Rootkit - C:\Windows\System32\drivers\rmesth.sys

[poharka]

SystemLook 04.09.10 by jpshortstuff
Log created at 23:13 on 16/12/2010 by Saga
Administrator - Elevation successful

========== filefind ==========

Searching for "Rjv.exe"
No files found.

========== regfind ==========

Searching for "Rjv.exe"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"JP595IR86O"="C:\Windows\TEMP\Rjv.exe"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"JP595IR86O"="C:\Windows\TEMP\Rjv.exe"

-= EOF =-

[motji]

Spustte OTL
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:reg
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"JP595IR86O"="-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"JP595IR86O"=-

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]

-klikněte na tlačítko opravit.
-Následně se pc restartuje.
- Log vložte zde


A rovnou nový log ze Rsitu

[poharka]

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\\"JP595IR86O"|"- /E : value set successfully!
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\JP595IR86O deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Saga
->Temp folder emptied: 144257 bytes
->Temporary Internet Files folder emptied: 66340 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 22538373 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2644 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 22,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Saga
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12162010_233013

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[poharka]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Saga at 2010-12-16 23:33:47
Microsoft Windows 7 Professional
System drive C: has 11 GB (10%) free of 110 GB
Total RAM: 2046 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:34:10, on 16. 12. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\notepad.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Saga\Desktop\RSIT.exe
C:\Program Files\trend micro\Saga.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 4502 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2009-01-20 3563520]
"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-11-29 963976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-13 22:44:25 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_22.44.25_log.txt
2010-12-13 21:08:46 ----D---- C:\ProgramData\Kaspersky Lab
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409422.sys
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409421.sys
2010-12-13 21:07:44 ----A---- C:\Windows\system32\drivers\0740942.sys
2010-12-13 20:50:08 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_20.50.08_log.txt
2010-12-12 22:01:02 ----A---- C:\Windows\zip.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWSC.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWREG.exe
2010-12-12 22:01:02 ----A---- C:\Windows\sed.exe
2010-12-12 22:01:02 ----A---- C:\Windows\PEV.exe
2010-12-12 22:01:02 ----A---- C:\Windows\NIRCMD.exe
2010-12-12 22:01:02 ----A---- C:\Windows\MBR.exe
2010-12-12 22:01:02 ----A---- C:\Windows\grep.exe
2010-12-12 22:00:44 ----D---- C:\Windows\ERDNT
2010-12-12 22:00:43 ----SD---- C:\beruška.com
2010-12-12 22:00:12 ----D---- C:\Qoobox
2010-12-12 21:59:49 ----A---- C:\Windows\SWXCACLS.exe
2010-12-12 21:59:43 ----RD---- C:\32788R22FWJFW
2010-12-12 11:54:53 ----D---- C:\Users\Saga\AppData\Roaming\Malwarebytes
2010-12-12 11:54:44 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-12-12 11:54:43 ----D---- C:\ProgramData\Malwarebytes
2010-12-12 11:54:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-12 11:54:39 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-12-12 11:21:58 ----A---- C:\Program Files\lvzqx.txt
2010-12-12 09:49:39 ----D---- C:\_OTL
2010-12-11 22:41:05 ----D---- C:\Program Files\trend micro
2010-12-11 22:41:04 ----D---- C:\rsit
2010-12-11 21:13:53 ----D---- C:\Program Files\Sophos
2010-12-11 12:29:28 ----D---- C:\Program Files\WIDCOMM
2010-12-11 12:24:20 ----D---- C:\Users\Saga\AppData\Roaming\Dell
2010-12-11 12:24:02 ----D---- C:\Program Files\Cisco
2010-12-11 12:22:05 ----A---- C:\Windows\system32\BCMLogon.dll
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.exe
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\Uninst_EAPModules.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\drivers\bcm42rly.sys
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlu00.exe
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlrmt.dll
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmttls.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\wltrynt.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\WLTRAY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\WLTRYSVC.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\BCMWLTRY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\bcmwlapi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\drivers\BCMWL6.SYS
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmwlcoi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvui.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvsrv.dll
2010-12-11 12:21:58 ----D---- C:\Program Files\Dell
2010-12-11 12:21:37 ----D---- C:\Users\Saga\AppData\Roaming\InstallShield
2010-12-11 11:44:29 ----A---- C:\Windows\ntbtlog.txt
2010-12-11 09:01:03 ----D---- C:\Windows\Minidump
2010-12-11 08:58:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-12-11 08:58:39 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-12-11 08:58:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-12-11 08:58:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-12-11 08:58:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-12-11 08:58:20 ----A---- C:\Windows\system32\aswBoot.exe
2010-12-04 08:31:10 ----A---- C:\Windows\ODBC.INI

