Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

PROSIM o kontrolu logu, podezření na nějakou havěť

Nemáte v tuto chvíli žádný problém s pc a chcete se jen ujistit, že je vše v pořádku?
Vložte log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

PROSIM o kontrolu logu, podezření na nějakou havěť

#1 Příspěvek od iname »

Zdravím všechny :!:

prosím o kontrolu logu níže, jsem přesvědčený, že je něco v nepořádku, pomale bootování, internet, a některé zbraně typu AD-aware poslední dobou nepremávají jako dříve, např. odmítají aktualizace atd. Jsem tu poprvé tak doufam že udělám vše dle zvyků a pravidel... předem děkuji :!: :!: :!:

Logfile of random's system information tool 1.08 (written by random/random)
Run by BambOO-user at 2010-12-18 02:32:56
Microsoft Windows 7 Professional
System drive C: has 88 GB (74%) free of 119 GB
Total RAM: 3756 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:32:58, on 18.12.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Unreal Commander\Uncom.exe
C:\Program Files\trend micro\BambOO-user.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1570435027-1370448789-3476712235-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1570435027-1370448789-3476712235-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Partner Service - Google Inc. - C:\ProgramData\Partner\Partner.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe
O23 - Service: TurboBoost - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10476 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Windows\system32\FBAgent.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files (x86)\Bonjour\mDNSResponder.exe"
"C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
"C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-b44111c2-25db-4b24-b2b8-0bf4c61aff4e -SystemEventPortName:HostProcess-8ec4d31b-3ee8-49ce-8354-6cfab0722e65 -IoCancelEventPortName:HostProcess-c8cc3e47-fc22-4a39-82e7-1412ccd5ac9f -NonStateChangingEventPortName:HostProcess-a3e8f690-c4ad-4289-aeeb-ecc49feddcc5 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:75395ed2-10eb-4177-8c35-61649570558c
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\AsScrPro.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe"
C:\Windows\system32\wbem\wmiprvse.exe
ATKOSD.exe
WDC.exe
"C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"
"C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=4408.8234280.422397287 "C:\Windows\system32\Macromed\Flash\NPSWF32.dll" 4408 plugin \\.\pipe\gecko-crash-server-pipe.4408
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe -Embedding
"taskhost.exe"
"C:\Program Files (x86)\Unreal Commander\Uncom.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Temp\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
Partner BHO Class - C:\ProgramData\Partner\Partner64.dll [2010-08-18 750064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-12-16 399536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll [2010-11-29 317496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-23 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2008-12-04 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
Partner BHO Class - C:\ProgramData\Partner\Partner.dll [2010-08-18 433648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-12-16 297648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll [2010-11-29 843832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-12-01 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-12-16 399536]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-12-16 297648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2010-03-27 17412200]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-12-10 1890088]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-04-07 2839840]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-08-25 161304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 386584]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-08-25 415256]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"SpywareTerminatorUpdate"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-12-11 3318784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AmIcoSinglun64]
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2010-01-18 324608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
C:\Windows\AsScrPro.exe [2010-08-18 3058304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [2009-11-02 103720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files (x86)\ICQ7.2\ICQ.exe [2010-12-02 133432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files (x86)\iTunes\iTunesHelper.exe [2010-04-24 142120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files (x86)\QuickTime\QTTask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-03-19 10134560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Setwallpaper]
c:\programdata\SetWallpaper.cmd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FancyStart daemon.lnk]
C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2010-08-18 12862]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SRS Premium Sound.lnk]
C:\Windows\INSTAL~1\{E5CF6~1\NEWSHO~4.EXE [2010-08-18 156952]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"=C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2010-01-22 106496]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-02-04 7350912]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [2010-05-03 170624]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
"Wireless Console 3"=C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2010-04-26 1597440]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"TrojanScanner"=C:\Program Files (x86)\Trojan Remover\Trjscan.exe [2010-08-02 1167808]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2010-04-24 142120]

