29 19:08:24 ----D---- C:\Windows\Panther
2010-10-29 19:05:05 ----A---- C:\Windows\system32\drivers\sptd.sys
2010-10-29 19:04:57 ----D---- C:\Program Files\DAEMON Tools Lite
2010-10-29 19:04:04 ----D---- C:\Users\Romana\AppData\Roaming\DAEMON Tools Lite
2010-10-29 19:04:01 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-10-29 19:03:13 ----D---- C:\Users\Romana\AppData\Roaming\Win7codecs
2010-10-29 19:03:01 ----D---- C:\Program Files\Win7codecs
2010-10-29 19:02:44 ----D---- C:\ProgramData\Win7codecs
2010-10-29 18:59:03 ----D---- C:\Users\Romana\AppData\Roaming\Opera
2010-10-29 18:58:50 ----D---- C:\Program Files\Opera
2010-10-29 18:56:34 ----D---- C:\Program Files\Zoner
2010-10-29 18:55:22 ----D---- C:\Program Files\foxitreader
2010-10-29 18:54:57 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-29 18:53:13 ----D---- C:\Program Files\WinRAR
2010-10-29 18:52:44 ----D---- C:\Program Files\Microsoft Security Essentials
2010-10-29 18:47:01 ----D---- C:\ProgramData\OEM
2010-10-29 18:46:56 ----D---- C:\Program Files\Acer
2010-10-29 18:45:41 ----D---- C:\Program Files\Atheros
2010-10-29 18:45:41 ----A---- C:\Windows\system32\drivers\athr.sys
2010-10-29 18:45:20 ----D---- C:\ProgramData\Atheros
2010-10-29 18:45:19 ----D---- C:\Users\Romana\AppData\Roaming\InstallShield
2010-10-29 18:43:57 ----D---- C:\Windows\system32\Atheros_L1e
2010-10-29 18:43:02 ----D---- C:\Program Files\Synaptics
2010-10-29 18:42:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-10-29 18:42:04 ----A---- C:\Windows\system32\AmUStor.dll
2010-10-29 18:42:02 ----D---- C:\ProgramData\AmUStor
2010-10-29 18:42:02 ----D---- C:\Program Files\AmIcoSingLun
2010-10-29 18:38:33 ----D---- C:\Program Files\Bluetooth Suite
2010-10-29 18:36:35 ----D---- C:\Program Files\CONEXANT
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EEL32A.dll
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EEG32A.dll
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EED32A.dll
2010-10-29 18:36:14 ----D---- C:\Users\Romana\AppData\Roaming\ATI
2010-10-29 18:36:14 ----D---- C:\ProgramData\ATI
2010-10-29 18:33:38 ----D---- C:\Program Files\DIFX
2010-10-29 18:33:35 ----DC---- C:\Windows\system32\DRVSTORE
2010-10-29 18:33:35 ----D---- C:\Program Files\AMD
2010-10-29 18:33:35 ----A---- C:\Windows\system32\drivers\usbfilter.sys
2010-10-29 18:31:27 ----SHD---- C:\Windows\Installer
2010-10-29 18:31:27 ----A---- C:\Windows\system32\drivers\AtiPcie.sys
2010-10-29 18:31:27 ----A---- C:\Windows\system32\drivers\AtiHdmi.sys
2010-10-29 18:31:27 ----A---- C:\Windows\system32\coinst.dll
2010-10-29 18:31:27 ----A---- C:\Windows\system32\atiuxpag.dll
2010-10-29 18:31:27 ----A---- C:\Windows\system32\atiumdva.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atipmdag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atikmpag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atikmdag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiumdag.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiu9pag.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atitmmxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atipdlxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atioglxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atimuixx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atimpc32.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiglpxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atigktxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiesrxx.exe
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atieclxx.exe
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atidxx32.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\ATIDEMGX.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\aticalrt.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\amdpcom32.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\drivers\ati2erec.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\aticaldd.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\aticalcl.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atibtmon.exe
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atiapfxx.exe
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atiadlxx.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\ati2edxx.dll
2010-10-29 18:31:12 ----D---- C:\Program Files\ATI Technologies
2010-10-29 18:31:09 ----D---- C:\Program Files\ATI
2010-10-29 18:28:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-29 18:24:47 ----D---- C:\Users\Romana\AppData\Roaming\Identities
2010-10-29 18:24:25 ----SD---- C:\Users\Romana\AppData\Roaming\Microsoft
2010-10-29 18:24:25 ----D---- C:\Users\Romana\AppData\Roaming\Media Center Programs
2010-10-29 18:22:42 ----SHD---- C:\Recovery
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Šablony
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Plocha
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Oblíbené položky
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Nabídka Start
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Dokumenty
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Data aplikací
2010-10-29 18:13:20 ----D---- C:\Windows\SoftwareDistribution
2010-10-29 18:10:25 ----D---- C:\Windows\Prefetch
2010-10-29 18:10:06 ----SHD---- C:\System Volume Information
2010-10-29 18:10:06 ----ASH---- C:\pagefile.sys
2010-10-29 18:10:06 ----ASH---- C:\hiberfil.sys
2010-10-29 17:02:56 ----A---- C:\Windows\system32\WdfCoInstaller01009.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\SynTPCo4.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\SynTPAPI.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\drivers\SynTP.sys
2010-10-29 17:02:55 ----A---- C:\Windows\system32\SynCtrl.dll
2010-10-29 17:02:55 ----A---- C:\Windows\system32\SynCOM.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\UCI32A55.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\FMPropPageExt.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\FMAPO.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\drivers\CHDRT32.sys
2010-10-29 15:11:00 ----A---- C:\Windows\system32\CX32FP25.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\CDolbyExt32.dll
2010-10-29 15:09:54 ----A---- C:\Windows\system32\drivers\L1C62x86.sys