======List of files/folders modified in the last 1 months======

2010-12-16 23:32:17 ----D---- C:\Windows\Temp
2010-12-16 23:31:56 ----D---- C:\Windows\system32\config
2010-12-16 23:01:44 ----D---- C:\Windows\System32
2010-12-16 23:01:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-16 23:01:43 ----D---- C:\Windows\inf
2010-12-16 22:55:53 ----D---- C:\Windows\system32\drivers\etc
2010-12-16 22:46:36 ----D---- C:\Windows\system32\drivers
2010-12-16 22:44:14 ----D---- C:\Windows
2010-12-16 21:26:33 ----D---- C:\Users\Saga\AppData\Roaming\vlc
2010-12-14 19:29:43 ----RD---- C:\Program Files
2010-12-14 07:58:28 ----SHD---- C:\System Volume Information
2010-12-13 21:08:46 ----HD---- C:\ProgramData
2010-12-13 20:37:35 ----D---- C:\Windows\system32\catroot2
2010-12-13 20:35:03 ----D---- C:\Windows\Tasks
2010-12-13 20:34:36 ----SHD---- C:\Windows\Installer
2010-12-13 19:15:43 ----D---- C:\Program Files\Mozilla Firefox
2010-12-12 22:12:32 ----D---- C:\Windows\AppPatch
2010-12-12 22:12:31 ----D---- C:\Program Files\Common Files
2010-12-12 21:54:18 ----D---- C:\Windows\Setup
2010-12-12 21:52:44 ----D---- C:\Windows\system32\Tasks
2010-12-12 20:31:47 ----D---- C:\Windows\system32\wfp
2010-12-12 20:31:47 ----D---- C:\Windows\system32\DriverStore
2010-12-12 20:31:43 ----D---- C:\Windows\system32\CodeIntegrity
2010-12-12 20:31:43 ----D---- C:\Users\Saga\AppData\Roaming\BitTorrent
2010-12-12 20:31:31 ----D---- C:\Windows\system32\wbem
2010-12-12 20:31:31 ----D---- C:\Windows\registration
2010-12-12 20:31:29 ----D---- C:\Windows\winsxs
2010-12-12 20:31:27 ----SD---- C:\Windows\system32\Microsoft
2010-12-12 20:31:24 ----D---- C:\Windows\system32\catroot
2010-12-12 20:31:09 ----SD---- C:\ProgramData\Microsoft
2010-12-12 20:29:09 ----D---- C:\Windows\system32\LogFiles
2010-12-12 17:40:08 ----D---- C:\ProgramData\Microsoft Help
2010-12-11 12:22:04 ----D---- C:\Windows\Help
2010-12-11 11:40:44 ----D---- C:\Windows\system32\NDF
2010-12-11 10:15:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-11 10:15:07 ----D---- C:\Users\Saga\AppData\Roaming\COWON
2010-12-11 08:58:17 ----D---- C:\ProgramData\Alwil Software
2010-12-10 21:01:33 ----D---- C:\Windows\system32\sysprep
2010-12-10 20:56:07 ----D---- C:\Users\Saga\AppData\Roaming\Skype
2010-12-10 18:49:15 ----D---- C:\Users\Saga\AppData\Roaming\skypePM
2010-12-04 19:20:09 ----D---- C:\Program Files\Microsoft Office
2010-12-04 19:17:37 ----RSD---- C:\Windows\assembly
2010-12-04 19:17:36 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-04 19:17:27 ----D---- C:\Windows\ShellNew
2010-12-04 19:16:26 ----D---- C:\Windows\system32\appmgmt
2010-12-04 19:10:23 ----D---- C:\Program Files\MSBuild
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Works
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio
2010-12-04 19:09:44 ----SD---- C:\Users\Saga\AppData\Roaming\Microsoft
2010-12-04 19:09:31 ----D---- C:\ProgramData\Adobe
2010-12-04 08:29:53 ----D---- C:\Windows\system
2010-11-20 22:59:38 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 07409422;07409422 Boot Guard Driver; C:\Windows\system32\DRIVERS\07409422.sys [2009-10-22 37392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 07409421;07409421; C:\Windows\system32\DRIVERS\07409421.sys [2009-09-25 128016]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-06-25 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-25 155136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2009-01-20 18424]
R3 BCM43XX;Ovládač karty Dell bezdrôtovej WLAN; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-01-20 1207288]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 catchme;catchme; \??\C:\Users\Saga\AppData\Local\Temp\catchme.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2009-01-20 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

[motji]

Tak jsem Vás trochu potrápila, ale je to fuč .

