Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Log pre motji

Nemáte v tuto chvíli žádný problém s pc a chcete se jen ujistit, že je vše v pořádku?
Vložte log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Log pre motji

#1 Příspěvek od Kovas »

Dobrý deň,
po dohode s motji prikladám logy, ktoré ste žiadali.
V podstate sa mi problém vyskytol, ako posledne. Po štarte Windows som otvoril Total Commander súčasne s Firefoxom a notebook mi zmrzol. Natvrdo som ho musel vypnúť. Potom sa mi, ale začal po štarte windows systém značne spomaľovať. Cez bod návratu som to chcel opraviť, ale po nabehnutí Windows bol poškodený Avast 5. Nešlo spustiť ochranu. Nakoniec som sa rozhodol ho odinštalovať a nanovo ho nainštalovať. Po preinštalovaní Avast beží správne.

Potom trvalo aj niekoľko minút po štarte Windows kým nabehne Firefox. Spustil som SAS našiel nejakú háveď, spustil som aj Avast po reštarte, našiel nejakého trojana, ale stále to blbne.

Niekoľkokrát som Windows ešte reštartoval, ale postupne sa štart Firefox zlepšil. Teraz štartuje, ako pred problémom.

Tu je log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-01-21 13:36:05
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (37%) free of 30 GB
Total RAM: 1976 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:36:14, on 21. 1. 2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\oodag.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
D:\Programy\totalcmd\TOTALCMD.EXE
D:\Instal\RSIT\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=;ftp=;https=;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [acevents] "C:\Program Files\ActivIdentity\ActivClient\acevents.exe"
O4 - HKLM\..\Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: Nastavení aplikace &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1542008234
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Programy\SuperAntispyware\SASWINLO.DLL
O20 - Winlogon Notify: ackpbsc - C:\Program Files\ActivIdentity\ActivClient\ackpbsc.dll
O20 - Winlogon Notify: acunlock - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ActivIdentity Shared Store Service (ac.sharedstore) - ActivIdentity - C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 8328 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-02 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll [2010-02-23 2121728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-02 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-04-04 1044480]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-03-13 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-03-13 173592]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-03-13 142360]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032]
"acevents"=C:\Program Files\ActivIdentity\ActivClient\acevents.exe [2009-06-03 153640]
"accrdsub"=C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [2009-06-03 400936]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-01-21 2548552]
"vspdfprsrv.exe"=D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe [2007-07-02 1179648]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
D:\Programy\SuperAntispyware\SASWINLO.DLL [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ackpbsc]
C:\Program Files\ActivIdentity\ActivClient\ackpbsc.dll [2009-06-03 113152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acunlock]
C:\Program Files\ActivIdentity\ActivClient\acunlock.dll [2009-06-03 299520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-03-09 205824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=D:\Programy\SuperAntispyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoDriveTypeAutoRun"=181

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\Programy\Pinnacle\Studio 14\Programs\RM.exe"="D:\Programy\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager"
"D:\Programy\Pinnacle\Studio 14\Programs\Studio.exe"="D:\Programy\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio"
"D:\Programy\Pinnacle\Studio 14\Programs\umi.exe"="D:\Programy\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi"
"D:\Programy\totalcmd\TOTALCMD.EXE"="D:\Programy\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\Programy\Skype\Plugin Manager\skypePM.exe"="D:\Programy\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Programy\Skype\Phone\Skype.exe"="D:\Programy\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-01-21 13:36:05 ----D---- C:\rsit
2011-01-21 09:26:13 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-01-21 09:26:12 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-01-21 09:26:11 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-01-21 09:26:10 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-01-21 09:26:09 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-01-21 09:26:09 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-01-21 09:26:08 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-01-21 09:25:55 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-01-21 09:15:53 ----A---- C:\WINDOWS\ntbtlog.txt
2011-01-14 20:50:38 ----A---- C:\Documents and Settings\All Users\Data aplikací\__wdump.txt
2011-01-13 19:07:20 ----A---- C:\WINDOWS\system32\vsmon1.dll
2011-01-13 19:07:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF Jobs
2011-01-13 19:07:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF
2011-01-13 18:54:41 ----D---- C:\WINDOWS\My Documents
2011-01-13 16:36:50 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-01-13 16:35:43 ----D---- C:\Program Files\Avanquest update
2011-01-12 11:56:31 ----D---- C:\Program Files\MSECache
2011-01-12 10:52:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2010-12-28 12:47:07 ----HD---- C:\VritualRoot
2010-12-25 16:43:07 ----D---- C:\Program Files\AVS4YOU
2010-12-25 16:42:42 ----A---- C:\WINDOWS\system32\libmfxsw32.dll
2010-12-25 16:42:41 ----A---- C:\WINDOWS\system32\libmfxhw32.dll
2010-12-25 01:52:01 ----D---- C:\Documents and Settings\Administrator\Data aplikací\AVS4YOU
2010-12-25 01:51:04 ----D---- C:\Program Files\Common Files\AVSMedia
2010-12-25 01:50:29 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2010-12-25 01:50:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVS4YOU
2010-12-25 01:50:28 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-12-25 00:36:43 ----D---- C:\Documents and Settings\Administrator\Data aplikací\avidemux