C:\Users\BambOO-user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.2.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-08-25 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-18 02:15:02 ----D---- C:\rsit
2010-12-18 02:15:02 ----D---- C:\Program Files\trend micro
2010-12-16 23:47:01 ----A---- C:\Windows\system32\drivers\vpcvmm.sys
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\zh-TW
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\zh-CN
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\tr-TR
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\th-TH
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\sv-SE
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\ru-RU
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\ro-RO
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\pt-PT
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\pt-BR
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\pl-PL
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\nl-NL
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\nb-NO
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\ko-KR
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\ja-JP
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\it-IT
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\hu-HU
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\he-IL
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\fr-FR
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\fi-FI
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\es-ES
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\el-GR
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\de-DE
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\da-DK
2010-12-16 22:46:45 ----D---- C:\Windows\system32\drivers\ar-SA
2010-12-16 22:46:45 ----D---- C:\Program Files (x86)\Windows Virtual PC
2010-12-16 22:43:04 ----A---- C:\Windows\system32\vpchbuspipe.dll
2010-12-16 22:43:02 ----A---- C:\Windows\SYSWOW64\vmsal.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\VPCWizard.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\VPCSettings.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\vpc.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\VMWindow.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\vmsal.exe
2010-12-16 22:43:02 ----A---- C:\Windows\system32\VMCPropertyHandler.dll
2010-12-16 22:43:02 ----A---- C:\Windows\system32\drivers\vpchbus.sys
2010-12-16 22:43:02 ----A---- C:\Windows\system32\drivers\vpcusb.sys
2010-12-16 22:43:02 ----A---- C:\Windows\system32\drivers\vpcnfltr.sys
2010-12-16 15:51:35 ----D---- C:\ProgramData\ASUS
2010-12-16 15:26:49 ----D---- C:\Users\BambOO-user\AppData\Roaming\STORMWARE
2010-12-16 15:09:23 ----D---- C:\Users\BambOO-user\AppData\Roaming\OpenOffice.org
2010-12-15 10:28:02 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-12-15 10:28:02 ----A---- C:\Windows\system32\tzres.dll
2010-12-15 10:28:00 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-15 10:28:00 ----A---- C:\Windows\system32\taskschd.dll
2010-12-15 10:28:00 ----A---- C:\Windows\system32\taskeng.exe
2010-12-15 10:28:00 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-15 10:27:59 ----A---- C:\Windows\SYSWOW64\taskschd.dll
2010-12-15 10:27:59 ----A---- C:\Windows\SYSWOW64\taskeng.exe
2010-12-15 10:27:59 ----A---- C:\Windows\SYSWOW64\taskcomp.dll
2010-12-15 10:27:59 ----A---- C:\Windows\SYSWOW64\schtasks.exe
2010-12-15 10:27:59 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-15 10:27:59 ----A---- C:\Windows\system32\schtasks.exe
2010-12-15 10:27:51 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2010-12-15 10:27:51 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2010-12-15 10:27:51 ----A---- C:\Windows\system32\atmlib.dll
2010-12-15 10:27:51 ----A---- C:\Windows\system32\atmfd.dll
2010-12-15 10:27:49 ----A---- C:\Windows\system32\win32k.sys
2010-12-15 10:27:47 ----A---- C:\Windows\SYSWOW64\webio.dll
2010-12-15 10:27:47 ----A---- C:\Windows\system32\webio.dll
2010-12-15 10:27:46 ----A---- C:\Windows\system32\consent.exe
2010-12-15 10:27:45 ----A---- C:\Windows\system32\mshtml.dll
2010-12-15 10:27:45 ----A---- C:\Windows\system32\iertutil.dll
2010-12-15 10:27:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2010-12-15 10:27:44 ----A---- C:\Windows\system32\mstime.dll
2010-12-15 10:27:44 ----A---- C:\Windows\system32\ieframe.dll
2010-12-15 10:27:43 ----A---- C:\Windows\SYSWOW64\mstime.dll
2010-12-15 10:27:42 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2010-12-15 10:27:41 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2010-12-15 10:27:40 ----A---- C:\Windows\system32\wininet.dll
2010-12-15 10:27:39 ----A---- C:\Windows\SYSWOW64\wininet.dll
2010-12-15 10:27:39 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2010-12-15 10:27:39 ----A---- C:\Windows\system32\urlmon.dll
2010-12-15 10:27:39 ----A---- C:\Windows\system32\msfeeds.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\ieui.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2010-12-15 10:27:38 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\mshtmled.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\msfeedssync.exe
2010-12-15 10:27:38 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\licmgr10.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\jsproxy.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\ieui.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\iepeers.dll
2010-12-15 10:27:38 ----A---- C:\Windows\system32\iedkcs32.dll
2010-12-11 20:18:53 ----D---- C:\Users\BambOO-user\AppData\Roaming\Spyware Terminator
2010-12-11 20:18:52 ----D---- C:\ProgramData\Spyware Terminator
2010-12-11 20:18:52 ----D---- C:\Program Files (x86)\Spyware Terminator
2010-12-11 15:04:33 ----A---- C:\Windows\SYSWOW64\ztvunace26.dll
2010-12-11 15:04:32 ----A---- C:\Windows\SYSWOW64\ztvunrar36.dll
2010-12-11 15:04:32 ----A---- C:\Windows\SYSWOW64\ztvcabinet.dll
2010-12-11 15:04:32 ----A---- C:\Windows\SYSWOW64\UNRAR3.dll
2010-12-11 15:04:32 ----A---- C:\Windows\SYSWOW64\unacev2.dll
2010-12-11 15:04:26 ----D---- C:\Users\BambOO-user\AppData\Roaming\Simply Super Software
2010-12-11 15:04:26 ----D---- C:\ProgramData\Simply Super Software
2010-12-11 15:04:26 ----D---- C:\Program Files (x86)\Trojan Remover
2010-12-11 15:03:57 ----D---- C:\Users\BambOO-user\AppData\Roaming\Unreal Commander
2010-12-05 21:06:25 ----A---- C:\Windows\SYSWOW64\unrar.dll
2010-12-05 21:06:24 ----A---- C:\Windows\avisplitter.ini
2010-12-05 21:06:23 ----A---- C:\Windows\SYSWOW64\yv12vfw.dll
2010-12-05 21:06:23 ----A---- C:\Windows\SYSWOW64\xvidvfw.dll
2010-12-05 21:06:23 ----A---- C:\Windows\SYSWOW64\xvidcore.dll
2010-12-05 21:06:23 ----A---- C:\Windows\SYSWOW64\ff_vfw.dll.manifest
2010-12-05 21:06:23 ----A---- C:\Windows\SYSWOW64\ff_vfw.dll
2010-12-05 21:06:21 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2010-12-05 00:57:03 ----D---- C:\Users\BambOO-user\AppData\Roaming\DivX
2010-12-05 00:56:56 ----D---- C:\Program Files\DivX
2010-12-05 00:56:34 ----D---- C:\Program Files (x86)\DivX
2010-12-05 00:55:59 ----D---- C:\ProgramData\DivX
2010-12-05 00:29:18 ----D---- C:\Program Files (x86)\VideoLAN
2010-12-02 23:17:59 ----A---- C:\Windows\system32\drivers\SBREDrv.sys
2010-12-02 23:09:13 ----D---- C:\ProgramData\Lavasoft
2010-12-02 23:02:38 ----D---- C:\Program Files\CCleaner
2010-12-02 21:55:54 ----D---- C:\Program Files (x86)\7-Zip
2010-12-02 03:07:51 ----D---- C:\Windows\pss
2010-12-02 03:07:05 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-12-02 02:59:34 ----D---- C:\Users\BambOO-user\AppData\Roaming\ICQ
2010-12-02 02:59:26 ----D---- C:\Program Files (x86)\ICQ7.2
2010-12-01 19:55:25 ----D---- C:\ProgramData\Sun
2010-12-01 19:55:10 ----A---- C:\Windows\SYSWOW64\javaws.exe
