prosím o kontrolu logu

[Evad...]

Několik minut po spuštění pc modrá smrt...prosím o kontrolu...díky


Logfile of random's system information tool 1.08 (written by random/random)
Run by TOM at 2010-11-22 14:25:34
Microsoft Windows 7 Professional
System drive E: has 20 GB (64%) free of 32 GB
Total RAM: 1014 MB (48% free)

HijackThis download failed

======Scheduled tasks folder======

E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1462245984-1767449129-2218748024-1000Core.job
E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1462245984-1767449129-2218748024-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - E:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=E:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=E:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=E:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"IndicatorUtility"=E:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [2009-06-22 47464]
"BCSSync"=E:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]
"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=E:\Program Files\Cyberlink\Shared Files\brs.exe [2008-10-07 75048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-02 393216]
"MSConfig"=E:\Users\TOM\oqx.exe [2010-11-21 18432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=E:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-03-25 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - E:\Windows\System32\Notepad.exe %1
.js - open - E:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-22 14:25:36 ----D---- E:\Program Files\trend micro
2010-11-22 14:25:34 ----D---- E:\rsit
2010-11-22 14:23:07 ----A---- E:\Windows\system32\drivers\wikuerjl.sys
2010-11-22 14:10:43 ----A---- E:\Windows\system32\drivers\kmsjormp.sys
2010-11-22 13:39:04 ----A---- E:\Windows\system32\drivers\umocxblw.sys
2010-11-22 13:30:10 ----D---- E:\Windows\Minidump
2010-11-22 13:28:27 ----A---- E:\Windows\system32\drivers\apzgdcde.sys
2010-11-21 23:20:49 ----RSH---- E:\Users\TOM\AppData\Roaming\juzjf.exe
2010-11-07 22:51:25 ----D---- E:\ProgramData\Alwil Software
2010-11-07 22:51:25 ----D---- E:\Program Files\Alwil Software
2010-11-06 23:17:47 ----D---- E:\Program Files\ICQ6Toolbar
2010-11-06 23:17:40 ----D---- E:\Users\TOM\AppData\Roaming\Mozilla
2010-11-06 23:17:40 ----D---- E:\ProgramData\ICQ
2010-11-06 23:17:22 ----D---- E:\Users\TOM\AppData\Roaming\ICQ
2010-11-06 22:43:00 ----A---- E:\Windows\system32\D3DCompiler_42.dll
2010-11-06 00:19:01 ----D---- E:\Users\TOM\AppData\Roaming\CyberLink
2010-11-06 00:18:24 ----D---- E:\ProgramData\CyberLink
2010-11-06 00:18:20 ----D---- E:\Program Files\Cyberlink
2010-11-06 00:17:56 ----D---- E:\Program Files\Common Files\CyberLink
2010-11-06 00:09:18 ----A---- E:\Windows\system32\msxml3a.dll
2010-11-06 00:09:18 ----A---- E:\Windows\system32\msvcr71.dll
2010-11-06 00:09:18 ----A---- E:\Windows\system32\msvcp71.dll
2010-11-05 22:33:39 ----A---- E:\Windows\system32\XceedZip.dll
2010-11-05 22:07:16 ----D---- E:\ProgramData\Temp
2010-10-31 23:01:02 ----D---- E:\Users\TOM\AppData\Roaming\Leadertech
2010-10-31 22:40:13 ----A---- E:\Windows\system32\D3DX9_37.dll
2010-10-31 22:40:07 ----A---- E:\Windows\system32\d3dx9_35.dll
2010-10-31 22:40:06 ----A---- E:\Windows\system32\xinput1_3.dll
2010-10-31 22:40:06 ----A---- E:\Windows\system32\d3dx9_34.dll
2010-10-31 22:40:06 ----A---- E:\Windows\system32\d3dx9_33.dll
2010-10-31 22:40:05 ----A---- E:\Windows\system32\d3dx9_32.dll