======List of files/folders modified in the last 1 months======

2011-01-21 13:36:14 ----D---- C:\WINDOWS\Prefetch
2011-01-21 13:36:10 ----D---- C:\Program Files\trend micro
2011-01-21 13:28:00 ----D---- C:\WINDOWS\temp
2011-01-21 13:12:52 ----A---- C:\WINDOWS\wincmd.ini
2011-01-21 13:09:13 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-21 13:08:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-21 09:48:43 ----D---- C:\WINDOWS\system32
2011-01-21 09:48:43 ----D---- C:\WINDOWS
2011-01-21 09:26:13 ----D---- C:\WINDOWS\system32\drivers
2011-01-21 09:26:04 ----SHD---- C:\WINDOWS\Installer
2011-01-21 09:26:04 ----D---- C:\WINDOWS\WinSxS
2011-01-21 09:25:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-01-21 09:25:49 ----D---- C:\Program Files\Alwil Software
2011-01-21 09:19:02 ----HD---- C:\WINDOWS\inf
2011-01-21 08:55:42 ----D---- C:\WINDOWS\system32\config
2011-01-21 08:55:31 ----D---- C:\WINDOWS\system32\wbem
2011-01-21 08:55:30 ----D---- C:\WINDOWS\Registration
2011-01-20 23:47:05 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-01-20 22:54:00 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2011-01-17 23:32:20 ----A---- C:\WINDOWS\VPlayer.INI
2011-01-17 23:31:19 ----A---- C:\WINDOWS\NeroDigital.ini
2011-01-14 23:53:30 ----A---- C:\WINDOWS\wcx_ftp.ini
2011-01-14 20:52:22 ----A---- C:\WINDOWS\win.ini
2011-01-14 09:39:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\BVRP Software
2011-01-14 09:39:54 ----RD---- C:\Program Files
2011-01-13 19:10:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF 5
2011-01-13 19:05:47 ----HD---- C:\Program Files\InstallShield Installation Information
2011-01-12 11:57:48 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2011-01-12 11:56:47 ----RSD---- C:\WINDOWS\Fonts
2011-01-12 11:56:44 ----D---- C:\Program Files\Microsoft Office
2011-01-12 11:56:43 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-01-12 10:52:48 ----A---- C:\WINDOWS\system32\MRT.exe
2011-01-12 10:52:41 ----DC---- C:\WINDOWS\system32\dllcache
2011-01-12 10:49:46 ----HD---- C:\WINDOWS\$hf_mig$
2011-01-11 19:19:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\COMODO
2011-01-11 18:57:28 ----A---- C:\WINDOWS\system32\guard32.dll
2010-12-29 21:29:03 ----D---- C:\WINDOWS\system32\oodag
2010-12-25 01:51:04 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hotcore3;hotcore3; C:\WINDOWS\system32\drivers\hotcore3.sys [2007-05-04 38448]
R0 hpdskflt;HP Disk Filter Driver; C:\WINDOWS\system32\DRIVERS\hpdskflt.sys [2006-10-17 17920]
R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2011-01-11 94784]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-08-25 36528]
R0 SFAUDIO;Sonic Focus DSP Driver; C:\WINDOWS\system32\drivers\sfaudio.sys [2008-03-28 24064]
R0 Vax347b;Vax347b; C:\WINDOWS\system32\DRIVERS\Vax347b.sys [2005-04-25 159616]
R0 Vax347s;Vax347s; C:\WINDOWS\System32\Drivers\Vax347s.sys [2004-04-30 5248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-01-13 29392]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-01-13 23632]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-01-13 294608]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-01-13 47440]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2011-01-11 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2011-01-11 27576]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SASDIFSV;SASDIFSV; \??\D:\Programy\SuperAntispyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\D:\Programy\SuperAntispyware\SASKUTIL.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-01-13 100176]
R3 Accelerometer;Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [2006-10-17 22016]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-04-11 338944]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-07-13 94976]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2008-11-21 1204128]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver; C:\WINDOWS\System32\Drivers\ATSwpWDF.sys [2009-07-29 482176]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2008-04-03 539512]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-04-03 37424]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-04-03 879624]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-04-03 156392]
R3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-04-03 55352]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-04-03 74688]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2008-04-28 9344]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-03-09 6278016]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2008-07-23 44800]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NETw5x32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2009-11-16 4221952]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S1 SABKUTIL;SABKUTIL; \??\D:\Programy\SuperAntispyware\SABKUTIL.sys []
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 b57w2k;BCM5701 Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2001-10-24 97120]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\NSNDIS5.SYS []
S3 Revoflt;Revoflt; C:\WINDOWS\system32\DRIVERS\revoflt.sys [2009-12-30 27064]
S3 Ser2pl;Prolific2 Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2005-07-25 48640]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ac.sharedstore;ActivIdentity Shared Store Service; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [2009-06-03 207400]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [2008-08-26 14336]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-03-31 264800]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-01-21 1803224]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-02 153376]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2009-02-25 1352960]
R2 StarWindService;StarWind iSCSI Service; D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2010-04-02 603904]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-12 135664]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2010-04-02 360192]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Log zo SAS

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/21/2011 at 10:41 AM

Application Version : 4.48.1000

Core Rules Database Version : 5134
Trace Rules Database Version: 3392

Scan type : Complete Scan
Total Scan Time : 00:28:05

Memory items scanned : 534
Memory threats detected : 0
Registry items scanned : 7560
Registry threats detected : 0
File items scanned : 22298
File threats detected : 11

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@clicksor[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ero-advertising[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@myroitracking[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@asiafriendfinder[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adultfriendfinder[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tracker.roitesting[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@serving.xxxwebtraffic[2].txt

Trojan.Agent/Gen-HackPatch
D:\SYSTEM VOLUME INFORMATION\_RESTORE{0068B98B-8DF6-42AB-B91E-4D9711482E61}\RP90\A0017595.EXE
D:\SYSTEM VOLUME INFORMATION\_RESTORE{0068B98B-8DF6-42AB-B91E-4D9711482E61}\RP90\A0017597.EXE

Screen z Avast virovej truhly
Virusová truhla.JPG
(49.88 KiB) Staženo 145 x
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#2 Příspěvek od motji »

Zdravím :)
především máte spuštěné dva programy na defragmentaci - OO defrag a tune up defrag. Jeden vypněte.