======List of files/folders modified in the last 1 months======

2010-10-31 08:51:46 ----D---- C:\Windows\Temp
2010-10-31 08:33:57 ----RD---- C:\Program Files
2010-10-31 08:26:44 ----D---- C:\Windows\System32
2010-10-31 08:26:44 ----D---- C:\Windows\inf
2010-10-31 08:24:47 ----D---- C:\Windows\system32\Tasks
2010-10-31 08:24:43 ----D---- C:\Windows\Tasks
2010-10-31 08:21:34 ----D---- C:\Windows\system32\config
2010-10-31 08:10:22 ----RSD---- C:\Windows\assembly
2010-10-30 19:00:52 ----D---- C:\Windows\system32\drivers
2010-10-30 15:38:52 ----HD---- C:\ProgramData
2010-10-30 13:30:32 ----D---- C:\Windows\system32\wdi
2010-10-30 12:35:19 ----D---- C:\Windows\system32\drivers\UMDF
2010-10-30 12:35:18 ----D---- C:\Windows\system32\DriverStore
2010-10-30 12:35:18 ----D---- C:\Windows\system32\catroot
2010-10-30 12:33:12 ----D---- C:\Windows\system32\LogFiles
2010-10-30 12:32:00 ----D---- C:\Windows
2010-10-30 12:31:48 ----D---- C:\Windows\system32\catroot2
2010-10-30 12:20:42 ----D---- C:\Windows\system32\NDF
2010-10-30 09:11:00 ----SD---- C:\ProgramData\Microsoft
2010-10-30 08:49:54 ----D---- C:\Windows\winsxs
2010-10-30 08:49:49 ----D---- C:\Windows\Microsoft.NET
2010-10-30 08:35:09 ----RSD---- C:\Windows\Fonts
2010-10-30 08:34:57 ----D---- C:\Program Files\Common Files\microsoft shared
2010-10-30 08:32:37 ----D---- C:\Program Files\Common Files\System
2010-10-30 08:32:37 ----A---- C:\Windows\win.ini
2010-10-29 22:07:39 ----D---- C:\Windows\system32\cs-CZ
2010-10-29 21:59:10 ----D---- C:\Windows\system32\en-US
2010-10-29 21:42:11 ----D---- C:\Windows\ModemLogs
2010-10-29 21:24:00 ----D---- C:\Program Files\Common Files
2010-10-29 20:48:31 ----D---- C:\Windows\Registration
2010-10-29 20:29:28 ----D---- C:\Windows\ShellNew
2010-10-29 19:58:55 ----D---- C:\Windows\system32\migration
2010-10-29 19:58:55 ----D---- C:\Program Files\Internet Explorer
2010-10-29 19:58:53 ----D---- C:\Windows\ehome
2010-10-29 19:58:52 ----D---- C:\Windows\system32\Boot
2010-10-29 19:58:52 ----D---- C:\Program Files\Windows Mail
2010-10-29 19:58:51 ----D---- C:\Windows\AppPatch
2010-10-29 19:58:51 ----D---- C:\Program Files\Windows Media Player
2010-10-29 19:41:42 ----D---- C:\Windows\debug
2010-10-29 19:30:40 ----D---- C:\Windows\Logs
2010-10-29 19:07:57 ----D---- C:\Windows\Setup
2010-10-29 18:38:09 ----D---- C:\Windows\system32\restore
2010-10-29 18:34:01 ----D---- C:\Windows\system32\CodeIntegrity
2010-10-29 18:28:04 ----D---- C:\Windows\system32\wbem
2010-10-29 18:24:44 ----SHD---- C:\$Recycle.Bin
2010-10-29 18:24:25 ----RD---- C:\Users
2010-10-29 18:22:42 ----D---- C:\Program Files\Windows NT
2010-10-29 18:13:21 ----D---- C:\Windows\system32\sysprep
2010-10-29 18:11:01 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-29 691696]
R0 symsnap;Symantec Volume Snap Shot Driver; C:\Windows\system32\DRIVERS\symsnap.sys [2009-09-21 138592]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-03-18 5341696]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2010-03-31 1792512]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 100352]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2010-03-31 517688]
R3 GEARAspiWDM;GearAspiWDM; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 GenericMount;Generic Mount Driver; C:\Windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-02-26 242992]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
S3 aqy4sf98;aqy4sf98; C:\Windows\system32\drivers\aqy4sf98.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2010-03-30 47144]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 VProEventMonitor;Symantec Event Monitor Driver; C:\Windows\system32\DRIVERS\vproeventmonitor.sys [2009-09-21 15096]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2009-10-01 131000]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-17 172032]
R2 AtherosSvc;AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
R2 Norton Ghost;Norton Ghost; C:\Program Files\Norton Ghost\Agent\VProSvc.exe [2009-10-01 4584288]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 SymSnapService;SymSnapService; C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 GenericMount Helper Service;GenericMount Helper Service; C:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [2009-07-14 7168]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 31 říj 2010 09:47