Ještě znovu spustte OTL, klikněte na tlačítko vyčisti, uklidí po sobě


Tak za dva tři dny sem vložte znovu log ze Rsitu, ať máme jistotu, že je vše fuč .
Jinak počítač je v pořádku?

[poharka]

vsetko vykonane
za tri dni to sem supnem. PC bol v poriadku v posledne dni, nic som nezaregistrovala, nepadal system...

Este raz velmi pekne dakujem za ochotu, vytrvalost a hlavne ucinne rady

Som rada, ze je zase ok

[motji]

Není zač. Trošku jsme Vás potrápila , ale raději bych počítač pak ještě zkontrolovala.
Dobrou noc

[poharka]

tak som tu zas

pc vyzeral byt ok, az dokym mi net nezacal blokovat stranky, vela stranok sa neda otvorit, lebo zevraj kvoli bezpecnosti.
A co som si spomenula, dakedy mi len tak padne firefox - vyhodi sa mi oznamenie o zlyhani a skonci.

pripajam log z rsitu :

Logfile of random's system information tool 1.08 (written by random/random)
Run by Saga at 2010-12-22 20:30:04
Microsoft Windows 7 Professional
System drive C: has 7 GB (6%) free of 110 GB
Total RAM: 2046 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:30:12, on 22. 12. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Saga\Desktop\RSIT.exe
C:\Program Files\trend micro\Saga.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 4388 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2009-01-20 3563520]
"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-11-29 963976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-22 20:30:04 ----D---- C:\rsit
2010-12-13 21:08:46 ----D---- C:\ProgramData\Kaspersky Lab
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409422.sys
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409421.sys
2010-12-13 21:07:44 ----A---- C:\Windows\system32\drivers\0740942.sys
2010-12-12 22:00:44 ----D---- C:\Windows\ERDNT
2010-12-12 22:00:43 ----SD---- C:\beruška.com
2010-12-12 21:59:43 ----RD---- C:\32788R22FWJFW
2010-12-12 11:54:53 ----D---- C:\Users\Saga\AppData\Roaming\Malwarebytes
2010-12-12 11:54:44 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-12-12 11:54:43 ----D---- C:\ProgramData\Malwarebytes
2010-12-12 11:54:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-12 11:54:39 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-12-12 11:21:58 ----A---- C:\Program Files\lvzqx.txt
2010-12-11 22:41:05 ----D---- C:\Program Files\trend micro
2010-12-11 21:13:53 ----D---- C:\Program Files\Sophos
2010-12-11 12:29:28 ----D---- C:\Program Files\WIDCOMM
2010-12-11 12:24:20 ----D---- C:\Users\Saga\AppData\Roaming\Dell
2010-12-11 12:24:02 ----D---- C:\Program Files\Cisco
2010-12-11 12:22:05 ----A---- C:\Windows\system32\BCMLogon.dll
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.exe
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\Uninst_EAPModules.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\drivers\bcm42rly.sys
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlu00.exe
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlrmt.dll
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmttls.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\wltrynt.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\WLTRAY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\WLTRYSVC.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\BCMWLTRY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\bcmwlapi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\drivers\BCMWL6.SYS
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmwlcoi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvui.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvsrv.dll
2010-12-11 12:21:58 ----D---- C:\Program Files\Dell
2010-12-11 12:21:37 ----D---- C:\Users\Saga\AppData\Roaming\InstallShield
2010-12-11 11:44:29 ----A---- C:\Windows\ntbtlog.txt
2010-12-11 09:01:03 ----D---- C:\Windows\Minidump
2010-12-11 08:58:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-12-11 08:58:39 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-12-11 08:58:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-12-11 08:58:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-12-11 08:58:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-12-11 08:58:20 ----A---- C:\Windows\system32\aswBoot.exe
2010-12-04 08:31:10 ----A---- C:\Windows\ODBC.INI