2010-10-31 22:39:48 ----A---- E:\Windows\system32\d3dx9_30.dll
2010-10-31 22:39:47 ----A---- E:\Windows\system32\d3dx9_29.dll
2010-10-31 22:39:47 ----A---- E:\Windows\system32\d3dx9_28.dll
2010-10-31 22:39:47 ----A---- E:\Windows\system32\d3dx9_27.dll
2010-10-31 22:39:47 ----A---- E:\Windows\system32\d3dx9_26.dll
2010-10-31 22:39:47 ----A---- E:\Windows\system32\d3dx9_25.dll
2010-10-31 22:39:46 ----A---- E:\Windows\system32\d3dx9_24.dll
2010-10-31 21:44:02 ----D---- E:\Program Files\Avanquest update
2010-10-31 21:44:01 ----D---- E:\ProgramData\BVRP Software
2010-10-31 21:41:42 ----D---- E:\Program Files\Microsoft Synchronization Services
2010-10-31 21:41:39 ----D---- E:\Program Files\Common Files\DESIGNER
2010-10-31 21:40:23 ----A---- E:\Windows\system32\drivers\s0016whnt.sys
2010-10-31 21:40:23 ----A---- E:\Windows\system32\drivers\s0016wh.sys
2010-10-31 21:40:22 ----A---- E:\Windows\system32\drivers\s0016unic.sys
2010-10-31 21:40:22 ----A---- E:\Windows\system32\drivers\s0016obex.sys
2010-10-31 21:40:22 ----A---- E:\Windows\system32\drivers\s0016nd5.sys
2010-10-31 21:40:21 ----A---- E:\Windows\system32\drivers\s0016mgmt.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016mdm.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016mdfl.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016cr.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016cmnt.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016cm.sys
2010-10-31 21:40:20 ----A---- E:\Windows\system32\drivers\s0016bus.sys
2010-10-31 21:40:05 ----D---- E:\Windows\PCHEALTH
2010-10-31 21:40:05 ----D---- E:\Program Files\Microsoft.NET
2010-10-31 21:40:05 ----D---- E:\Program Files\Microsoft Sync Framework
2010-10-31 21:40:05 ----D---- E:\Program Files\Microsoft SQL Server Compact Edition
2010-10-31 21:39:41 ----D---- E:\ProgramData\Sony Ericsson
2010-10-31 21:39:08 ----D---- E:\Users\TOM\AppData\Roaming\InstallShield
2010-10-31 21:31:11 ----D---- E:\Program Files\Microsoft Visual Studio 8
2010-10-31 21:19:32 ----D---- E:\Users\TOM\AppData\Roaming\vlc
2010-10-31 21:19:04 ----D---- E:\Program Files\Microsoft Analysis Services
2010-10-31 21:16:09 ----D---- E:\Program Files\Microsoft Office
2010-10-31 21:16:06 ----D---- E:\ProgramData\Microsoft Help
2010-10-31 21:15:37 ----RHD---- E:\MSOCache
2010-10-31 21:06:07 ----D---- E:\Program Files\Conduit
2010-10-31 21:06:04 ----D---- E:\Program Files\BS_Player
2010-10-31 21:05:08 ----A---- E:\Windows\system32\drivers\sptd.sys
2010-10-31 21:04:36 ----D---- E:\Users\TOM\AppData\Roaming\DAEMON Tools
2010-10-31 20:55:44 ----D---- E:\Users\TOM\AppData\Roaming\WinRAR
2010-10-31 17:15:37 ----A---- E:\Windows\system32\D3DX9_42.dll
2010-10-31 17:15:37 ----A---- E:\Windows\system32\d3dx9_31.dll
2010-10-31 17:14:06 ----D---- E:\Program Files\Common Files\PX Storage Engine
2010-10-31 17:13:57 ----D---- E:\Users\TOM\AppData\Roaming\Winamp
2010-10-29 20:27:04 ----D---- E:\ProgramData\PC Drivers HeadQuarters
2010-10-29 20:16:31 ----D---- E:\ProgramData\WinZip
2010-10-29 19:31:22 ----HD---- E:\Program Files\InstallShield Installation Information
2010-10-29 19:31:05 ----D---- E:\Program Files\Fujitsu
2010-10-29 18:48:39 ----D---- E:\Windows\system32\Wat
2010-10-29 18:19:00 ----D---- E:\Program Files\CCleaner
2010-10-29 18:12:31 ----SHD---- E:\Windows\Installer
2010-10-29 18:04:10 ----D---- E:\Users\TOM\AppData\Roaming\Macromedia
2010-10-29 18:04:10 ----D---- E:\Users\TOM\AppData\Roaming\Adobe
2010-10-29 18:04:06 ----D---- E:\Windows\system32\Macromed