:arrow: Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

Pokračování večer :) .
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#3 Příspěvek od Kovas »

Zakázal som tune up defrag

Log z Combofix

ComboFix 11-01-20.03 - Administrator . 01. 2011 15:29:42.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1976.1438 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Files Created from 2010-12-21 to 2011-01-21 )))))))))))))))))))))))))))))))
.

2011-01-21 12:36 . 2011-01-21 12:36 -------- d-----w- C:\rsit
2011-01-21 08:26 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-21 08:26 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-21 08:26 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-21 08:26 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-21 08:26 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-21 08:26 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-21 08:26 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-21 08:25 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-21 07:55 . 2011-01-21 07:55 -------- d-----w- c:\windows\system32\wbem\Repository
2011-01-13 18:07 . 2005-06-02 11:40 14336 ----a-w- c:\windows\system32\vsmon1.dll
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF Jobs
2011-01-13 17:54 . 2011-01-13 17:54 -------- d-----w- c:\windows\My Documents
2011-01-13 15:36 . 2011-01-13 15:42 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-01-13 15:35 . 2011-01-13 15:35 -------- d-----w- c:\program files\Avanquest update
2011-01-12 10:56 . 2011-01-12 10:56 -------- d-----w- c:\program files\MSECache
2010-12-28 11:47 . 2010-12-28 14:04 -------- d-----w- C:\VritualRoot
2010-12-25 15:43 . 2011-01-09 16:12 -------- d-----w- c:\program files\AVS4YOU
2010-12-25 15:42 . 2010-09-03 12:32 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2010-12-25 15:42 . 2010-09-03 12:32 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2010-12-25 00:52 . 2010-12-25 18:53 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVS4YOU
2010-12-25 00:51 . 2010-12-25 15:43 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-12-25 00:50 . 2008-08-13 10:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-12-25 00:50 . 2010-12-25 00:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2010-12-25 00:50 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-12-24 23:36 . 2011-01-16 23:43 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\avidemux

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-10-05 20:03 38848 ----a-w- c:\windows\avastSS.scr
2011-01-11 17:57 . 2010-06-01 18:00 285480 ----a-w- c:\windows\system32\guard32.dll
2011-01-11 17:57 . 2010-06-01 18:00 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-11 17:57 . 2010-06-01 18:00 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-11 17:57 . 2010-06-01 18:00 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-01-11 17:57 . 2010-06-04 10:55 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-11-18 18:15 . 2009-08-28 12:44 81920 ------w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-17 13:49 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:23 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:23 . 2004-08-17 13:49 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-06 00:23 . 2004-08-17 13:49 43520 ------w- c:\windows\system32\licmgr10.dll
2010-11-03 12:25 . 2004-08-17 13:44 385024 ------w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2001-10-25 12:00 40960 ------w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2004-08-17 13:48 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2004-08-17 13:44 1853312 ------w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-13 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-13 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-13 142360]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"acevents"="c:\program files\ActivIdentity\ActivClient\acevents.exe" [2009-06-03 153640]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2009-06-03 400936]
"vspdfprsrv.exe"="d:\programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe" [2007-07-02 1179648]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-3-31 576104]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\programy\SuperAntispyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\programy\SuperAntispyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2009-06-03 14:14 113152 ----a-w- c:\program files\ActivIdentity\ActivClient\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2009-06-03 14:13 299520 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\j:\0autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"=d:\programy\Winamp\winampa.exe
"Malwarebytes Anti-Malware (reboot)"="d:\programy\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"RemoteControl"=d:\programy\CyberLink\PowerDVD\PDVDServ.exe
"USBToolTip"=c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" -h

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"d:\\Programy\\totalcmd\\TOTALCMD.EXE"=
"d:\\Programy\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Programy\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [27. 12. 2009 21:35 38448]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28. 3. 2008 13:14 24064]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [4. 9. 2009 23:10 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [4. 9. 2009 23:10 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [21. 1. 2011 9:26 294608]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [4. 6. 2010 11:55 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1. 6. 2010 19:00 27576]
R1 SASDIFSV;SASDIFSV;d:\programy\SuperAntispyware\sasdifsv.sys [17. 2. 2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;d:\programy\SuperAntispyware\SASKUTIL.SYS [10. 5. 2010 19:41 67656]
R2 ac.sharedstore;ActivIdentity Shared Store Service;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe [3. 6. 2009 15:16 207400]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21. 1. 2011 9:26 17744]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [29. 8. 2009 9:35 482176]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23. 7. 2008 10:31 44800]
S1 SABKUTIL;SABKUTIL;\??\d:\programy\SuperAntispyware\SABKUTIL.sys --> d:\programy\SuperAntispyware\SABKUTIL.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12. 1. 2010 23:44 135664]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [20. 7. 2010 15:28 27064]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2011-01-21 c:\windows\Tasks\1-Click Maintenance.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\Úklid 1 kliknutím.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\myd1jj65.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.sk
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\programy\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - d:\programy\Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ImTranslator: {9AA46F4F-4DC7-4c06-97AF-5035170634FE} - %profile%\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
FF - Ext: Super Hide IP: support@super-hide-ip.com - %profile%\extensions\support@super-hide-ip.com
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: CsFire: csfire@cs.kuleuven.be - %profile%\extensions\csfire@cs.kuleuven.be
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\Google\Google Gears\Firefox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-21 15:33
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\