======List of files/folders modified in the last 1 months======

2010-12-22 20:30:07 ----D---- C:\Windows\Temp
2010-12-22 20:23:09 ----D---- C:\Users\Saga\AppData\Roaming\BitTorrent
2010-12-22 17:32:07 ----D---- C:\Windows\system32\config
2010-12-22 17:25:44 ----D---- C:\Windows\System32
2010-12-22 17:25:44 ----D---- C:\Windows\inf
2010-12-22 17:25:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-21 20:05:19 ----SHD---- C:\System Volume Information
2010-12-19 21:45:01 ----D---- C:\Users\Saga\AppData\Roaming\vlc
2010-12-16 23:42:22 ----D---- C:\Windows
2010-12-16 22:55:53 ----D---- C:\Windows\system32\drivers\etc
2010-12-16 22:46:36 ----D---- C:\Windows\system32\drivers
2010-12-14 19:29:43 ----RD---- C:\Program Files
2010-12-13 21:08:46 ----HD---- C:\ProgramData
2010-12-13 20:37:35 ----D---- C:\Windows\system32\catroot2
2010-12-13 20:35:03 ----D---- C:\Windows\Tasks
2010-12-13 20:34:36 ----SHD---- C:\Windows\Installer
2010-12-13 19:15:43 ----D---- C:\Program Files\Mozilla Firefox
2010-12-12 22:12:32 ----D---- C:\Windows\AppPatch
2010-12-12 22:12:31 ----D---- C:\Program Files\Common Files
2010-12-12 21:54:18 ----D---- C:\Windows\Setup
2010-12-12 21:52:44 ----D---- C:\Windows\system32\Tasks
2010-12-12 20:31:47 ----D---- C:\Windows\system32\wfp
2010-12-12 20:31:47 ----D---- C:\Windows\system32\DriverStore
2010-12-12 20:31:43 ----D---- C:\Windows\system32\CodeIntegrity
2010-12-12 20:31:31 ----D---- C:\Windows\system32\wbem
2010-12-12 20:31:31 ----D---- C:\Windows\registration
2010-12-12 20:31:29 ----D---- C:\Windows\winsxs
2010-12-12 20:31:27 ----SD---- C:\Windows\system32\Microsoft
2010-12-12 20:31:24 ----D---- C:\Windows\system32\catroot
2010-12-12 20:31:09 ----SD---- C:\ProgramData\Microsoft
2010-12-12 20:29:09 ----D---- C:\Windows\system32\LogFiles
2010-12-12 17:40:08 ----D---- C:\ProgramData\Microsoft Help
2010-12-11 12:22:04 ----D---- C:\Windows\Help
2010-12-11 11:40:44 ----D---- C:\Windows\system32\NDF
2010-12-11 10:15:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-11 10:15:07 ----D---- C:\Users\Saga\AppData\Roaming\COWON
2010-12-11 08:58:17 ----D---- C:\ProgramData\Alwil Software
2010-12-10 21:01:33 ----D---- C:\Windows\system32\sysprep
2010-12-10 20:56:07 ----D---- C:\Users\Saga\AppData\Roaming\Skype
2010-12-10 18:49:15 ----D---- C:\Users\Saga\AppData\Roaming\skypePM
2010-12-04 19:20:09 ----D---- C:\Program Files\Microsoft Office
2010-12-04 19:17:37 ----RSD---- C:\Windows\assembly
2010-12-04 19:17:36 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-04 19:17:27 ----D---- C:\Windows\ShellNew
2010-12-04 19:16:26 ----D---- C:\Windows\system32\appmgmt
2010-12-04 19:10:23 ----D---- C:\Program Files\MSBuild
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Works
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio
2010-12-04 19:09:44 ----SD---- C:\Users\Saga\AppData\Roaming\Microsoft
2010-12-04 19:09:31 ----D---- C:\ProgramData\Adobe
2010-12-04 08:29:53 ----D---- C:\Windows\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 07409422;07409422 Boot Guard Driver; C:\Windows\system32\DRIVERS\07409422.sys [2009-10-22 37392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 07409421;07409421; C:\Windows\system32\DRIVERS\07409421.sys [2009-09-25 128016]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-06-25 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-25 155136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2009-01-20 18424]
R3 BCM43XX;Ovládač karty Dell bezdrôtovej WLAN; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-01-20 1207288]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2009-01-20 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

je to ok, ci zase sa tam nieco vlamalo?

[motji]

Ahoj
nevidím nic, koukneme pořádně

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT 

- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde


Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

[poharka]

ahoj, dlho som tu nebola, bola som na dovolenke.

PC je stale v neporiadku. Pouzivam avast, a ten mi nasiel toto:c://windows//explorer.exe - hrozba:win 32:patched- TM(Trj)
pravdepodobne ide o trojana. na obrazovke sa mi robia take ciary. Neviem co s tym mam robit, lebo ked to dam presunut do truhly, tak to nejde, lebo to napise, ze subor je len na citanie.

Vcera som to dala kompletne skenovat Malwarebytes a nic nenaslo.