======List of files/folders modified in the last 1 months======

2010-11-22 14:25:36 ----RD---- E:\Program Files
2010-11-22 14:25:17 ----D---- E:\Windows
2010-11-22 14:23:17 ----AD---- E:\Windows\Temp
2010-11-22 14:23:07 ----D---- E:\Windows\system32\drivers
2010-11-21 23:23:50 ----D---- E:\Windows\System32
2010-11-21 19:48:46 ----A---- E:\Windows\system32\PerfStringBackup.INI
2010-11-21 19:48:45 ----D---- E:\Windows\inf
2010-11-19 22:33:39 ----D---- E:\Windows\system32\catroot2
2010-11-17 21:09:57 ----SD---- E:\Users\TOM\AppData\Roaming\Microsoft
2010-11-08 14:29:31 ----D---- E:\Windows\system32\Tasks
2010-11-07 23:07:54 ----SHD---- E:\System Volume Information
2010-11-07 23:02:35 ----D---- E:\Windows\system32\config
2010-11-07 22:52:14 ----D---- E:\Windows\winsxs
2010-11-07 22:51:25 ----HD---- E:\ProgramData
2010-11-07 11:40:40 ----D---- E:\Windows\Prefetch
2010-11-06 22:45:05 ----D---- E:\Windows\system32\DriverStore
2010-11-06 22:45:05 ----D---- E:\Windows\system32\catroot
2010-11-06 00:17:56 ----D---- E:\Program Files\Common Files
2010-11-06 00:10:26 ----D---- E:\Program Files\Common Files\microsoft shared
2010-11-05 22:42:20 ----RSD---- E:\Windows\assembly
2010-11-03 13:06:27 ----D---- E:\Windows\system32\wdi
2010-11-01 21:29:24 ----D---- E:\Windows\ModemLogs
2010-11-01 12:42:28 ----D---- E:\Windows\Logs
2010-11-01 12:26:27 ----D---- E:\Windows\Microsoft.NET
2010-10-31 21:45:00 ----RSD---- E:\Windows\Fonts
2010-10-31 21:44:31 ----D---- E:\Windows\ShellNew
2010-10-31 21:43:53 ----D---- E:\Program Files\MSBuild
2010-10-31 21:40:05 ----SD---- E:\ProgramData\Microsoft
2010-10-31 21:20:12 ----A---- E:\Windows\win.ini
2010-10-31 21:19:58 ----D---- E:\Program Files\Common Files\System
2010-10-29 18:48:59 ----A---- E:\Windows\system32\systemcpl.dll
2010-10-29 18:48:59 ----A---- E:\Windows\system32\slwga.dll
2010-10-29 18:48:57 ----A---- E:\Windows\system32\user32.dll
2010-10-29 18:47:36 ----D---- E:\Windows\SoftwareDistribution
2010-10-29 18:04:09 ----D---- E:\Windows\Downloaded Program Files
2010-10-29 18:03:16 ----D---- E:\Windows\Tasks
2010-10-29 17:44:12 ----D---- E:\Windows\system32\NDF
2010-10-29 09:20:42 ----D---- E:\Windows\debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; E:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; E:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 SCDEmu;SCDEmu; E:\Windows\system32\drivers\SCDEmu.sys [2010-04-12 59388]
R1 vwififlt;Virtual WiFi Filter Driver; E:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\PowerDVD8\000.fcl [2008-10-07 61424]
R3 athr;Atheros – ovladač pro zařízení pro rozšiřitelnou bezdrátovou síť LAN; E:\Windows\system32\DRIVERS\athr.sys [2009-07-13 1096704]
R3 BthEnum;Ovladač pro Bluetooth Request Block; E:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); E:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; E:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 igfx;igfx; E:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); E:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Ovladač Realtek 8167 NT; E:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; E:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S0 sptd;sptd; E:\Windows\System32\Drivers\sptd.sys [2010-10-31 717296]
S2 Parvdm;Parvdm; E:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; E:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; E:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 apzgdcde;apzgdcde; \??\E:\Windows\System32\Drivers\apzgdcde.sys [2010-11-22 40128]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; E:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; E:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 cpuz132;cpuz132; \??\E:\Users\TOM\AppData\Local\Temp\cpuz132\cpuz132_x32.sys []
S3 kmsjormp;kmsjormp; \??\E:\Windows\System32\Drivers\kmsjormp.sys [2010-11-22 40128]
S3 pciide;pciide; E:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; E:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); E:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; E:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; E:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); E:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); E:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; E:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); E:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s3cap;s3cap; E:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; E:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; E:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 umocxblw;umocxblw; \??\E:\Windows\System32\Drivers\umocxblw.sys [2010-11-22 40128]
S3 viaagp;VIA AGP Bus Filter; E:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; E:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; E:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; E:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 wikuerjl;wikuerjl; \??\E:\Windows\System32\Drivers\wikuerjl.sys [2010-11-22 40128]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 AppMgmt;@appmgmts.dll,-3250; E:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; E:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; E:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; E:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; E:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-29 1343400]