[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC9F0E17-DF2C-2024-93FC-FE478F6FE0F2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"panpgmpdfgiepnfalhkhkpkaggkbibab"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c
"palpojogakigodkmnjjffbgoglbgiiif"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="11AA12E2A3A41484F58FFB46DD07F95E2F5CDD4294302AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA6171C11EC38DE3DA9C6AECB7A5D14077DFE8CFAC74074818B9AEB344F5E8E2F934B99265462E69EEE823C73A72416A543E5A843613B49E69AF6F40A0307A24316051C1D348E199BAC72AEA384ACFDDD74491743C30D81E7879F693768F6CDB96FCD481A05E9B3F0226F581A528CE19E153A3EEA3F65B16457A3B6909F6A02E4425235F4D9DD1F87B7E39757B477C186ED02677D2AE3944D5448303ECE10D0ADFB745E5C4846E8DB176E30AE5398C3C50B1D40135B2107298B860CBE9F8B6F0DC8CAA1526AF1BD7E3162CCC3D80B30A13C395896AF260D13CC89E3613FF2BB149A9C442CE1A674133746F715F7E1F37495B9A64888EFC9B7AEB3B74B61D133E5296A6D144D9B045122D2236F6121202B6F3785BC49F1895B091767F53827F8B86EE2288657FB86872C78A275CDC0E8C566FCAFDA5D1139D27A7EBBAD00E45359276D63D6A669BE93D4582E1E7830285A5A89495F2E29EA0962655D1376742EA5D622742A6D760F6B5FC962B4A24DD914EE92D5582E8653FBE7FCDC9ADC2E979143CF8F7A5CAC0095D1D7C0D78D6F9F2D8D7DBFAAD16B4EBD7329AA8D7663C3A4F47752952A07BCB078402C7A03DFBDF760E6530E120FD875B1021E09115587F83DCEBB9C9375956BE1F56D62CCDA9EDA591E438EE919955C13D570FC773CDEBFABBFAF07D3DBFD0B629EB1ABBB904D4D2B27240C5C2AC8C14F23412F7CC269BA18E5F39CAF138EE60F95884423A6FADE4F39EF396C535D87DC9F13377487E8C11B1536FBEDE682EAC4E9E66FDA377E2F01BE839FA29A61A3FAB2CC82B91E45BF93D20416D8183B19235CA4C33E4ECE724158A0198D790620A97A37D1AB8D87B4A456D1B2BE58BA040BE4FE2B2E6C08F4D3D96D56BADDA29C2DC6013A2AD06133330FF6E9F1D1AA5626AD95E60C08ED91C04A715AC2ABAFC9909BBC241A562363E89D2EA94AA0D4495D956D07C088633B54E51BFE3AB64CEEA0B261CCE682C5FE35D816B422D22BAE61AE6E73B8CC70F51E1ABBEDC0C938666D77C944FDAAE2D6CA49B420576EBF6A253FE3666224C4DB730D89A8F5A3DB9C4D8BB26FCF9A3ACD9D2C6F564DE94CF55FC280EF3254AF98EA159C01FD754017584140875211ADD9E8F292936AB3AB5B8AE5D7719F9626EF62BC739F02651269ECA3771901424509AC44CCEA19295DBC678EE2A2A598C03579C5EE01AF0D253FAA6EC38456D3AA7727F833C1489F864E784F7C0E44F93D5213A2D3F3B5FB6E56F711737FD762ADDA621FBA526A5F6ED7847565927FCF7C455879CC9D4AB20800FDB13812087A4179A6F7BFAA77A380B517"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\guard32.dll
d:\programy\SuperAntispyware\SASWINLO.DLL
c:\program files\ActivIdentity\ActivClient\ackpbsc.dll
c:\program files\ActivIdentity\ActivClient\aclog.dll
c:\program files\ActivIdentity\ActivClient\accrypto.dll
c:\program files\ActivIdentity\ActivClient\ACLIBEAY.dll
c:\program files\ActivIdentity\ActivClient\acunlock.dll
c:\program files\ActivIdentity\ActivClient\aipingui.dll
c:\program files\ActivIdentity\ActivClient\acevtsub.dll
c:\program files\ActivIdentity\ActivClient\asphat32.dll
c:\program files\ActivIdentity\ActivClient\acerrmes.dll
c:\program files\ActivIdentity\ActivClient\aiwinext.dll
c:\program files\ActivIdentity\ActivClient\aspcom.dll
c:\program files\ActivIdentity\ActivClient\aicext.dll
c:\program files\ActivIdentity\ActivClient\Resources\acerrmrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\asphatrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\aipinguirc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIlrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\acunlockrc.dll

- - - - - - - > 'lsass.exe'(980)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(1376)
c:\windows\system32\guard32.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-21 15:34:49
ComboFix-quarantined-files.txt 2011-01-21 14:34

Pre-Run: Volných bajtů: 11 651 608 576
Post-Run: Volných bajtů: 11 675 770 880

- - End Of File - - 157A8BB0452A366CA9AF26DB6F7780F4

ComboFix 11-01-20.03 - Administrator . 01. 2011 15:29:42.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1976.1438 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Files Created from 2010-12-21 to 2011-01-21 )))))))))))))))))))))))))))))))
.