2010-12-01 19:55:10 ----A---- C:\Windows\SYSWOW64\javaw.exe
2010-12-01 19:55:10 ----A---- C:\Windows\SYSWOW64\java.exe
2010-12-01 19:55:10 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2010-12-01 19:54:58 ----D---- C:\Program Files (x86)\Java
2010-12-01 19:30:22 ----D---- C:\Users\BambOO-user\AppData\Roaming\Apple Computer
2010-12-01 19:30:10 ----A---- C:\Windows\SYSWOW64\GEARAspi.dll
2010-12-01 19:30:10 ----A---- C:\Windows\system32\GEARAspi64.dll
2010-12-01 19:30:10 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2010-12-01 19:29:45 ----D---- C:\Program Files\iPod
2010-12-01 19:29:44 ----D---- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2010-12-01 19:29:44 ----D---- C:\Program Files\iTunes
2010-12-01 19:29:44 ----D---- C:\Program Files (x86)\iTunes
2010-12-01 19:29:00 ----D---- C:\Program Files (x86)\QuickTime
2010-12-01 19:28:59 ----D---- C:\ProgramData\Apple Computer
2010-12-01 19:28:47 ----D---- C:\Program Files (x86)\Apple Software Update
2010-12-01 19:28:01 ----D---- C:\Program Files\Common Files\Apple
2010-12-01 19:27:52 ----D---- C:\Program Files\Bonjour
2010-12-01 19:27:52 ----D---- C:\Program Files (x86)\Bonjour
2010-12-01 19:27:06 ----D---- C:\ProgramData\Apple
2010-11-29 20:45:50 ----A---- C:\Pass.txt
2010-11-29 19:50:59 ----D---- C:\Windows\CSC
2010-11-29 19:48:05 ----SHD---- C:\System Volume Information
2010-11-29 19:48:05 ----ASH---- C:\pagefile.sys
2010-11-29 19:47:58 ----ASH---- C:\hiberfil.sys
2010-11-29 19:43:57 ----D---- C:\Program Files (x86)\Secunia
2010-11-29 15:21:09 ----A---- C:\Windows\SYSWOW64\bzpdf101c.dll
2010-11-29 15:21:06 ----A---- C:\Windows\system32\bzpdf101.dll
2010-11-29 15:21:02 ----D---- C:\Program Files\STORMWARE
2010-11-29 15:20:52 ----D---- C:\Program Files (x86)\STORMWARE
2010-11-29 15:15:22 ----D---- C:\Users\BambOO-user\AppData\Roaming\Macromedia
2010-11-29 15:00:54 ----A---- C:\Windows\system32\mfreadwrite.dll
2010-11-29 15:00:54 ----A---- C:\Windows\system32\mfps.dll
2010-11-29 15:00:53 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2010-11-29 15:00:53 ----A---- C:\Windows\SYSWOW64\mfreadwrite.dll
2010-11-29 15:00:53 ----A---- C:\Windows\system32\WMVDECOD.DLL
2010-11-29 15:00:52 ----A---- C:\Windows\SYSWOW64\mf.dll
2010-11-29 15:00:52 ----A---- C:\Windows\system32\mf.dll
2010-11-29 14:43:51 ----D---- C:\Windows\SYSWOW64\Wat
2010-11-29 14:43:51 ----D---- C:\Windows\system32\Wat
2010-11-29 14:41:14 ----D---- C:\Program Files (x86)\Unreal Commander
2010-11-29 14:27:55 ----D---- C:\Users\BambOO-user\AppData\Roaming\Mozilla
2010-11-29 14:27:42 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-11-29 14:18:35 ----D---- C:\Program Files (x86)\OpenOffice.org 3
2010-11-29 14:14:56 ----A---- C:\Windows\SYSWOW64\PresentationHostProxy.dll
2010-11-29 14:14:56 ----A---- C:\Windows\SYSWOW64\PresentationHost.exe
2010-11-29 14:14:56 ----A---- C:\Windows\SYSWOW64\netfxperf.dll
2010-11-29 14:14:56 ----A---- C:\Windows\SYSWOW64\mscoree.dll
2010-11-29 14:14:56 ----A---- C:\Windows\SYSWOW64\dfshim.dll
2010-11-29 14:14:56 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-11-29 14:14:56 ----A---- C:\Windows\system32\PresentationHost.exe
2010-11-29 14:14:56 ----A---- C:\Windows\system32\netfxperf.dll
2010-11-29 14:14:56 ----A---- C:\Windows\system32\mscoree.dll
2010-11-29 14:14:56 ----A---- C:\Windows\system32\dfshim.dll
2010-11-29 14:14:21 ----A---- C:\Windows\system32\browserchoice.exe
2010-11-29 14:07:18 ----A---- C:\Windows\system32\MRT.exe
2010-11-29 14:05:17 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-11-29 14:05:17 ----A---- C:\Windows\system32\drivers\ks.sys
2010-11-29 14:04:21 ----A---- C:\Windows\SYSWOW64\t2embed.dll
2010-11-29 14:04:21 ----A---- C:\Windows\system32\t2embed.dll
2010-11-29 14:04:20 ----A---- C:\Windows\system32\ntdll.dll
2010-11-29 14:04:19 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2010-11-29 14:04:19 ----A---- C:\Windows\system32\msxml3.dll
2010-11-29 14:04:18 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2010-11-29 14:04:11 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2010-11-29 14:04:10 ----A---- C:\Windows\system32\CPFilters.dll
2010-11-29 14:04:08 ----A---- C:\Windows\system32\msdri.dll
2010-11-29 14:03:29 ----A---- C:\Windows\system32\shell32.dll
2010-11-29 14:03:21 ----A---- C:\Windows\SYSWOW64\shell32.dll
2010-11-29 14:03:01 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2010-11-29 14:03:01 ----A---- C:\Windows\system32\oleaut32.dll
2010-11-29 14:02:54 ----A---- C:\Windows\system32\wmp.dll
2010-11-29 14:02:45 ----A---- C:\Windows\SYSWOW64\wmp.dll
2010-11-29 14:02:43 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2010-11-29 14:02:42 ----A---- C:\Windows\system32\wmploc.DLL
2010-11-29 14:02:41 ----A---- C:\Windows\SYSWOW64\iccvid.dll
2010-11-29 14:02:40 ----A---- C:\Windows\system32\inetcomm.dll
2010-11-29 14:02:38 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2010-11-29 14:02:37 ----A---- C:\Windows\system32\cdd.dll
2010-11-29 14:02:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-11-29 14:02:32 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2010-11-29 14:02:31 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2010-11-29 14:02:28 ----A---- C:\Windows\SYSWOW64\schannel.dll
2010-11-29 14:02:28 ----A---- C:\Windows\system32\schannel.dll
2010-11-29 14:02:27 ----A---- C:\Windows\system32\comctl32.dll
2010-11-29 14:02:26 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2010-11-29 14:02:23 ----A---- C:\Windows\system32\ole32.dll
2010-11-29 14:02:20 ----A---- C:\Windows\SYSWOW64\ole32.dll
2010-11-29 14:02:19 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-11-29 14:02:19 ----A---- C:\Windows\system32\spoolsv.exe
2010-11-29 14:02:18 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2010-11-29 14:02:18 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-11-29 14:02:17 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-11-29 14:02:16 ----A---- C:\Windows\SYSWOW64\rtutils.dll
2010-11-29 14:02:16 ----A---- C:\Windows\system32\rtutils.dll
2010-11-29 14:02:15 ----A---- C:\Windows\SYSWOW64\mfc40u.dll
2010-11-29 14:02:15 ----A---- C:\Windows\SYSWOW64\mfc40.dll
2010-11-29 14:02:14 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-11-29 14:02:03 ----A---- C:\Windows\system32\wmpmde.dll
2010-11-29 14:02:02 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2010-11-29 14:02:02 ----A---- C:\Windows\system32\srvsvc.dll
2010-11-29 14:02:02 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-11-29 14:02:02 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-11-29 14:02:02 ----A---- C:\Windows\system32\drivers\srv.sys
2010-11-29 14:02:01 ----A---- C:\Windows\SYSWOW64\sscore.dll
2010-11-29 12:14:42 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2010-11-29 11:47:51 ----D---- C:\Users\BambOO-user\AppData\Roaming\ESET
2010-11-29 11:46:56 ----D---- C:\ProgramData\ESET
2010-11-29 11:46:56 ----D---- C:\Program Files\ESET
2010-11-29 11:26:39 ----D---- C:\Users\BambOO-user\AppData\Roaming\Adobe
2010-11-29 11:18:50 ----D---- C:\Windows\system32\appmgmt
2010-11-29 11:00:35 ----D---- C:\Users\BambOO-user\AppData\Roaming\Identities
2010-11-29 11:00:01 ----DC---- C:\Windows\system32\DRVSTORE
2010-11-29 10:59:22 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2010-11-29 10:58:36 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2010-11-29 10:58:36 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-11-29 10:58:26 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2010-11-29 10:57:23 ----D---- C:\Program Files (x86)\Microsoft
2010-11-29 10:57:01 ----D---- C:\Program Files (x86)\Windows Live
2010-11-29 10:54:25 ----HD---- C:\ASUS.DAT
2010-11-29 10:54:14 ----SD---- C:\Users\BambOO-user\AppData\Roaming\Microsoft
2010-11-29 10:54:14 ----D---- C:\Users\BambOO-user\AppData\Roaming\Media Center Programs