-----------------EOF-----------------

[Diallix]

Fuuha, pekne...

da sa vojst do nudzoveho rezimu?

[Evad...]

Jak myslis?...jde to zapnout i normalne ale nevim na jak dlouho..

[Evad...]

Jo taak...nouzak jde ale nepoznám jestli normalne nebo by se to treba casem taky vyplo ale nejspíš to jde v pohodě

[Diallix]

Stiahni si na c:\ tento nastroj:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

V nudzovom rezime (pod uctom administratora) vypni vsetky bezpecnostne programy.

Start >> spustit >> napis c:\combofix.exe /KillAll >> enter

Ak naskoci tabulka, odsuhlas ju ANO/OK.

Po scane 5-10 minut utilita vygeneruje log, ktory ulozi do c:\ComboFix.txt
Jeho obsah daj sem.

Po skene sa pc moze resetovat.

[Evad...]

ComboFix 10-11-23.01 - TOM 23.11.2010 21:17:07.2.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.1014.694 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: /KillAll
SP: Spyware Terminator *disabled* (Updated) {55EE49A8-16BE-4601-BBE6-607B7F7317DE}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\users\TOM\AppData\Roaming\juzjf.exe
e:\users\TOM\oqx.exe
e:\users\TOM\secupdat.dat
e:\windows\System32\Drivers\apzgdcde.sys
e:\windows\System32\Drivers\dvtosqvk.sys
e:\windows\System32\Drivers\kmsjormp.sys
e:\windows\System32\Drivers\opbdpglz.sys
e:\windows\system32\Drivers\tprvzfms.sys
e:\windows\system32\Drivers\umocxblw.sys
e:\windows\system32\Drivers\wikuerjl.sys
e:\windows\system32\secupdat.dat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_apzgdcde
-------\Service_dvtosqvk
-------\Service_kmsjormp
-------\Service_opbdpglz
-------\Service_tprvzfms
-------\Service_umocxblw
-------\Service_wikuerjl


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-23 do 2010-11-23 )))))))))))))))))))))))))))))))
.