Zdravim a pekny den preji

Havet tam je a ne jedna

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

ghostik · #3 Příspěvek od **ghostik** » 31 říj 2010 10:59

ComboFix 10-10-30.04 - Romana 31.10.2010 10:02:54.1.1 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.766.239 [GMT 1:00]
Spuštěný z: c:\users\Romana\Desktop\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Romana\AppData\Local\Temp\sshnas21.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-31 07:33 . 2010-10-31 08:01 -------- d-----w- c:\program files\trend micro
2010-10-31 07:33 . 2010-10-31 07:34 -------- d-----w- C:\rsit
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49DE2646-F771-48AC-A591-872F65EC5CBE}\mpengine.dll
2010-10-30 14:38 . 2010-10-30 14:38 -------- d-----w- c:\programdata\Nokia
2010-10-30 11:32 . 2010-10-30 11:33 -------- d-----w- c:\windows\WindowsMobile
2010-10-30 08:18 . 2010-10-30 08:18 -------- d-----w- C:\Symantec
2010-10-30 08:14 . 2010-10-30 08:14 -------- d-----w- c:\program files\Your Uninstaller 2010
2010-10-30 07:36 . 2010-10-30 07:36 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-10-30 07:29 . 2010-10-30 07:29 -------- d-----w- c:\program files\MSXML 4.0
2010-10-29 21:44 . 2010-10-29 21:44 -------- d-----w- c:\program files\Ask.com
2010-10-29 21:42 . 2010-10-29 21:44 -------- d-----w- c:\program files\The KMPlayer
2010-10-29 21:27 . 2010-10-29 21:34 -------- d-----w- C:\TRANSLAT
2010-10-29 21:27 . 2010-10-29 21:33 -------- d-----w- c:\programdata\LangSoft
2010-10-29 20:27 . 2010-10-29 20:52 -------- d-----w- c:\programdata\PC Suite
2010-10-29 20:24 . 2010-10-29 20:24 -------- d-----w- c:\program files\Common Files\Nokia
2010-10-29 20:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-10-29 20:22 . 2010-10-29 20:22 -------- d-----w- c:\program files\PC Connectivity Solution
2010-10-29 20:21 . 2010-02-26 12:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-10-29 20:19 . 2010-10-29 20:23 -------- d-----w- c:\program files\Nokia
2010-10-29 19:47 . 2010-10-29 19:47 -------- d-----w- c:\program files\Symantec
2010-10-29 19:47 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-10-29 19:47 . 2009-10-01 20:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys
2010-10-29 19:46 . 2009-09-21 18:20 138592 ----a-w- c:\windows\system32\drivers\symsnap.sys
2010-10-29 19:45 . 2009-09-21 18:40 15096 ----a-w- c:\windows\system32\drivers\vproeventmonitor.sys
2010-10-29 19:45 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 19:45 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-10-29 19:43 . 2010-10-29 19:47 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-29 19:42 . 2010-10-30 17:33 -------- d-----w- c:\programdata\Symantec
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\program files\Norton Ghost
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 19:34 . 2010-10-30 07:34 -------- d-----w- c:\program files\Microsoft Works
2010-10-29 19:32 . 2010-10-29 20:58 -------- d-----w- c:\program files\Microsoft.NET
2010-10-29 19:32 . 2010-10-29 19:32 -------- d-----w- c:\windows\PCHEALTH
2010-10-29 19:27 . 2010-10-31 07:15 -------- d-----w- c:\programdata\Microsoft Help
2010-10-29 19:27 . 2010-10-29 19:27 -------- d-----r- C:\MSOCache
2010-10-29 19:24 . 2004-08-09 22:42 77824 ------w- c:\windows\system32\brlmw03a.dll
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brownie
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brother
2010-10-29 19:24 . 2007-08-19 16:34 94208 ----a-w- c:\windows\system32\BRRBTOOL.EXE
2010-10-29 19:24 . 2007-04-23 23:30 192512 ------w- c:\windows\system32\Pdrvinst.dll
2010-10-29 19:24 . 2006-12-21 02:23 176128 ----a-w- c:\windows\system32\BROSNMP.DLL
2010-10-29 19:24 . 2006-08-04 15:43 73728 ------w- c:\windows\system32\BRWEBUP.EXE
2010-10-29 19:24 . 2006-08-03 11:14 90112 ------w- c:\windows\system32\BrWebIns.dll
2010-10-29 19:24 . 2004-09-23 15:00 24223 ----a-w- c:\windows\system32\BRLM03A.DLL
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\program files\Common Files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----r- c:\program files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\programdata\Skype
2010-10-29 19:15 . 2010-10-29 19:15 -------- d-----w- c:\windows\system32\Macromed
2010-10-29 18:53 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-10-29 18:50 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-10-29 18:50 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-10-29 18:50 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-10-29 18:50 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-10-29 18:50 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-10-29 18:48 . 2010-10-29 18:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-29 18:43 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-10-29 18:41 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-10-29 18:41 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-10-29 18:41 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-10-29 18:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-29 18:33 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-29 18:32 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-10-29 18:32 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-10-29 18:32 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-29 18:32 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-10-29 18:31 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-10-29 18:08 . 2010-10-29 17:23 -------- d-----w- c:\windows\Panther