2011-01-21 12:36 . 2011-01-21 12:36 -------- d-----w- C:\rsit
2011-01-21 08:26 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-21 08:26 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-21 08:26 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-21 08:26 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-21 08:26 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-21 08:26 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-21 08:26 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-21 08:25 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-21 07:55 . 2011-01-21 07:55 -------- d-----w- c:\windows\system32\wbem\Repository
2011-01-13 18:07 . 2005-06-02 11:40 14336 ----a-w- c:\windows\system32\vsmon1.dll
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF Jobs
2011-01-13 17:54 . 2011-01-13 17:54 -------- d-----w- c:\windows\My Documents
2011-01-13 15:36 . 2011-01-13 15:42 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-01-13 15:35 . 2011-01-13 15:35 -------- d-----w- c:\program files\Avanquest update
2011-01-12 10:56 . 2011-01-12 10:56 -------- d-----w- c:\program files\MSECache
2010-12-28 11:47 . 2010-12-28 14:04 -------- d-----w- C:\VritualRoot
2010-12-25 15:43 . 2011-01-09 16:12 -------- d-----w- c:\program files\AVS4YOU
2010-12-25 15:42 . 2010-09-03 12:32 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2010-12-25 15:42 . 2010-09-03 12:32 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2010-12-25 00:52 . 2010-12-25 18:53 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVS4YOU
2010-12-25 00:51 . 2010-12-25 15:43 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-12-25 00:50 . 2008-08-13 10:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-12-25 00:50 . 2010-12-25 00:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2010-12-25 00:50 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-12-24 23:36 . 2011-01-16 23:43 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\avidemux

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-10-05 20:03 38848 ----a-w- c:\windows\avastSS.scr
2011-01-11 17:57 . 2010-06-01 18:00 285480 ----a-w- c:\windows\system32\guard32.dll
2011-01-11 17:57 . 2010-06-01 18:00 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-11 17:57 . 2010-06-01 18:00 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-11 17:57 . 2010-06-01 18:00 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-01-11 17:57 . 2010-06-04 10:55 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-11-18 18:15 . 2009-08-28 12:44 81920 ------w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-17 13:49 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:23 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:23 . 2004-08-17 13:49 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-06 00:23 . 2004-08-17 13:49 43520 ------w- c:\windows\system32\licmgr10.dll
2010-11-03 12:25 . 2004-08-17 13:44 385024 ------w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2001-10-25 12:00 40960 ------w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2004-08-17 13:48 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2004-08-17 13:44 1853312 ------w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-13 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-13 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-13 142360]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"acevents"="c:\program files\ActivIdentity\ActivClient\acevents.exe" [2009-06-03 153640]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2009-06-03 400936]
"vspdfprsrv.exe"="d:\programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe" [2007-07-02 1179648]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-3-31 576104]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\programy\SuperAntispyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\programy\SuperAntispyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2009-06-03 14:14 113152 ----a-w- c:\program files\ActivIdentity\ActivClient\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2009-06-03 14:13 299520 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\j:\0autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"=d:\programy\Winamp\winampa.exe
"Malwarebytes Anti-Malware (reboot)"="d:\programy\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"RemoteControl"=d:\programy\CyberLink\PowerDVD\PDVDServ.exe
"USBToolTip"=c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" -h

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"d:\\Programy\\totalcmd\\TOTALCMD.EXE"=
"d:\\Programy\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Programy\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [27. 12. 2009 21:35 38448]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28. 3. 2008 13:14 24064]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [4. 9. 2009 23:10 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [4. 9. 2009 23:10 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [21. 1. 2011 9:26 294608]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [4. 6. 2010 11:55 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1. 6. 2010 19:00 27576]
R1 SASDIFSV;SASDIFSV;d:\programy\SuperAntispyware\sasdifsv.sys [17. 2. 2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;d:\programy\SuperAntispyware\SASKUTIL.SYS [10. 5. 2010 19:41 67656]
R2 ac.sharedstore;ActivIdentity Shared Store Service;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe [3. 6. 2009 15:16 207400]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21. 1. 2011 9:26 17744]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [29. 8. 2009 9:35 482176]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23. 7. 2008 10:31 44800]
S1 SABKUTIL;SABKUTIL;\??\d:\programy\SuperAntispyware\SABKUTIL.sys --> d:\programy\SuperAntispyware\SABKUTIL.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12. 1. 2010 23:44 135664]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [20. 7. 2010 15:28 27064]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2011-01-21 c:\windows\Tasks\1-Click Maintenance.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\Úklid 1 kliknutím.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\myd1jj65.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.sk
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\programy\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - d:\programy\Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ImTranslator: {9AA46F4F-4DC7-4c06-97AF-5035170634FE} - %profile%\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
FF - Ext: Super Hide IP: support@super-hide-ip.com - %profile%\extensions\support@super-hide-ip.com
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: CsFire: csfire@cs.kuleuven.be - %profile%\extensions\csfire@cs.kuleuven.be
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\Google\Google Gears\Firefox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-21 15:33
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\