======List of files/folders modified in the last 1 months======

2010-12-18 02:32:57 ----D---- C:\Windows\Temp
2010-12-18 02:15:02 ----RD---- C:\Program Files
2010-12-18 02:14:25 ----D---- C:\Temp
2010-12-17 23:13:08 ----D---- C:\Windows\system32\config
2010-12-17 22:48:07 ----D---- C:\Windows\System32
2010-12-17 22:48:06 ----D---- C:\Windows\inf
2010-12-17 22:48:06 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-17 22:43:44 ----A---- C:\Windows\SYSWOW64\log.txt
2010-12-17 15:48:24 ----D---- C:\Windows\system32\drivers
2010-12-17 15:48:22 ----D---- C:\Windows\system32\drivers\UMDF
2010-12-17 15:46:04 ----SHD---- C:\Windows\Installer
2010-12-17 08:32:40 ----HD---- C:\ProgramData
2010-12-17 08:28:48 ----RD---- C:\Program Files (x86)
2010-12-17 08:25:10 ----D---- C:\Windows\system32\Tasks
2010-12-17 00:26:39 ----A---- C:\Windows\system32\AutoRunFilter.ini
2010-12-17 00:23:05 ----SD---- C:\ProgramData\Microsoft
2010-12-16 23:59:07 ----D---- C:\Windows\winsxs
2010-12-16 23:39:19 ----D---- C:\Windows\system32\catroot
2010-12-16 23:38:05 ----D---- C:\Windows\debug
2010-12-16 23:22:53 ----D---- C:\Windows\Prefetch
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\zh-TW
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\zh-CN
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\tr-TR
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\th-TH
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\sv-SE
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\ru-RU
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\ro-RO
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\pt-PT
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\pt-BR
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\pl-PL
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\nl-NL
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\nb-NO
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\ko-KR
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\ja-JP
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\it-IT
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\hu-HU
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\he-IL
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\fr-FR
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\fi-FI
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\es-ES
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\en-US
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\el-GR
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\de-DE
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\da-DK
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\cs-CZ
2010-12-16 22:46:49 ----D---- C:\Windows\SYSWOW64\ar-SA
2010-12-16 22:46:49 ----D---- C:\Windows\SysWOW64
2010-12-16 22:46:49 ----D---- C:\Windows\system32\tr-TR
2010-12-16 22:46:49 ----D---- C:\Windows\system32\pt-PT
2010-12-16 22:46:49 ----D---- C:\Windows\system32\ja-JP
2010-12-16 22:46:49 ----D---- C:\Windows\system32\it-IT
2010-12-16 22:46:49 ----D---- C:\Windows\system32\fr-FR
2010-12-16 22:46:49 ----D---- C:\Windows\system32\fi-FI
2010-12-16 22:46:49 ----D---- C:\Windows\system32\el-GR
2010-12-16 22:46:49 ----D---- C:\Windows\system32\de-DE
2010-12-16 22:46:48 ----D---- C:\Windows\system32\zh-TW
2010-12-16 22:46:48 ----D---- C:\Windows\system32\ro-RO
2010-12-16 22:46:48 ----D---- C:\Windows\system32\pt-BR
2010-12-16 22:46:48 ----D---- C:\Windows\system32\pl-PL
2010-12-16 22:46:48 ----D---- C:\Windows\system32\nl-NL
2010-12-16 22:46:48 ----D---- C:\Windows\system32\nb-NO
2010-12-16 22:46:48 ----D---- C:\Windows\system32\ko-KR
2010-12-16 22:46:48 ----D---- C:\Windows\system32\en-US
2010-12-16 22:46:48 ----D---- C:\Windows\system32\drivers\en-US
2010-12-16 22:46:48 ----D---- C:\Windows\system32\drivers\cs-CZ
2010-12-16 22:46:48 ----D---- C:\Windows\system32\da-DK
2010-12-16 22:46:48 ----D---- C:\Windows\system32\cs-CZ
2010-12-16 22:46:48 ----D---- C:\Windows\system32\ar-SA
2010-12-16 22:46:47 ----D---- C:\Windows\system32\zh-CN
2010-12-16 22:46:47 ----D---- C:\Windows\system32\th-TH
2010-12-16 22:46:47 ----D---- C:\Windows\system32\sv-SE
2010-12-16 22:46:47 ----D---- C:\Windows\system32\ru-RU
2010-12-16 22:46:47 ----D---- C:\Windows\system32\hu-HU
2010-12-16 22:46:47 ----D---- C:\Windows\system32\he-IL
2010-12-16 22:46:47 ----D---- C:\Windows\system32\es-ES
2010-12-16 22:46:45 ----D---- C:\Windows\system32\DriverStore
2010-12-16 22:46:38 ----D---- C:\Windows
2010-12-16 22:43:27 ----D---- C:\Windows\system32\catroot2
2010-12-16 22:09:01 ----D---- C:\Windows\SoftwareDistribution
2010-12-16 03:55:12 ----D---- C:\Windows\rescache
2010-12-16 03:16:35 ----D---- C:\Windows\SYSWOW64\migration
2010-12-16 03:16:35 ----D---- C:\Windows\system32\migration
2010-12-16 03:16:35 ----D---- C:\Program Files\Windows Mail
2010-12-16 03:16:35 ----D---- C:\Program Files\Internet Explorer
2010-12-16 03:16:35 ----D---- C:\Program Files (x86)\Windows Mail
2010-12-16 03:16:35 ----D---- C:\Program Files (x86)\Internet Explorer
2010-12-14 10:58:28 ----D---- C:\Windows\Tasks
2010-12-11 20:55:38 ----A---- C:\Windows\system32\ServiceFilter.ini
2010-12-11 19:58:38 ----D---- C:\Windows\system32\wdi
2010-12-11 15:06:05 ----AD---- C:\ProgramData\Temp
2010-12-10 16:47:18 ----D---- C:\Windows\system32\NDF
2010-12-05 20:49:18 ----D---- C:\Program Files (x86)\Common Files
2010-12-03 23:25:23 ----RSD---- C:\Windows\assembly
2010-12-03 23:25:23 ----D---- C:\Windows\Microsoft.NET
2010-12-03 00:07:11 ----D---- C:\Program Files (x86)\ASUS
2010-12-03 00:04:40 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-12-02 02:59:43 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-12-02 02:57:17 ----D---- C:\Windows\SYSWOW64\NV
2010-12-02 02:57:17 ----D---- C:\Windows\system32\NV
2010-12-02 02:55:22 ----D---- C:\Program Files\Windows Sidebar
2010-12-02 02:55:22 ----D---- C:\Program Files\Windows Photo Viewer
2010-12-02 02:55:22 ----D---- C:\Program Files\Windows Media Player
2010-12-02 02:55:22 ----D---- C:\Program Files\Windows Journal
2010-12-02 02:55:22 ----D---- C:\Program Files\Windows Defender
2010-12-02 02:55:22 ----D---- C:\Program Files\Common Files\System
2010-12-02 02:55:22 ----D---- C:\Program Files (x86)\Windows Sidebar
2010-12-02 02:55:21 ----D---- C:\Windows\SYSWOW64\winrm
2010-12-02 02:55:21 ----D---- C:\Windows\SYSWOW64\sr-Latn-CS
2010-12-02 02:55:21 ----D---- C:\Windows\SYSWOW64\slmgr
2010-12-02 02:55:21 ----D---- C:\Windows\SYSWOW64\migwiz
2010-12-02 02:55:21 ----D---- C:\Windows\SYSWOW64\en
2010-12-02 02:55:21 ----D---- C:\Windows\servicing
2010-12-02 02:55:21 ----D---- C:\Windows\ehome
2010-12-02 02:55:21 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2010-12-02 02:55:21 ----D---- C:\Program Files (x86)\Windows Media Player
2010-12-02 02:55:21 ----D---- C:\Program Files (x86)\Windows Defender
2010-12-02 02:55:16 ----D---- C:\Windows\SYSWOW64\drivers\en-US
2010-12-02 02:55:16 ----D---- C:\Windows\SYSWOW64\drivers
2010-12-02 02:55:13 ----D---- C:\Windows\SYSWOW64\WCN
2010-12-02 02:55:13 ----D---- C:\Windows\SYSWOW64\wbem
2010-12-02 02:55:13 ----D---- C:\Windows\SYSWOW64\Printing_Admin_Scripts
2010-12-02 02:55:13 ----D---- C:\Windows\SYSWOW64\DriverStore
2010-12-02 02:55:13 ----D---- C:\Windows\SYSWOW64\Dism
2010-12-02 02:55:13 ----D---- C:\Windows\en-US
2010-12-02 02:55:12 ----D---- C:\Windows\PolicyDefinitions
2010-12-02 02:55:11 ----D---- C:\Windows\system32\winrm
2010-12-02 02:55:11 ----D---- C:\Windows\system32\sysprep
2010-12-02 02:55:11 ----D---- C:\Windows\system32\sr-Latn-CS
2010-12-02 02:55:11 ----D---- C:\Windows\system32\slmgr
2010-12-02 02:55:11 ----D---- C:\Windows\system32\oobe
2010-12-02 02:55:11 ----D---- C:\Windows\system32\migwiz
2010-12-02 02:55:11 ----D---- C:\Windows\system32\en
2010-12-02 02:55:11 ----D---- C:\Windows\system32\Boot
2010-12-02 02:55:00 ----D---- C:\Windows\system32\WCN
2010-12-02 02:55:00 ----D---- C:\Windows\system32\Dism
2010-12-02 02:54:59 ----D---- C:\Windows\system32\wbem
2010-12-02 02:54:59 ----D---- C:\Windows\system32\Printing_Admin_Scripts
2010-12-01 20:10:10 ----D---- C:\ProgramData\Adobe
2010-12-01 19:28:01 ----D---- C:\Program Files\Common Files
2010-11-29 20:32:47 ----D---- C:\Windows\SYSWOW64\sl-SI
2010-11-29 20:32:45 ----D---- C:\Windows\system32\sl-SI
2010-11-29 20:31:37 ----D---- C:\Windows\SYSWOW64\sk-SK
2010-11-29 20:31:32 ----D---- C:\Windows\system32\sk-SK
2010-11-29 20:29:02 ----D---- C:\Windows\SYSWOW64\XPSViewer
2010-11-29 20:29:02 ----D---- C:\Windows\SYSWOW64\MUI
2010-11-29 20:28:57 ----D---- C:\Windows\SYSWOW64\com
2010-11-29 20:28:57 ----D---- C:\Windows\IME
2010-11-29 20:28:55 ----D---- C:\Windows\system32\MUI
2010-11-29 20:28:43 ----D---- C:\Windows\system32\com
2010-11-29 20:28:43 ----D---- C:\Windows\AppPatch
2010-11-29 20:25:44 ----D---- C:\Windows\SYSWOW64\lv-LV
2010-11-29 20:25:41 ----D---- C:\Windows\system32\lv-LV
2010-11-29 20:24:27 ----D---- C:\Windows\SYSWOW64\lt-LT
2010-11-29 20:24:24 ----D---- C:\Windows\system32\lt-LT
2010-11-29 20:23:08 ----D---- C:\Windows\SYSWOW64\hr-HR
2010-11-29 20:23:04 ----D---- C:\Windows\system32\hr-HR
2010-11-29 20:21:36 ----D---- C:\Windows\SYSWOW64\et-EE
2010-11-29 20:21:32 ----D---- C:\Windows\system32\et-EE
2010-11-29 20:20:07 ----D---- C:\Windows\SYSWOW64\bg-BG
2010-11-29 20:20:03 ----D---- C:\Windows\system32\bg-BG
2010-11-29 20:17:28 ----D---- C:\Program Files\DVD Maker
2010-11-29 19:46:58 ----D---- C:\Program Files (x86)\Adobe
2010-11-29 14:56:56 ----D---- C:\Program Files (x86)\Google
2010-11-29 14:36:16 ----D---- C:\Windows\Logs
2010-11-29 14:18:54 ----RSD---- C:\Windows\Fonts
2010-11-29 12:09:15 ----SHD---- C:\$RECYCLE.BIN
2010-11-29 12:09:09 ----RD---- C:\Users
2010-11-29 11:19:41 ----D---- C:\ProgramData\GoBoingo
2010-11-29 11:00:25 ----D---- C:\Windows\system32\drivers\etc
2010-11-29 10:53:42 ----A---- C:\Windows\system32\Defrag.ini
2010-11-29 10:52:20 ----SHD---- C:\Recovery