Poradite mi prosim vas, co s tym, lebo ma fakt porazi, enchapem, odkial sa to tu berie
Dakujem

[motji]

Ahoj, Tobě tuším nešel combofix,že?

Udělej co je napsáno v přechozím příspěvku, ten OTL a Gmer
A ten soubor explorer.exe otestuj na www.virustotal.com. Vypadá to že je napadený virem, budeme ho muset vyměnit, rozhodně ho nemaž

[poharka]

ja som to skusala, ten otl, lenze ona mi to strasne dlho, asi tri hodiny skenovalo, a zaseklo sa to na nejakom manualnom skene nejake priecinka. nieco mi to aj vyhodilo, ze nemoze vytvorit nieco na ploche, dala som ok a skenovalo dalej. lenze potom sa to zaseklo, a nic...
idem to skusit este raz.
ked som ten subor davala na virus total, nedalo sa mi touploadnut, lebo ze obsahuje virus

tak neviem, co teda mam robit?
teraz to akurat skenujem uz 2,5 hod cez kaspersky. uz je hotovo 68percent.

[motji]

nechte doběhnout kašperského a ten OTL zkuste potom v nouzovém režimu. Když nepujde, tak si zjistím čistý explorer jinak

[poharka]

necham skoncit kasperskeho.

nakoniec na virustotal mi to slo, a naslo toto:

Antivirus Version Last update Result
AhnLab-V3 2011.01.04.00 2011.01.03 Trojan/Win32.Bamital
AntiVir 7.11.1.17 2011.01.03 TR/Patched.Gen
Antiy-AVL 2.0.3.7 2011.01.03 -
Avast 4.8.1351.0 2011.01.03 Win32:Patched-TM
Avast5 5.0.677.0 2011.01.03 Win32:Patched-TM
AVG 9.0.0.851 2011.01.03 -
BitDefender 7.2 2011.01.03 Trojan.Generic.5259171
CAT-QuickHeal 11.00 2011.01.03 -
ClamAV 0.96.4.0 2011.01.03 -
Command 5.2.11.5 2011.01.02 -
Comodo 7286 2011.01.03 -
DrWeb 5.0.2.03300 2011.01.03 -
eSafe 7.0.17.0 2011.01.02 -
eTrust-Vet 36.1.8079 2011.01.03 Win32/Patcher.S
F-Prot 4.6.2.117 2011.01.02 -
F-Secure 9.0.16160.0 2011.01.03 Trojan.Generic.5259171
Fortinet 4.2.254.0 2011.01.03 W32/KORDEEF.AA!tr
GData 21 2011.01.03 Trojan.Generic.5259171
Ikarus T3.1.1.90.0 2011.01.03 Trojan.SuspectCRC
Jiangmin 13.0.900 2011.01.03 -
K7AntiVirus 9.75.3423 2011.01.03 Riskware
McAfee 5.400.0.1158 2011.01.03 Artemis!6CE102617EE8
McAfee-GW-Edition 2010.1C 2011.01.03 -
Microsoft 1.6402 2011.01.03 -
NOD32 5757 2011.01.03 Win32/Patched.GK
Norman 6.06.12 2011.01.03 W32/Smalltroj.ZLIW
nProtect 2011-01-03.01 2011.01.03 Trojan.Generic.5259171
Panda 10.0.2.7 2011.01.03 W32/Patched.AM
PCTools 7.0.3.5 2011.01.03 Trojan.Bamital
Prevx 3.0 2011.01.03 -
Rising 22.80.04.04 2010.12.31 Trojan.Win32.Generic.52568408
Sophos 4.60.0 2011.01.03 Troj/Patched-Y
SUPERAntiSpyware 4.40.0.1006 2011.01.03 -
Symantec 20101.3.0.103 2011.01.03 Trojan.Bamital.B!inf
TheHacker 6.7.0.1.110 2011.01.03 -
TrendMicro 9.120.0.1004 2011.01.03 TROJ_KORDEEF.AA
TrendMicro-HouseCall 9.120.0.1004 2011.01.03 TROJ_KORDEEF.AA
VBA32 3.12.14.2 2011.01.03 -
VIPRE 7941 2011.01.03 Trojan.Win32.Generic!BT
ViRobot 2011.1.3.4234 2011.01.03 -
VirusBuster 13.6.125.0 2011.01.03 -

[motji]

Ten soubor musíme vyměnit. nechte dojet kašperského, zkuste to OTL v nouzovém režimu a zítra vymyslím, jak ho vyměnit