[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC9F0E17-DF2C-2024-93FC-FE478F6FE0F2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"panpgmpdfgiepnfalhkhkpkaggkbibab"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c
"palpojogakigodkmnjjffbgoglbgiiif"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="11AA12E2A3A41484F58FFB46DD07F95E2F5CDD4294302AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA6171C11EC38DE3DA9C6AECB7A5D14077DFE8CFAC74074818B9AEB344F5E8E2F934B99265462E69EEE823C73A72416A543E5A843613B49E69AF6F40A0307A24316051C1D348E199BAC72AEA384ACFDDD74491743C30D81E7879F693768F6CDB96FCD481A05E9B3F0226F581A528CE19E153A3EEA3F65B16457A3B6909F6A02E4425235F4D9DD1F87B7E39757B477C186ED02677D2AE3944D5448303ECE10D0ADFB745E5C4846E8DB176E30AE5398C3C50B1D40135B2107298B860CBE9F8B6F0DC8CAA1526AF1BD7E3162CCC3D80B30A13C395896AF260D13CC89E3613FF2BB149A9C442CE1A674133746F715F7E1F37495B9A64888EFC9B7AEB3B74B61D133E5296A6D144D9B045122D2236F6121202B6F3785BC49F1895B091767F53827F8B86EE2288657FB86872C78A275CDC0E8C566FCAFDA5D1139D27A7EBBAD00E45359276D63D6A669BE93D4582E1E7830285A5A89495F2E29EA0962655D1376742EA5D622742A6D760F6B5FC962B4A24DD914EE92D5582E8653FBE7FCDC9ADC2E979143CF8F7A5CAC0095D1D7C0D78D6F9F2D8D7DBFAAD16B4EBD7329AA8D7663C3A4F47752952A07BCB078402C7A03DFBDF760E6530E120FD875B1021E09115587F83DCEBB9C9375956BE1F56D62CCDA9EDA591E438EE919955C13D570FC773CDEBFABBFAF07D3DBFD0B629EB1ABBB904D4D2B27240C5C2AC8C14F23412F7CC269BA18E5F39CAF138EE60F95884423A6FADE4F39EF396C535D87DC9F13377487E8C11B1536FBEDE682EAC4E9E66FDA377E2F01BE839FA29A61A3FAB2CC82B91E45BF93D20416D8183B19235CA4C33E4ECE724158A0198D790620A97A37D1AB8D87B4A456D1B2BE58BA040BE4FE2B2E6C08F4D3D96D56BADDA29C2DC6013A2AD06133330FF6E9F1D1AA5626AD95E60C08ED91C04A715AC2ABAFC9909BBC241A562363E89D2EA94AA0D4495D956D07C088633B54E51BFE3AB64CEEA0B261CCE682C5FE35D816B422D22BAE61AE6E73B8CC70F51E1ABBEDC0C938666D77C944FDAAE2D6CA49B420576EBF6A253FE3666224C4DB730D89A8F5A3DB9C4D8BB26FCF9A3ACD9D2C6F564DE94CF55FC280EF3254AF98EA159C01FD754017584140875211ADD9E8F292936AB3AB5B8AE5D7719F9626EF62BC739F02651269ECA3771901424509AC44CCEA19295DBC678EE2A2A598C03579C5EE01AF0D253FAA6EC38456D3AA7727F833C1489F864E784F7C0E44F93D5213A2D3F3B5FB6E56F711737FD762ADDA621FBA526A5F6ED7847565927FCF7C455879CC9D4AB20800FDB13812087A4179A6F7BFAA77A380B517"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\guard32.dll
d:\programy\SuperAntispyware\SASWINLO.DLL
c:\program files\ActivIdentity\ActivClient\ackpbsc.dll
c:\program files\ActivIdentity\ActivClient\aclog.dll
c:\program files\ActivIdentity\ActivClient\accrypto.dll
c:\program files\ActivIdentity\ActivClient\ACLIBEAY.dll
c:\program files\ActivIdentity\ActivClient\acunlock.dll
c:\program files\ActivIdentity\ActivClient\aipingui.dll
c:\program files\ActivIdentity\ActivClient\acevtsub.dll
c:\program files\ActivIdentity\ActivClient\asphat32.dll
c:\program files\ActivIdentity\ActivClient\acerrmes.dll
c:\program files\ActivIdentity\ActivClient\aiwinext.dll
c:\program files\ActivIdentity\ActivClient\aspcom.dll
c:\program files\ActivIdentity\ActivClient\aicext.dll
c:\program files\ActivIdentity\ActivClient\Resources\acerrmrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\asphatrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\aipinguirc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIlrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\acunlockrc.dll

- - - - - - - > 'lsass.exe'(980)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(1376)
c:\windows\system32\guard32.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-21 15:34:49
ComboFix-quarantined-files.txt 2011-01-21 14:34

Pre-Run: Volných bajtů: 11 651 608 576
Post-Run: Volných bajtů: 11 675 770 880

- - End Of File - - 157A8BB0452A366CA9AF26DB6F7780F4
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#4 Příspěvek od Kovas »

P.S.: Keď som sa dnes vrátil domov na víkend zistil som, že mám problém aj so stolovým PC. Začne sa načítavať Windows,
ale počas štartu sa reštartuje a tak to robí dokola. Samozrejme vinník sa mi nepriznal, ako sa to stalo a čo robil. Skúsil som
to cez konzolu obnovy, ale vyhodilo mi modrú obrazovku. Nejde to ani cez núdzoví režim. Vyskúšam nejaké záchranné boot
DVD z CHIPU, niečo pozriem na fóre a uvidím. Ak sa mi nepodarí pomôžete mi s tým??? :)
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#5 Příspěvek od motji »

To první pc je po combofixu ok? Nebo stále stejný problém?

S tím druhým pc - co to máte za operační systém? Máte k němu inst. cd? Máte tam nějaká důležitá data?
A přiznal se viník, co s tím dělal? Stahoval nějaký crack, nebo instaloval program, to je celkem důležité, abychom věděli, zda to může být virem nebo konfliktem programů
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#6 Příspěvek od Kovas »

Notebook je po Combofixu v poriadku. Beží ako pred tým. Combofix mám odinštalovať?