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-12-17 538136]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-08-18 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-07 139704]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys [2009-09-23 66304]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys [2009-12-01 359624]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-04-07 163888]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-04-07 169592]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 50600]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\Windows\system32\DRIVERS\stflt.sys [2010-07-07 50696]
R2 TurboB;Turbo Boost UI Monitor driver; C:\Windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
R3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2009-12-28 44032]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2009-10-05 1542656]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-04-07 33608]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-08-25 10611552]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-03-19 2301344]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 15416]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-04-21 76912]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2009-05-13 15928]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 77824]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 180224]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-08-20 1800192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-12-10 301104]
R3 vpcbus;Služba hostitelské sběrnice programu Virtual PC; C:\Windows\system32\DRIVERS\vpchbus.sys [2009-09-23 187904]
R3 vpcusb;Služba konektoru virtualizace rozhraní USB; C:\Windows\system32\DRIVERS\vpcusb.sys [2009-09-23 95232]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 551936]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 79360]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2009-07-01 98344]
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2009-07-01 132648]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2009-07-01 21160]
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]
S3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys []
S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-07-07 17464]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2010-04-16 50176]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2008-05-24 154168]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe [2009-12-08 379520]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-04-16 144672]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-16 84536]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]
R2 Bonjour Service;Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2010-04-08 345376]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-08-03 864032]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2010-04-07 810120]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-10-01 262144]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-03-27 393320]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-03-27 1800808]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe [2010-12-11 948775]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-04-24 660256]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-08-18 135664]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-04-07 42336]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-18 182768]
S3 Partner Service;Partner Service; C:\ProgramData\Partner\Partner.exe [2010-08-18 332272]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 TurboBoost;TurboBoost; C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-29 1255736]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#2 Příspěvek od Roli »

Zdravím, uělal jsi vše naprosto správně.

Nyní pro začátek použij Mbam z mého podpisu a dej mi sem z něj log dříve než něco smažeš,

pokud tedy něco najde.
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#3 Příspěvek od iname »

děkuji za rychlou radu :!: včera, po odeslání zadosti o radu s logem, jsem se tu ješte pomalinko "toulal" a našel jsem tu plno zajímacích informací... a dnes jsem vyškubnul ze svých not HDD a připojil ho přez USB k jinýmu compu. "uklízet" jsem zacal SuperAntiSpyware ten něco našel a odstranil, dal jsem ho projel nejakym odstranovacem Rootkitu (uz si nepamatuji jak se jmenuje), jeho název jsem si nechal vygenerovat náhodně, na strankach kde jsem to stahoval (taky nevim kde, protoze mam nastavene mazani historie atd. po vypnuti prohlizece :-) ) pisali, ze je velice u haveti populární jeho oficialni nazev, a radi na nej utoci hned jakmile zjisti, ze je soubor s jeho nazvem na disku... asi uz budes vedet co to je... a potom jsem to projel Mbam a ten povidal ze je vse CLEAN.

Noty startuji rychleji i rychlei se vypinaji i bez mi připadá svižnější, tak bych mozna rekl, že je vše OK.... co ty na to?

dá se to ještě něcím ověřit? přeci jenom, pokud nějaká vyspěleší havěť napadne nějaký čistič, AV atd. (při prvním spuštěni nebo hned po instalaci z paměti, dříve něž se to stane obraceně, tak ty nástroječky jsou potom slepý, že jsou rádi, že najdou konec sveho testu natož ty potvory... nebo :???: (proto jsem to scenoval na tom dalsim PC, aby nebyly šmejdi aktivni)

děkuji za info :!:
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#4 Příspěvek od Roli »

Zvláštní postup na který si asi běžný uživatel netroufne, ale proč ne.

Můžeš tam pustit i větší kalibr, jen doporučuji pozorně číst, protože tenhle softík netoleruje chyby.

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#5 Příspěvek od iname »

pri vypinání ESS se stala takova zvlastost, ze kdyz jsem povypinal ESS a samotne oko zcervenalo a brecelo ze je OFF. posleze jsem pustil Combo, tak to mi nahlasilo jestli chci vypnout ESS, dal jsem ANO a Combo povidalo ze bezi a ze to nechce... tento postup se stejnym vysledkem jsem provedl i pod uctem s pravy spravce a "spustit jako spravce" jako na predchozim uctu stejne a totez... restartoval jsem zase vypnul ESS a pustil jsem si spravce uloh kde jsem nasel jeste bezici asi jadro ESS ackoliv samy ESS hlasili ze jsou vyple.. kdyz jsem tam byl tak jsem vypnul zkoro vse tun. ruzny updatery od itunes po javu... a po tomto jsem pustil Combo a vse probehlo jak melo... nize vypis:

ComboFix 10-12-18.02 - BambOO-user 20.12.2010 0:20.1.4 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.3756.2576 [GMT 1:00]
Spuštěný z: c:\users\BambOO-Uzivatel\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Disabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.2 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\FullRemove.exe
c:\users\BambOO-user\Documents\cc_20101202_230339.reg
c:\users\BambOO-user\Documents\zal_reg_admin_cc_20101219_043551.reg

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-19 do 2010-12-19 )))))))))))))))))))))))))))))))
.