2010-11-23 20:25 . 2010-11-23 20:28 -------- d-----w- e:\users\TOM\AppData\Local\temp
2010-11-23 20:25 . 2010-11-23 20:25 -------- d-----w- e:\users\Default\AppData\Local\temp
2010-11-22 19:53 . 2010-11-22 19:53 142592 ----a-w- e:\windows\system32\drivers\sp_rsdrv2.sys
2010-11-22 19:53 . 2010-11-22 19:58 -------- d-----w- e:\programdata\Spyware Terminator
2010-11-22 19:53 . 2010-11-22 19:54 -------- d-----w- e:\users\TOM\AppData\Roaming\Spyware Terminator
2010-11-22 19:53 . 2010-11-22 23:22 -------- d-----w- e:\program files\Spyware Terminator
2010-11-22 13:25 . 2010-11-22 13:25 -------- d-----w- e:\program files\trend micro
2010-11-22 13:25 . 2010-11-22 13:25 -------- d-----w- E:\rsit
2010-11-07 21:51 . 2010-11-07 22:08 -------- d-----w- e:\programdata\Alwil Software
2010-11-07 21:51 . 2010-11-07 21:51 -------- d-----w- e:\program files\Alwil Software
2010-11-07 14:06 . 2010-10-07 23:21 6146896 ----a-w- e:\programdata\Microsoft\Windows Defender\Definition Updates\{38A5E9A1-8034-4142-AA48-7445E93BC55D}\mpengine.dll
2010-11-06 22:17 . 2010-11-06 22:17 -------- d-----w- e:\program files\ICQ6Toolbar
2010-11-06 22:17 . 2010-11-06 22:17 -------- d-----w- e:\programdata\ICQ
2010-11-06 22:17 . 2010-11-07 19:12 -------- d-----w- e:\users\TOM\AppData\Roaming\ICQ
2010-11-06 22:17 . 2010-11-06 22:17 -------- d-----w- e:\users\TOM\AppData\Local\AOL
2010-11-06 21:43 . 2009-09-04 16:29 1974616 ----a-w- e:\windows\system32\D3DCompiler_42.dll
2010-11-05 23:19 . 2010-11-05 23:19 -------- d-----w- e:\users\TOM\AppData\Roaming\CyberLink
2010-11-05 23:18 . 2010-11-05 23:19 -------- d-----w- e:\programdata\CyberLink
2010-11-05 23:18 . 2010-11-05 23:18 -------- d-----w- e:\program files\Cyberlink
2010-11-05 23:17 . 2010-11-05 23:17 -------- d-----w- e:\program files\Common Files\CyberLink
2010-11-05 23:09 . 2010-11-05 23:23 29480 ----a-w- e:\windows\system32\msxml3a.dll
2010-11-05 23:09 . 2010-11-05 23:23 353576 ----a-w- e:\windows\system32\msvcr71.dll
2010-11-05 23:09 . 2010-11-05 23:23 505128 ----a-w- e:\windows\system32\msvcp71.dll
2010-11-05 21:40 . 2010-11-05 21:40 -------- d-----w- e:\users\TOM\AppData\Local\Downloaded Installations
2010-11-05 21:33 . 2004-06-14 13:56 427864 ----a-w- e:\windows\system32\XceedZip.dll
2010-11-05 21:33 . 2004-03-09 15:45 662288 ----a-w- e:\windows\system32\MSCOMCT2.OCX
2010-11-03 10:17 . 2010-11-03 10:17 -------- d-----w- e:\users\TOM\AppData\Local\ElevatedDiagnostics
2010-11-02 12:57 . 2010-11-02 12:57 48648 ----a-w- e:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-11-02 12:56 . 2010-11-02 12:56 484160 ----a-w- e:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-11-01 14:07 . 2010-11-01 14:07 -------- d-----w- e:\users\TOM\AppData\Local\Sony Ericsson
2010-10-31 22:01 . 2010-10-31 22:01 -------- d-----w- e:\users\TOM\AppData\Roaming\Leadertech
2010-10-31 21:40 . 2008-03-05 14:56 3786760 ----a-w- e:\windows\system32\D3DX9_37.dll
2010-10-31 21:40 . 2007-07-19 17:14 3727720 ----a-w- e:\windows\system32\d3dx9_35.dll
2010-10-31 21:40 . 2007-05-16 15:45 3497832 ----a-w- e:\windows\system32\d3dx9_34.dll
2010-10-31 21:40 . 2007-04-04 17:53 81768 ----a-w- e:\windows\system32\xinput1_3.dll