K tomu stolnému PC som zistil, že v stredu sa pokúšali do neho inštalovať certifikáty daňového úradu pre správne fungovanie elektronických služieb (vypĺňanie a odosielanie formulárov). Niekedy sa na ňom robia veci, ktoré sa nestihnú v práci. Ako mi bolo povedané nakoniec sa to nepodarilo spojazdniť. Nainštalovali to na notebooku. Potom vlastne zistili, že jednotlivé certifikáty boli inštalované do nesprávnych položiek. Neviem, či by to malo na to vplyv, ale údajne vo štvrtok, keď chceli zapnúť PC už pri načítaní Windows sa reštartoval.

Skúsil z CHIPU jedno boot dvd a v pohode ho načítalo a spustilo. Takže si myslím, že hardwar je OK. Mal som podozrenie na vadnú RAM.

Skúsim ešte inštalačné cd a spustím opravu systému.

Sám vedieť, ako to dopadne.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#7 Příspěvek od motji »

Dobře, pak se s tím druhým pc ozvěte.

Já Vám ještě v combofixu něco domažu nějaké zbytečnosti



:arrow: Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Reglock::
[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d9,09,6a,f8,b5,6b,52,4b,8a,a7,83,\

Regnull::
[HKEY_USERS\S-1-5-21-220523388-117609710-682003330-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DC9F0E17-DF2C-2024-93FC-FE478F6FE0F2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"panpgmpdfgiepnfalhkhkpkaggkbibab"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c
"palpojogakigodkmnjjffbgoglbgiiif"=hex:61,62,69,6f,65,66,63,6e,68,62,63,68,62,
63,61,68,69,6b,6a,63,62,70,65,68,61,6e,66,61,6e,68,67,6d,66,6d,00,7c
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek


-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#8 Příspěvek od Kovas »

No takže potom čo som vložil inštalačné cd nedalo mi to možnosť opraviť inštaláciu systému,
bola len možnosť opraviť windows cez konzolu pre zotavenie a možnosť vykonať novú inštaláciu. No, ale keď spustím Konzolu pre zotavenie objaví sa mi modrá obrazovka s oznámením unmountable_boot_volume

Takže tu moje praktické vedomosti končia :(

Zaujímavé je, že pri štarte Windows sa aj objaví ikona znázorňujúca načítanie systému, ale potom po čase sa PC reštartuje.

Neviete mi s tým poradiť?
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#9 Příspěvek od motji »

Takže konzole nefunguje?
Tak to je zlé, našla jsem totiž tento návod a k němu konzoli potřebujeme :(
http://translate.googleusercontent.com/ ... csrHXMt8Jg

Co to máte za systém?
Máte tam soubory, které potřebujete vytáhnout z disku, než by jste disk třeba zformátoval?
Máte k dispozici druhý pc se stejným systémem?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#10 Příspěvek od Kovas »

Tu prikladám log z Combofixu

ComboFix 11-01-20.03 - Administrator . 01. 2011 21:38:38.8.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1976.1474 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Files Created from 2010-12-21 to 2011-01-21 )))))))))))))))))))))))))))))))
.

2011-01-21 12:36 . 2011-01-21 12:36 -------- d-----w- C:\rsit
2011-01-21 08:26 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-21 08:26 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-21 08:26 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-21 08:26 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-21 08:26 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-21 08:26 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-21 08:26 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-21 08:25 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-21 07:55 . 2011-01-21 07:55 -------- d-----w- c:\windows\system32\wbem\Repository
2011-01-13 18:07 . 2005-06-02 11:40 14336 ----a-w- c:\windows\system32\vsmon1.dll
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF
2011-01-13 18:07 . 2011-01-13 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eXPert PDF Jobs
2011-01-13 17:54 . 2011-01-13 17:54 -------- d-----w- c:\windows\My Documents
2011-01-13 15:36 . 2011-01-13 15:42 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-01-13 15:35 . 2011-01-13 15:35 -------- d-----w- c:\program files\Avanquest update
2011-01-12 10:56 . 2011-01-12 10:56 -------- d-----w- c:\program files\MSECache
2010-12-28 11:47 . 2010-12-28 14:04 -------- d-----w- C:\VritualRoot
2010-12-25 15:43 . 2011-01-09 16:12 -------- d-----w- c:\program files\AVS4YOU
2010-12-25 15:42 . 2010-09-03 12:32 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2010-12-25 15:42 . 2010-09-03 12:32 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2010-12-25 00:52 . 2010-12-25 18:53 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVS4YOU
2010-12-25 00:51 . 2010-12-25 15:43 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-12-25 00:50 . 2008-08-13 10:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-12-25 00:50 . 2010-12-25 00:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2010-12-25 00:50 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-12-24 23:36 . 2011-01-16 23:43 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\avidemux