2010-12-19 23:23 . 2010-12-19 23:23 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2010-12-19 23:23 . 2010-12-19 23:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-19 03:50 . 2010-12-19 03:50 -------- d-----w- C:\found.000
2010-12-19 01:38 . 2010-04-29 14:39 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-19 01:38 . 2010-12-19 01:38 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-12-19 01:38 . 2010-12-19 01:38 -------- d-----w- c:\programdata\Malwarebytes
2010-12-19 01:38 . 2010-04-29 14:39 24664 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-18 05:06 . 2010-12-18 05:06 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-12-18 05:06 . 2010-12-18 05:06 -------- d-----w- c:\programdata\!SASCORE
2010-12-18 05:06 . 2010-12-18 05:06 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-12-18 01:15 . 2010-12-18 01:32 -------- d-----w- c:\program files\trend micro
2010-12-18 01:15 . 2010-12-18 01:15 -------- d-----w- C:\rsit
2010-12-18 01:14 . 2010-12-18 01:14 832273 ----a-w- c:\temp\RSITx64.exe
2010-12-16 22:47 . 2009-12-01 17:55 359624 ----a-w- c:\windows\system32\drivers\vpcvmm.sys
2010-12-16 21:43 . 2009-09-23 01:52 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\vpchbus.sys.mui
2010-12-16 14:51 . 2010-12-16 14:51 -------- d-----w- c:\programdata\ASUS
2010-12-15 09:28 . 2010-10-27 05:06 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 09:28 . 2010-10-27 04:32 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2010-12-15 09:28 . 2010-11-02 05:18 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 09:28 . 2010-11-02 05:17 1169408 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 09:28 . 2010-11-02 05:16 1114624 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 09:28 . 2010-11-02 05:10 464384 ----a-w- c:\windows\system32\taskeng.exe
2010-12-11 19:18 . 2010-12-19 22:57 -------- d-----w- c:\programdata\Spyware Terminator
2010-12-11 19:18 . 2010-12-11 19:53 -------- d-----w- c:\program files (x86)\Spyware Terminator
2010-12-11 14:04 . 2005-08-26 00:50 77312 ----a-w- c:\windows\SysWow64\ztvunace26.dll
2010-12-11 14:04 . 2006-06-19 12:01 69632 ----a-w- c:\windows\SysWow64\ztvcabinet.dll
2010-12-11 14:04 . 2006-05-25 14:52 162304 ----a-w- c:\windows\SysWow64\ztvunrar36.dll
2010-12-11 14:04 . 2003-02-02 19:06 153088 ----a-w- c:\windows\SysWow64\UNRAR3.dll
2010-12-11 14:04 . 2002-03-06 00:00 75264 ----a-w- c:\windows\SysWow64\unacev2.dll
2010-12-11 14:04 . 2010-12-11 14:04 -------- d-----w- c:\program files (x86)\Trojan Remover
2010-12-11 14:04 . 2010-12-11 14:04 -------- d-----w- c:\programdata\Simply Super Software
2010-12-10 12:43 . 2010-12-10 12:43 2790864 ----a-w- c:\temp\install_flash_player.exe
2010-12-05 20:06 . 2010-03-15 10:31 165376 ----a-w- c:\windows\SysWow64\unrar.dll
2010-12-05 20:06 . 2008-09-24 19:41 839680 ----a-w- c:\windows\SysWow64\lameACM.acm
2010-12-05 20:06 . 2010-11-24 08:00 108032 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2010-12-05 20:06 . 2010-11-03 19:08 237568 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2010-12-05 20:06 . 2010-06-08 17:10 790528 ----a-w- c:\windows\SysWow64\xvidcore.dll
2010-12-05 20:06 . 2010-06-08 17:10 134144 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2010-12-05 20:06 . 2010-01-17 16:18 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm
2010-12-05 20:06 . 2010-12-05 20:06 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2010-12-04 23:56 . 2010-12-05 19:49 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
2010-12-04 23:56 . 2010-12-05 19:49 -------- d-----w- c:\program files\DivX
2010-12-04 23:56 . 2010-12-05 19:49 -------- d-----w- c:\program files (x86)\DivX
2010-12-04 23:55 . 2010-12-05 19:49 -------- d-----w- c:\programdata\DivX
2010-12-04 23:29 . 2010-12-04 23:29 -------- d-----w- c:\program files (x86)\VideoLAN
2010-12-02 22:17 . 2010-12-02 22:17 49752 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-12-02 22:09 . 2010-12-17 07:28 -------- d-----w- c:\programdata\Lavasoft
2010-12-02 22:02 . 2010-12-02 22:02 -------- d-----w- c:\program files\CCleaner
2010-12-02 20:55 . 2010-12-02 20:55 -------- d-----w- c:\program files (x86)\7-Zip
2010-12-02 09:51 . 2009-07-14 01:41 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2010-12-02 01:59 . 2010-12-08 13:45 -------- d-----w- c:\program files (x86)\ICQ7.2
2010-12-01 18:55 . 2010-12-01 18:55 -------- d-----w- c:\program files (x86)\Common Files\Java
2010-12-01 18:55 . 2010-12-01 18:54 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2010-12-01 18:54 . 2010-12-01 18:54 -------- d-----w- c:\program files (x86)\Java
2010-12-01 18:30 . 2009-05-18 12:17 34152 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-12-01 18:30 . 2008-04-17 11:12 126312 ----a-w- c:\windows\system32\GEARAspi64.dll
2010-12-01 18:30 . 2008-04-17 11:12 107368 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2010-12-01 18:28 . 2010-12-01 18:28 -------- d-----w- c:\program files (x86)\Apple Software Update
2010-12-01 18:28 . 2010-12-01 18:28 -------- d-----w- c:\program files\Common Files\Apple
2010-12-01 18:27 . 2010-12-01 18:27 -------- d-----w- c:\program files\Bonjour
2010-12-01 18:27 . 2010-12-01 18:27 -------- d-----w- c:\program files (x86)\Bonjour
2010-12-01 18:27 . 2010-12-17 14:48 -------- d-----w- c:\programdata\Apple
2010-12-01 18:27 . 2010-12-01 18:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2010-11-29 18:45 . 2010-11-29 18:45 2827728 ----a-w- c:\temp\update\install_flash_player_ax.exe
2010-11-29 18:44 . 2010-11-29 18:45 12674968 ----a-w- c:\temp\update\AdobeAIRInstaller.exe
2010-11-29 18:43 . 2010-11-29 18:43 -------- d-----w- c:\program files (x86)\Secunia
2010-11-29 15:09 . 2010-11-29 15:10 8567280 ----a-w- c:\temp\update\Firefox Setup 3.6.12.exe
2010-11-29 14:21 . 2009-07-14 01:41 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\LXKPTPRC.DLL
2010-11-29 14:21 . 2008-06-09 14:16 147456 ----a-w- c:\windows\SysWow64\bzpdf101c.dll
2010-11-29 14:21 . 2008-06-09 14:16 196608 ----a-w- c:\windows\system32\bzpdf101.dll
2010-11-29 14:21 . 2010-12-16 11:46 -------- d-----w- c:\program files\STORMWARE
2010-11-29 14:21 . 1999-05-12 22:00 1064456 ----a-w- c:\windows\SysWow64\mscomctl.ocx
2010-11-29 14:21 . 1999-05-06 23:00 140288 ----a-w- c:\windows\SysWow64\comdlg32.OCX
2010-11-29 14:20 . 2010-11-29 14:20 -------- d-----w- c:\program files (x86)\Common Files\STORMWARE Shared
2010-11-29 14:20 . 2010-11-29 14:20 -------- d-----w- c:\program files (x86)\STORMWARE
2010-11-29 14:00 . 2010-05-23 08:35 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2010-11-29 14:00 . 2010-05-23 08:35 206848 ----a-w- c:\windows\system32\mfps.dll
2010-11-29 14:00 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2010-11-29 14:00 . 2010-05-23 10:11 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2010-11-29 14:00 . 2010-05-23 08:37 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2010-11-29 14:00 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2010-11-29 14:00 . 2010-05-23 08:35 4068864 ----a-w- c:\windows\system32\mf.dll
2010-11-29 13:43 . 2010-11-29 13:43 -------- d-----w- c:\windows\SysWow64\Wat
2010-11-29 13:43 . 2010-11-29 13:43 -------- d-----w- c:\windows\system32\Wat
2010-11-29 13:41 . 2010-11-29 13:41 -------- d-----w- c:\program files (x86)\Unreal Commander
2010-11-29 13:18 . 2010-11-29 13:18 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2010-11-29 13:14 . 2009-11-25 11:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2010-11-29 13:14 . 2009-11-25 11:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2010-11-29 13:14 . 2009-11-25 11:47 48960 ----a-w- c:\windows\system32\netfxperf.dll
2010-11-29 13:14 . 2009-11-25 11:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2010-11-29 13:14 . 2009-11-25 11:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2010-11-29 13:14 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2010-11-29 13:14 . 2009-11-25 11:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-11-29 13:14 . 2009-11-25 11:47 444752 ----a-w- c:\windows\system32\mscoree.dll
2010-11-29 13:14 . 2009-11-25 11:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe
2010-11-29 13:14 . 2009-11-25 11:47 1942856 ----a-w- c:\windows\system32\dfshim.dll
2010-11-29 13:14 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2010-11-29 13:05 . 2010-03-04 04:40 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-11-29 13:05 . 2010-03-04 04:32 243712 ----a-w- c:\windows\system32\drivers\ks.sys
2010-11-29 13:03 . 2010-04-07 07:37 861184 ----a-w- c:\windows\system32\oleaut32.dll
2010-11-29 13:03 . 2010-04-07 07:10 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2010-11-29 11:14 . 2010-12-04 23:57 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2010-11-29 11:09 . 2010-12-16 21:52 -------- d-----w- c:\users\BambOO-Uzivatel
2010-11-29 10:46 . 2010-11-29 10:46 -------- d-----w- c:\program files\ESET
2010-11-29 10:18 . 2010-12-02 23:07 -------- d-----w- c:\windows\system32\appmgmt
2010-11-29 10:00 . 2010-12-17 07:28 -------- dc----w- c:\windows\system32\DRVSTORE
2010-11-29 09:59 . 2010-11-29 09:59 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework
2010-11-29 09:58 . 2006-11-29 12:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-11-29 09:58 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
2010-11-29 09:58 . 2010-11-29 09:58 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2010-11-29 09:57 . 2010-11-29 09:57 -------- d-----w- c:\program files (x86)\Microsoft
2010-11-29 09:57 . 2010-12-02 23:04 -------- d-----w- c:\program files (x86)\Windows Live
2010-11-29 09:55 . 2010-11-29 09:55 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2010-11-29 09:54 . 2010-11-29 10:01 -------- d-----w- C:\ASUS.DAT
2010-11-29 09:54 . 2010-11-29 10:00 -------- d-----w- c:\users\BambOO-user