2010-10-31 21:40 . 2007-03-12 15:42 3495784 ----a-w- e:\windows\system32\d3dx9_33.dll
2010-10-31 21:40 . 2006-11-29 12:06 3426072 ----a-w- e:\windows\system32\d3dx9_32.dll
2010-10-31 21:39 . 2005-05-26 14:34 2297552 ----a-w- e:\windows\system32\d3dx9_26.dll
2010-10-31 20:44 . 2010-11-06 11:15 -------- d-----w- e:\program files\Avanquest update
2010-10-31 20:44 . 2010-10-31 20:44 -------- d-----w- e:\programdata\BVRP Software
2010-10-31 20:41 . 2010-10-31 20:41 -------- d-----w- e:\program files\Microsoft Synchronization Services
2010-10-31 20:39 . 2010-10-31 20:39 -------- d-----w- e:\programdata\Sony Ericsson
2010-10-31 20:39 . 2010-10-31 20:39 -------- d-----w- e:\users\TOM\AppData\Roaming\InstallShield
2010-10-31 20:31 . 2010-10-31 20:31 -------- d-----w- e:\program files\Microsoft Visual Studio 8
2010-10-31 20:19 . 2010-11-05 12:07 -------- d-----w- e:\users\TOM\AppData\Roaming\vlc
2010-10-31 20:19 . 2010-10-31 20:19 -------- d-----w- e:\program files\Microsoft Analysis Services
2010-10-31 20:17 . 2010-10-31 20:17 -------- d-----w- e:\users\TOM\AppData\Local\Microsoft Help
2010-10-31 20:16 . 2010-11-22 23:16 -------- d-----w- e:\programdata\Microsoft Help
2010-10-31 20:15 . 2010-10-31 20:15 -------- d-----r- E:\MSOCache
2010-10-31 20:06 . 2010-10-31 20:06 -------- d-----w- e:\program files\Conduit
2010-10-31 20:06 . 2010-10-31 20:06 -------- d-----w- e:\program files\BS_Player
2010-10-31 20:05 . 2010-10-31 20:13 717296 ----a-w- e:\windows\system32\drivers\sptd.sys
2010-10-31 20:04 . 2010-10-31 20:04 -------- d-----w- e:\users\TOM\AppData\Roaming\DAEMON Tools
2010-10-31 16:15 . 2009-09-04 16:29 1892184 ----a-w- e:\windows\system32\D3DX9_42.dll
2010-10-31 16:15 . 2006-09-28 15:05 2414360 ----a-w- e:\windows\system32\d3dx9_31.dll
2010-10-31 16:14 . 2010-10-31 16:14 -------- d-----w- e:\program files\Common Files\PX Storage Engine
2010-10-31 16:13 . 2010-10-31 16:33 -------- d-----w- e:\users\TOM\AppData\Roaming\Winamp
2010-10-29 19:27 . 2010-10-29 19:27 -------- d-----w- e:\programdata\PC Drivers HeadQuarters
2010-10-29 19:16 . 2010-10-31 19:53 -------- d-----w- e:\users\TOM\AppData\Local\WinZip
2010-10-29 19:16 . 2010-10-29 19:18 -------- d-----w- e:\programdata\WinZip
2010-10-29 18:31 . 2010-11-06 22:17 -------- d--h--w- e:\program files\InstallShield Installation Information
2010-10-29 18:31 . 2010-10-29 18:31 -------- d-----w- e:\program files\Fujitsu
2010-10-29 17:58 . 2010-10-29 17:58 48648 ----a-w- e:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-29 17:58 . 2010-10-29 17:58 484160 ----a-w- e:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-29 17:48 . 2010-10-29 17:48 -------- d-----w- e:\windows\system32\Wat
2010-10-29 17:19 . 2010-10-29 17:19 -------- d-----w- e:\program files\CCleaner
2010-10-29 17:12 . 2010-11-22 23:17 -------- d-sh--w- e:\windows\Installer
2010-10-29 17:04 . 2010-10-29 17:04 -------- d-----w- e:\windows\system32\Macromed
2010-10-29 17:03 . 2010-10-29 17:05 -------- d-----w- e:\users\TOM\AppData\Local\Google
2010-10-29 17:03 . 2010-10-29 17:03 -------- d-----w- e:\users\TOM\AppData\Local\Deployment
2010-10-29 17:03 . 2010-10-29 17:03 -------- d-----w- e:\users\TOM\AppData\Local\Apps