2010-10-29 18:05 . 2010-10-29 18:05 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-29 18:04 . 2010-10-29 18:05 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-10-29 18:04 . 2010-10-29 18:04 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-10-29 18:03 . 2010-10-29 18:03 -------- d-----w- c:\program files\Win7codecs
2010-10-29 18:02 . 2010-10-29 18:03 -------- d-----w- c:\programdata\Win7codecs
2010-10-29 17:58 . 2010-10-29 17:58 -------- d-----w- c:\program files\Opera
2010-10-29 17:56 . 2010-10-29 17:56 -------- d-----w- c:\program files\Zoner
2010-10-29 17:55 . 2010-10-29 17:55 -------- d-----w- c:\program files\foxitreader
2010-10-29 17:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-29 17:52 . 2010-10-29 18:52 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-29 17:47 . 2010-10-29 17:47 -------- d-----w- c:\programdata\OEM
2010-10-29 17:46 . 2010-10-29 17:46 -------- d-----w- c:\program files\Acer
2010-10-29 17:45 . 2010-10-29 17:45 -------- d-----w- c:\program files\Atheros
2010-10-29 17:45 . 2010-03-31 16:51 1792512 ----a-w- c:\windows\system32\drivers\athr.sys
2010-10-29 17:45 . 2010-10-29 20:39 -------- d-----w- c:\programdata\Atheros
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\windows\system32\Atheros_L1e
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\program files\Synaptics
2010-10-29 17:42 . 2010-10-29 19:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-29 17:42 . 2009-05-05 12:08 9216 ----a-w- c:\windows\system32\AmUStor.dll
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\programdata\AmUStor
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\program files\AmIcoSingLun
2010-10-29 17:38 . 2010-10-29 17:38 -------- d-----w- c:\program files\Bluetooth Suite
2010-10-29 17:36 . 2010-04-04 22:03 1048 ------w- c:\windows\system32\drivers\SamSfPa.dat
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\program files\CONEXANT
2010-10-29 17:36 . 2009-12-16 08:26 76488 ----a-w- c:\windows\system32\EEL32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 62664 ----a-w- c:\windows\system32\EEG32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 168648 ----a-w- c:\windows\system32\EED32A.dll
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\programdata\ATI
2010-10-29 17:34 . 2010-10-29 17:34 0 ----a-w- c:\windows\ativpsrm.bin
2010-10-29 17:33 . 2010-10-29 20:23 -------- d-----w- c:\program files\DIFX
2010-10-29 17:33 . 2010-10-29 20:23 -------- dc----w- c:\windows\system32\DRVSTORE
2010-10-29 17:33 . 2010-10-29 17:33 -------- d-----w- c:\program files\AMD
2010-10-29 17:33 . 2009-12-22 00:26 30392 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2010-10-29 17:28 . 2010-10-31 08:56 -------- d-----w- c:\windows\system32\wbem\Performance
2010-10-29 17:24 . 2010-10-29 17:24 -------- d-----w- c:\users\Romana
2010-10-29 16:02 . 2010-02-26 08:33 242992 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-10-29 16:02 . 2010-02-26 08:31 165160 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-10-29 16:02 . 2010-02-26 08:31 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-10-29 16:02 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2010-10-29 16:02 . 2010-02-26 08:31 210216 ----a-w- c:\windows\system32\SynCtrl.dll
2010-10-29 16:02 . 2010-02-26 08:31 173352 ----a-w- c:\windows\system32\SynCOM.dll
2010-10-29 14:11 . 2010-03-31 12:49 517688 ----a-w- c:\windows\system32\drivers\CHDRT32.sys
2010-10-29 14:11 . 2010-03-30 08:57 1737272 ----a-w- c:\windows\system32\CX32FP25.dll
2010-10-29 14:11 . 2010-03-30 08:45 301624 ----a-w- c:\windows\system32\UCI32A55.dll
2010-10-29 14:11 . 2010-03-16 10:43 303008 ----a-w- c:\windows\system32\FMAPO.dll
2010-10-29 14:11 . 2010-03-15 08:56 76344 ----a-w- c:\windows\system32\FMPropPageExt.dll
2010-10-29 14:11 . 2010-01-20 11:48 428088 ----a-w- c:\windows\system32\CDolbyExt32.dll
2010-10-29 14:09 . 2010-04-21 13:47 68208 ----a-w- c:\windows\system32\drivers\L1C62x86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-29 17:39 . 2010-04-01 05:36 246804 ----a-w- c:\windows\system32\drivers\AtherosBt.bin
2010-08-21 05:36 . 2010-10-29 18:39 224256 ----a-w- c:\windows\system32\schannel.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-17 98304]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2010-03-04 496184]
"AtherosBtStack"="c:\program files\Bluetooth Suite\BtvStack.exe" [2010-04-01 445528]
"AthBtTray"="c:\program files\Bluetooth Suite\AthBtTray.exe" [2010-04-01 285784]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2010-02-05 233472]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-04-23 715296]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-18 880640]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 08:26 672632 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
2009-10-01 19:32 2596712 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [2010-03-30 47144]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
R3 GenericMount Helper Service;GenericMount Helper Service;c:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2009-07-14 7168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-29 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-17 172032]
S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-17 5341696]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
S3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-U36VRSFLG6 - c:\users\Romana\AppData\Local\Temp\Zpx.exe
AddRemove-PC Translator - c:\users\Romana\AppData\Local\Temp\UN32.EXE