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-02 05:16 . 2010-12-15 09:28 1114624 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 05:10 . 2010-12-15 09:27 285696 ----a-w- c:\windows\system32\schtasks.exe
2010-11-02 04:34 . 2010-12-15 09:27 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2010-08-18 20:00 433648 ----a-w- c:\programdata\Partner\Partner.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"SpywareTerminatorUpdate"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-12-11 3318784]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-12-14 2988784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-01-22 106496]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-02-04 7350912]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-04-26 1597440]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TrojanScanner"="c:\program files (x86)\Trojan Remover\Trjscan.exe" [2010-08-02 1167808]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-04-24 142120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-18 135664]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [x]
R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2010-08-18 332272]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-07-07 17464]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-04-16 50176]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-29 1255736]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 139704]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-12-07 379520]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 163888]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2010-04-07 810120]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 50600]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-03-27 1800808]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys [2010-07-07 50696]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-12-28 44032]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-04-21 76912]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 77824]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 180224]

.
Obsah adresáře 'Naplánované úlohy'

2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-18 20:00]

2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-18 20:00]
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2010-08-18 20:00 750064 ----a-w- c:\programdata\Partner\Partner64.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-03-27 17412200]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2839840]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Doplňkový sken -------
.
uStart Page = hxxp://asus.msn.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: WikiKomentáře Google... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\users\BambOO-user\AppData\Roaming\Mozilla\Firefox\Profiles\t9t5qgof.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-12-20 00:24:43
ComboFix-quarantined-files.txt 2010-12-19 23:24

Před spuštěním: Volných bajtů: 92 711 370 752
Po spuštění: Volných bajtů: 92 600 791 040

- - End Of File - - DA3FAB0B8D0169B4540D2F7827E4A651


nejak jsem tam nic nenasel, ale to bude asi tim ze ne vsemu rozumim :lol: co vy na to :???:
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#6 Příspěvek od Roli »

Něco málo smazáno, zbytek v pořádku.

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


No a pokud už je s PC vše v pořádku máme hotovo.
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#7 Příspěvek od iname »

Vše jsem provedl a zatim to vypada ready... :thumbsups:

Urcite mnohokrate dekuji :!: :worship:

uvazuji, ze zapracuji na sebevzdelavani a projdu si u vas "samokurzem" a pridam se k vam... jedine co mi v tom malinko dela problem je volny cas :wacko:

jeste jednou diky !
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#8 Příspěvek od Roli »

Není zač a kdyby něco klidně písni.
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#9 Příspěvek od iname »

Určitě se ozvu, kdyby něco :worship: prozatim :closed:
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#10 Příspěvek od Roli »

Dobře, ještě tady nějaký ten pátek vydržím :wink:
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#11 Příspěvek od iname »

:welcome: dlouho jsem tu nebyl... malinko jsem studoval, tzn. jsi sem temer jisty, ze na netbooku pritelkine je urcite nejakej smejd. pls. juknete mi na to? služebníček :)


ComboFix 10-12-25.02 - Dasha 26.12.2010 4:28.1.2 - x86
Microsoft Windows 7 Starter 6.1.7600.0.1250.420.1029.18.2038.1343 [GMT 1:00]
Spuštěný z: c:\users\Dasha\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Disabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.2 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ICQ6.5\ICQLRun.exe
c:\programdata\FullRemove.exe
c:\programdata\hpeC1CA.dll
c:\users\Dasha\Documents\cc_20101206_011125.reg
c:\users\Dasha\videos\Sony_ Ericsson_ PC Suite_6.011.00_Web_CSY.exe
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-26 do 2010-12-26 )))))))))))))))))))))))))))))))
.