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-29 17:48 . 2009-07-13 23:40 409088 ----a-w- e:\windows\system32\systemcpl.dll
2010-10-29 17:48 . 2009-07-13 23:36 13824 ----a-w- e:\windows\system32\slwga.dll
2010-10-29 17:48 . 2009-07-13 23:24 811520 ----a-w- e:\windows\system32\user32.dll
2010-10-19 10:41 . 2010-10-10 09:43 222080 ------w- e:\windows\system32\MpSigStub.exe
.

------- Sigcheck -------

[-] 2010-10-29 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . e:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . e:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]
"SpywareTerminatorUpdate"="e:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-11-22 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="e:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="e:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="e:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IndicatorUtility"="e:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-06-22 47464]
"BCSSync"="e:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="e:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-07 75048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

R0 sptd;sptd;e:\windows\System32\Drivers\sptd.sys [2010-10-31 717296]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;e:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);e:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;e:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;e:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);e:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);e:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;e:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);e:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
R3 WatAdminSvc;Služba Technologie aktivace Windows;e:\windows\system32\Wat\WatAdminSvc.exe [2010-10-29 1343400]
S1 sp_rsdrv2;Spyware Terminator Driver 2;e:\windows\system32\drivers\sp_rsdrv2.sys [2010-11-22 142592]
S1 vwififlt;Virtual WiFi Filter Driver;e:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\PowerDVD8\000.fcl [2008-10-07 61424]
S3 RTL8167;Ovladač Realtek 8167 NT;e:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;e:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.
Obsah adresáře 'Naplánované úlohy'

2010-11-21 e:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1462245984-1767449129-2218748024-1000Core.job
- e:\users\TOM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-29 17:03]

2010-11-22 e:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1462245984-1767449129-2218748024-1000UA.job
- e:\users\TOM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-29 17:03]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: {F5CD7C0D-535A-42CF-950A-4F5236638827} = 160.218.43.200 160.218.10.200
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - e:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath -

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)
WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\PowerDVD8\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@e:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="e:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\windows\system32\AUDIODG.EXE
e:\program files\Spyware Terminator\sp_rsser.exe
e:\windows\system32\taskhost.exe
e:\windows\system32\WUDFHost.exe
e:\windows\system32\conhost.exe
e:\windows\System32\rundll32.exe
e:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2010-11-23 21:34:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-23 20:34

Před spuštěním: Volných bajtů: 21 668 876 288
Po spuštění: Volných bajtů: 21 490 638 848

- - End Of File - - 4E69991A6F678D2E5598F8F8AB14E2CB

[Diallix]

Dobre.

Toto otestuj na virustotal.com
e:\windows\System32\user32.dll
e:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

Po jednom upni a vysledky sem (url). Ak ti naskoci tabulka, ze subory boli uz prve otestovane, zvol moznost noveho otestovania.

[Evad...]

http://www.virustotal.com/file-scan/rep ... 1290630998
http://www.virustotal.com/file-scan/rep ... 1290631345

[Diallix]

Mohol by si tie dva subory skopcit do nejakej zlozky, tu zarchivovat a uploadnut na leteckaposta.cz ?

URL suborov potom sem daj.

Ako je na tom mimo recou pc ?