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3364)
c:\program files\Bluetooth Suite\AthCopyHook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\atieclxx.exe
c:\program files\Norton Ghost\Agent\VProSvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Brownie\Brnipmon.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-10-31 10:54:59 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-31 09:54

Před spuštěním: Volných bajtů: 89 641 361 408
Po spuštění: Volných bajtů: 89 799 680 000

- - End Of File - - F388C8736DD760B95A57C7877FEAA86B

#4 Příspěvek od **vyosek** » 31 říj 2010 11:12

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

ghostik · #5 Příspěvek od **ghostik** » 31 říj 2010 11:49

ComboFix 10-10-30.04 - Romana 31.10.2010 11:19:38.2.1 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.766.248 [GMT 1:00]
Spuštěný z: c:\users\Romana\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Romana\Desktop\CFScript.txt
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-31 10:42 . 2010-10-31 10:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-31 07:33 . 2010-10-31 08:01 -------- d-----w- c:\program files\trend micro
2010-10-31 07:33 . 2010-10-31 07:34 -------- d-----w- C:\rsit
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49DE2646-F771-48AC-A591-872F65EC5CBE}\mpengine.dll
2010-10-30 14:38 . 2010-10-30 14:38 -------- d-----w- c:\programdata\Nokia
2010-10-30 11:32 . 2010-10-30 11:33 -------- d-----w- c:\windows\WindowsMobile
2010-10-30 08:18 . 2010-10-30 08:18 -------- d-----w- C:\Symantec
2010-10-30 08:14 . 2010-10-30 08:14 -------- d-----w- c:\program files\Your Uninstaller 2010
2010-10-30 07:36 . 2010-10-30 07:36 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-10-30 07:29 . 2010-10-30 07:29 -------- d-----w- c:\program files\MSXML 4.0
2010-10-29 21:42 . 2010-10-29 21:44 -------- d-----w- c:\program files\The KMPlayer
2010-10-29 21:27 . 2010-10-29 21:34 -------- d-----w- C:\TRANSLAT
2010-10-29 21:27 . 2010-10-29 21:33 -------- d-----w- c:\programdata\LangSoft
2010-10-29 20:27 . 2010-10-29 20:52 -------- d-----w- c:\programdata\PC Suite
2010-10-29 20:24 . 2010-10-29 20:24 -------- d-----w- c:\program files\Common Files\Nokia
2010-10-29 20:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-10-29 20:22 . 2010-10-29 20:22 -------- d-----w- c:\program files\PC Connectivity Solution
2010-10-29 20:21 . 2010-02-26 12:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-10-29 20:19 . 2010-10-29 20:23 -------- d-----w- c:\program files\Nokia
2010-10-29 19:47 . 2010-10-29 19:47 -------- d-----w- c:\program files\Symantec
2010-10-29 19:47 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-10-29 19:47 . 2009-10-01 20:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys
2010-10-29 19:46 . 2009-09-21 18:20 138592 ----a-w- c:\windows\system32\drivers\symsnap.sys
2010-10-29 19:45 . 2009-09-21 18:40 15096 ----a-w- c:\windows\system32\drivers\vproeventmonitor.sys
2010-10-29 19:45 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 19:45 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-10-29 19:43 . 2010-10-29 19:47 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-29 19:42 . 2010-10-30 17:33 -------- d-----w- c:\programdata\Symantec
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\program files\Norton Ghost
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 19:34 . 2010-10-30 07:34 -------- d-----w- c:\program files\Microsoft Works
2010-10-29 19:32 . 2010-10-29 20:58 -------- d-----w- c:\program files\Microsoft.NET
2010-10-29 19:32 . 2010-10-29 19:32 -------- d-----w- c:\windows\PCHEALTH
2010-10-29 19:27 . 2010-10-31 07:15 -------- d-----w- c:\programdata\Microsoft Help
2010-10-29 19:27 . 2010-10-29 19:27 -------- d-----r- C:\MSOCache
2010-10-29 19:24 . 2004-08-09 22:42 77824 ------w- c:\windows\system32\brlmw03a.dll