2010-12-26 03:47 . 2010-12-26 03:48 -------- d-----w- c:\users\Dasha\AppData\Local\temp
2010-12-26 03:47 . 2010-12-26 03:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-24 23:38 . 2010-12-25 02:43 -------- d-----w- C:\UsbFix
2010-12-24 15:28 . 2010-12-24 15:28 -------- d-----w- c:\program files\LSoft Technologies
2010-12-24 15:02 . 2010-12-24 15:02 119808 ----a-r- c:\users\Dasha\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2010-12-24 10:55 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B98C0A0-6793-4E4E-8C15-4BA280DA01D1}\mpengine.dll
2010-12-06 04:17 . 2010-09-23 07:46 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-12-06 01:00 . 2010-12-06 01:00 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-12-06 00:44 . 2010-12-06 00:44 -------- d-----w- c:\users\Dasha\AppData\Local\Sunbelt Software
2010-12-06 00:43 . 2010-12-06 00:43 -------- dc-h--w- c:\programdata\{E961CE1B-C3EA-4882-9F67-F859B555D097}
2010-12-06 00:42 . 2010-12-06 00:48 -------- d-----w- c:\programdata\Lavasoft
2010-12-06 00:42 . 2010-12-06 00:42 -------- d-----w- c:\program files\Lavasoft
2010-12-05 22:49 . 2010-12-05 22:49 -------- d-----w- c:\program files\CCleaner
2010-11-29 22:35 . 2010-11-29 22:35 -------- d-----w- c:\users\Dasha\AppData\Local\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2010-05-21 19:35 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-05 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-05 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-29 7744032]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Dasha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\Dasha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2010-01-18 07:42 3058304 ----a-w- c:\windows\AsScrPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSPRP]
2010-01-18 07:13 2018032 ----a-w- c:\program files\ASUS\APRP\aprp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eee Docking]
2009-11-17 21:47 414384 ----a-w- c:\program files\ASUS\Eee Docking\Eee Docking.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EeeSplendidAgent]
2009-12-29 23:28 104960 ----a-w- c:\program files\ASUS\EPC\EeeSplendid\AsAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyMon]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyService]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LivCam]
2009-11-19 22:05 284160 ----a-w- c:\program files\ASUS\LivCam\LivCam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveUpdate]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-11-20 08:17 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-05-20 06:16 222504 ----a-w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2008-08-03 23:02 36352 ----a-w- c:\program files\Winamp\winampa.exe

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-12-06 1375992]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2010-12-06 15264]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]
R4 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2009-07-06 11448]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 41312]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ?3,16,13,0
FF - ProfilePath - c:\users\Dasha\AppData\Roaming\Mozilla\Firefox\Profiles\mw8424u5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe
MSConfigStartUp-ASUS WebStorage - c:\program files\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-12-26 04:52:29
ComboFix-quarantined-files.txt 2010-12-26 03:52

Před spuštěním: Volných bajtů: 59 107 966 976
Po spuštění: Volných bajtů: 59 567 128 576

- - End Of File - - 0631ECE8E14E4AB4CAE44B13E1608EA9


dik moc :!:
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#12 Příspěvek od Roli »

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:

Obrázek

Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#13 Příspěvek od iname »

provedeno, zde je pozadovany log:¨

ComboFix 10-12-26.01 - Dasha 28.12.2010 3:25.2.2 - x86
Microsoft Windows 7 Starter 6.1.7600.0.1250.420.1029.18.2038.1349 [GMT 1:00]
Spuštěný z: c:\users\Dasha\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Dasha\Desktop\CFScript.txt.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
FW: ESET personal firewall *Disabled* {F3340042-195E-BB41-42D1-CDB495BB46DE}
SP: ESET Smart Security 4.2 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-11-28 do 2010-12-28 )))))))))))))))))))))))))))))))
.

2010-12-28 02:44 . 2010-12-28 02:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-26 03:52 . 2010-12-28 02:44 -------- d-----w- c:\users\Dasha\AppData\Local\temp
2010-12-24 23:38 . 2010-12-25 02:43 -------- d-----w- C:\UsbFix
2010-12-24 15:28 . 2010-12-24 15:28 -------- d-----w- c:\program files\LSoft Technologies
2010-12-24 15:02 . 2010-12-24 15:02 119808 ----a-r- c:\users\Dasha\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2010-12-24 10:55 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B98C0A0-6793-4E4E-8C15-4BA280DA01D1}\mpengine.dll
2010-12-06 04:17 . 2010-09-23 07:46 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-12-06 01:00 . 2010-12-06 01:00 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-12-06 00:44 . 2010-12-06 00:44 -------- d-----w- c:\users\Dasha\AppData\Local\Sunbelt Software
2010-12-06 00:43 . 2010-12-06 00:43 -------- dc-h--w- c:\programdata\{E961CE1B-C3EA-4882-9F67-F859B555D097}
2010-12-06 00:42 . 2010-12-06 00:48 -------- d-----w- c:\programdata\Lavasoft
2010-12-06 00:42 . 2010-12-06 00:42 -------- d-----w- c:\program files\Lavasoft
2010-12-05 22:49 . 2010-12-05 22:49 -------- d-----w- c:\program files\CCleaner
2010-11-29 22:35 . 2010-11-29 22:35 -------- d-----w- c:\users\Dasha\AppData\Local\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2010-05-21 19:35 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-05 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-05 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-29 7744032]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Dasha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\Dasha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2010-01-18 07:42 3058304 ----a-w- c:\windows\AsScrPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSPRP]
2010-01-18 07:13 2018032 ----a-w- c:\program files\ASUS\APRP\aprp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eee Docking]
2009-11-17 21:47 414384 ----a-w- c:\program files\ASUS\Eee Docking\Eee Docking.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EeeSplendidAgent]
2009-12-29 23:28 104960 ----a-w- c:\program files\ASUS\EPC\EeeSplendid\AsAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyMon]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyService]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LivCam]
2009-11-19 22:05 284160 ----a-w- c:\program files\ASUS\LivCam\LivCam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveUpdate]
2009-09-11 21:25 33768 ----a-w- c:\windows\System32\AsusSender.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-11-20 08:17 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-05-20 06:16 222504 ----a-w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2008-08-03 23:02 36352 ----a-w- c:\program files\Winamp\winampa.exe

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-12-06 1375992]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2010-12-06 15264]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]
R4 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2009-07-06 11448]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 41312]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/pages/ ... ?3,16,13,0
FF - ProfilePath - c:\users\Dasha\AppData\Roaming\Mozilla\Firefox\Profiles\mw8424u5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2010-12-28 03:55:32
ComboFix-quarantined-files.txt 2010-12-28 02:55
ComboFix2.txt 2010-12-26 03:52

Před spuštěním: Volných bajtů: 58 826 932 224
Po spuštění: Volných bajtů: 59 220 451 328

- - End Of File - - 722573578197DB9614F53B77E06ED231
Nahoru
Uživatelský avatar
Roli
VIP
VIP
Příspěvky: 13399
Registrován: 26 lis 2006 13:37
Bydliště: ČR

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#14 Příspěvek od Roli »

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Pak dej vědět jaký je stav PC.
| Rsit | Mbam | AVPTool | Cure It |

O víkendu odpočívám :all_coholic:
Nahoru
iname
Návštěvník
Návštěvník
Příspěvky: 14
Registrován: 18 pro 2010 02:08

Re: PROSIM o kontrolu logu, podezření na nějakou havěť

#15 Příspěvek od iname »

děkuji! :worship: zatim to vypada vše OK, uvidím co poví přítelkyně :D

mohu se zeptat co se prepisovalo tim txt. chapu ze registr ale kde a co ti v tom predchozim logu nesedelo ? (jo nevadi ze ti tykam :???: )

dik za info :!:

lada
Nahoru
Odpovědět

Zpět na „Preventivní kontroly logů“