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brownie
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brother
2010-10-29 19:24 . 2007-08-19 16:34 94208 ----a-w- c:\windows\system32\BRRBTOOL.EXE
2010-10-29 19:24 . 2007-04-23 23:30 192512 ------w- c:\windows\system32\Pdrvinst.dll
2010-10-29 19:24 . 2006-12-21 02:23 176128 ----a-w- c:\windows\system32\BROSNMP.DLL
2010-10-29 19:24 . 2006-08-04 15:43 73728 ------w- c:\windows\system32\BRWEBUP.EXE
2010-10-29 19:24 . 2006-08-03 11:14 90112 ------w- c:\windows\system32\BrWebIns.dll
2010-10-29 19:24 . 2004-09-23 15:00 24223 ----a-w- c:\windows\system32\BRLM03A.DLL
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\program files\Common Files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----r- c:\program files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\programdata\Skype
2010-10-29 19:15 . 2010-10-29 19:15 -------- d-----w- c:\windows\system32\Macromed
2010-10-29 18:53 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-10-29 18:50 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-10-29 18:50 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-10-29 18:50 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-10-29 18:50 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-10-29 18:50 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-10-29 18:48 . 2010-10-29 18:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-29 18:43 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-10-29 18:41 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-10-29 18:41 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-10-29 18:41 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-10-29 18:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-29 18:33 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-29 18:32 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-10-29 18:32 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-10-29 18:32 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-29 18:32 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-10-29 18:31 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-10-29 18:08 . 2010-10-29 17:23 -------- d-----w- c:\windows\Panther
2010-10-29 18:05 . 2010-10-29 18:05 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-29 18:04 . 2010-10-29 18:05 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-10-29 18:04 . 2010-10-29 18:04 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-10-29 18:03 . 2010-10-29 18:03 -------- d-----w- c:\program files\Win7codecs
2010-10-29 18:02 . 2010-10-29 18:03 -------- d-----w- c:\programdata\Win7codecs
2010-10-29 17:58 . 2010-10-29 17:58 -------- d-----w- c:\program files\Opera
2010-10-29 17:56 . 2010-10-29 17:56 -------- d-----w- c:\program files\Zoner
2010-10-29 17:55 . 2010-10-29 17:55 -------- d-----w- c:\program files\foxitreader
2010-10-29 17:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-29 17:52 . 2010-10-29 18:52 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-29 17:47 . 2010-10-29 17:47 -------- d-----w- c:\programdata\OEM
2010-10-29 17:46 . 2010-10-29 17:46 -------- d-----w- c:\program files\Acer
2010-10-29 17:45 . 2010-10-29 17:45 -------- d-----w- c:\program files\Atheros
2010-10-29 17:45 . 2010-03-31 16:51 1792512 ----a-w- c:\windows\system32\drivers\athr.sys
2010-10-29 17:45 . 2010-10-29 20:39 -------- d-----w- c:\programdata\Atheros
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\windows\system32\Atheros_L1e
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\program files\Synaptics
2010-10-29 17:42 . 2010-10-29 19:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-29 17:42 . 2009-05-05 12:08 9216 ----a-w- c:\windows\system32\AmUStor.dll
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\programdata\AmUStor
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\program files\AmIcoSingLun
2010-10-29 17:38 . 2010-10-29 17:38 -------- d-----w- c:\program files\Bluetooth Suite
2010-10-29 17:36 . 2010-04-04 22:03 1048 ------w- c:\windows\system32\drivers\SamSfPa.dat
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\program files\CONEXANT
2010-10-29 17:36 . 2009-12-16 08:26 76488 ----a-w- c:\windows\system32\EEL32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 62664 ----a-w- c:\windows\system32\EEG32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 168648 ----a-w- c:\windows\system32\EED32A.dll
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\programdata\ATI
2010-10-29 17:34 . 2010-10-29 17:34 0 ----a-w- c:\windows\ativpsrm.bin
2010-10-29 17:33 . 2010-10-29 20:23 -------- d-----w- c:\program files\DIFX
2010-10-29 17:33 . 2010-10-29 20:23 -------- dc----w- c:\windows\system32\DRVSTORE
2010-10-29 17:33 . 2010-10-29 17:33 -------- d-----w- c:\program files\AMD
2010-10-29 17:33 . 2009-12-22 00:26 30392 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2010-10-29 17:28 . 2010-10-31 09:55 -------- d-----w- c:\windows\system32\wbem\Performance
2010-10-29 17:24 . 2010-10-29 17:24 -------- d-----w- c:\users\Romana
2010-10-29 16:02 . 2010-02-26 08:33 242992 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-10-29 16:02 . 2010-02-26 08:31 165160 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-10-29 16:02 . 2010-02-26 08:31 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-10-29 16:02 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2010-10-29 16:02 . 2010-02-26 08:31 210216 ----a-w- c:\windows\system32\SynCtrl.dll
2010-10-29 16:02 . 2010-02-26 08:31 173352 ----a-w- c:\windows\system32\SynCOM.dll
2010-10-29 14:11 . 2010-03-31 12:49 517688 ----a-w- c:\windows\system32\drivers\CHDRT32.sys
2010-10-29 14:11 . 2010-03-30 08:57 1737272 ----a-w- c:\windows\system32\CX32FP25.dll
2010-10-29 14:11 . 2010-03-30 08:45 301624 ----a-w- c:\windows\system32\UCI32A55.dll
2010-10-29 14:11 . 2010-03-16 10:43 303008 ----a-w- c:\windows\system32\FMAPO.dll
2010-10-29 14:11 . 2010-03-15 08:56 76344 ----a-w- c:\windows\system32\FMPropPageExt.dll
2010-10-29 14:11 . 2010-01-20 11:48 428088 ----a-w- c:\windows\system32\CDolbyExt32.dll
2010-10-29 14:09 . 2010-04-21 13:47 68208 ----a-w- c:\windows\system32\drivers\L1C62x86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-29 17:39 . 2010-04-01 05:36 246804 ----a-w- c:\windows\system32\drivers\AtherosBt.bin
2010-08-21 05:36 . 2010-10-29 18:39 224256 ----a-w- c:\windows\system32\schannel.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-17 98304]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2010-03-04 496184]
"AtherosBtStack"="c:\program files\Bluetooth Suite\BtvStack.exe" [2010-04-01 445528]
"AthBtTray"="c:\program files\Bluetooth Suite\AthBtTray.exe" [2010-04-01 285784]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2010-02-05 233472]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-04-23 715296]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-18 880640]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
2009-10-01 19:32 2596712 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [2010-03-30 47144]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
R3 GenericMount Helper Service;GenericMount Helper Service;c:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2009-07-14 7168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-29 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-17 172032]
S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-17 5341696]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
S3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-10-31 11:46:32
ComboFix-quarantined-files.txt 2010-10-31 10:46
ComboFix2.txt 2010-10-31 09:55

Před spuštěním: Volných bajtů: 89 851 514 880
Po spuštění: Volných bajtů: 89 803 321 344

- - End Of File - - 55C98BAC757BCF13A54B8E1C42F9EFF9

#6 Příspěvek od **vyosek** » 31 říj 2010 12:01

Jak se chova PC

ghostik · #7 Příspěvek od **ghostik** » 31 říj 2010 12:26

Děkuji za optání, daří se mu skvěle. CPU už není tak zatížen, procesy jsou čisté, složka Temp je o 90% prázdnější. Good work. Thx. Mohu ještě tady přihodit další log? Každý člen domácnosti má jedno PC. Děti na tom budou asi nejhůř. Po vyčištění udělám komplet zálohu HDD a když bude problém jen to překopčím.

#8 Příspěvek od **vyosek** » 31 říj 2010 12:37

Na dalsi PC zalozte nove tema a do predmetu dejte "pro vyosek - PC2" - kolegove mi to nechaji, tady by se nam to motalo

Zde jeste uklidime

Odinstalujte Combofix

Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
Napiste ComboFix /Uninstall
Stisknete Enter
Tohle smaze Combofix a jeho slozky

T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

A myslim ze ho muzem prohlasit za cisty

VIRY.CZ

Spoštění zp1, zp2.exe atd.

Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.

Re: Spoštění zp1, zp2.exe atd.