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-10-05 20:03 38848 ----a-w- c:\windows\avastSS.scr
2011-01-11 17:57 . 2010-06-01 18:00 285480 ----a-w- c:\windows\system32\guard32.dll
2011-01-11 17:57 . 2010-06-01 18:00 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-11 17:57 . 2010-06-01 18:00 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-11 17:57 . 2010-06-01 18:00 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-01-11 17:57 . 2010-06-04 10:55 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-11-18 18:15 . 2009-08-28 12:44 81920 ------w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-17 13:49 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:23 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:23 . 2004-08-17 13:49 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-06 00:23 . 2004-08-17 13:49 43520 ------w- c:\windows\system32\licmgr10.dll
2010-11-03 12:25 . 2004-08-17 13:44 385024 ------w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2001-10-25 12:00 40960 ------w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:09 . 2004-08-17 13:48 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:58 . 2004-08-17 13:44 1853312 ------w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((( SnapShot@2011-01-21_14.33.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-21 18:44 . 2011-01-21 18:44 16384 c:\windows\temp\Perflib_Perfdata_c1c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-13 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-13 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-13 142360]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"acevents"="c:\program files\ActivIdentity\ActivClient\acevents.exe" [2009-06-03 153640]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2009-06-03 400936]
"vspdfprsrv.exe"="d:\programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe" [2007-07-02 1179648]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-3-31 576104]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\programy\SuperAntispyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- d:\programy\SuperAntispyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2009-06-03 14:14 113152 ----a-w- c:\program files\ActivIdentity\ActivClient\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2009-06-03 14:13 299520 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\j:\0autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"=d:\programy\Winamp\winampa.exe
"Malwarebytes Anti-Malware (reboot)"="d:\programy\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"RemoteControl"=d:\programy\CyberLink\PowerDVD\PDVDServ.exe
"USBToolTip"=c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
"OODefragTray"=c:\windows\system32\oodtray.exe
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" -h

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"d:\\Programy\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"d:\\Programy\\totalcmd\\TOTALCMD.EXE"=
"d:\\Programy\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Programy\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [27. 12. 2009 21:35 38448]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28. 3. 2008 13:14 24064]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [4. 9. 2009 23:10 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [4. 9. 2009 23:10 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [21. 1. 2011 9:26 294608]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [4. 6. 2010 11:55 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1. 6. 2010 19:00 27576]
R1 SASDIFSV;SASDIFSV;d:\programy\SuperAntispyware\sasdifsv.sys [17. 2. 2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;d:\programy\SuperAntispyware\SASKUTIL.SYS [10. 5. 2010 19:41 67656]
R2 ac.sharedstore;ActivIdentity Shared Store Service;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe [3. 6. 2009 15:16 207400]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21. 1. 2011 9:26 17744]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [29. 8. 2009 9:35 482176]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23. 7. 2008 10:31 44800]
S1 SABKUTIL;SABKUTIL;\??\d:\programy\SuperAntispyware\SABKUTIL.sys --> d:\programy\SuperAntispyware\SABKUTIL.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12. 1. 2010 23:44 135664]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [20. 7. 2010 15:28 27064]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2011-01-21 c:\windows\Tasks\1-Click Maintenance.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-12 22:44]

2011-01-21 c:\windows\Tasks\Úklid 1 kliknutím.job
- d:\programy\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\myd1jj65.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.sk
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\programy\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - d:\programy\Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ImTranslator: {9AA46F4F-4DC7-4c06-97AF-5035170634FE} - %profile%\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
FF - Ext: Super Hide IP: support@super-hide-ip.com - %profile%\extensions\support@super-hide-ip.com
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: CsFire: csfire@cs.kuleuven.be - %profile%\extensions\csfire@cs.kuleuven.be
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\Google\Google Gears\Firefox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-21 21:48
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="11AA12E2A3A41484F58FFB46DD07F95E2F5CDD4294302AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA6171C11EC38DE3DA9C6AECB7A5D14077DFE8CFAC74074818B9AEB344F5E8E2F934B99265462E69EEE823C73A72416A543E5A843613B49E69AF6F40A0307A24316051C1D348E199BAC72AEA384ACFDDD74491743C30D81E7879F693768F6CDB96FCD481A05E9B3F0226F581A528CE19E153A3EEA3F65B16457A3B6909F6A02E4425235F4D9DD1F87B7E39757B477C186ED02677D2AE3944D5448303ECE10D0ADFB745E5C4846E8DB176E30AE5398C3C50B1D40135B2107298B860CBE9F8B6F0DC8CAA1526AF1BD7E3162CCC3D80B30A13C395896AF260D13CC89E3613FF2BB149A9C442CE1A674133746F715F7E1F37495B9A64888EFC9B7AEB3B74B61D133E5296A6D144D9B045122D2236F6121202B6F3785BC49F1895B091767F53827F8B86EE2288657FB86872C78A275CDC0E8C566FCAFDA5D1139D27A7EBBAD00E45359276D63D6A669BE93D4582E1E7830285A5A89495F2E29EA0962655D1376742EA5D622742A6D760F6B5FC962B4A24DD914EE92D5582E8653FBE7FCDC9ADC2E979143CF8F7A5CAC0095D1D7C0D78D6F9F2D8D7DBFAAD16B4EBD7329AA8D7663C3A4F47752952A07BCB078402C7A03DFBDF760E6530E120FD875B1021E09115587F83DCEBB9C9375956BE1F56D62CCDA9EDA591E438EE919955C13D570FC773CDEBFABBFAF07D3DBFD0B629EB1ABBB904D4D2B27240C5C2AC8C14F23412F7CC269BA18E5F39CAF138EE60F95884423A6FADE4F39EF396C535D87DC9F13377487E8C11B1536FBEDE682EAC4E9E66FDA377E2F01BE839FA29A61A3FAB2CC82B91E45BF93D20416D8183B19235CA4C33E4ECE724158A0198D790620A97A37D1AB8D87B4A456D1B2BE58BA040BE4FE2B2E6C08F4D3D96D56BADDA29C2DC6013A2AD06133330FF6E9F1D1AA5626AD95E60C08ED91C04A715AC2ABAFC9909BBC241A562363E89D2EA94AA0D4495D956D07C088633B54E51BFE3AB64CEEA0B261CCE682C5FE35D816B422D22BAE61AE6E73B8CC70F51E1ABBEDC0C938666D77C944FDAAE2D6CA49B420576EBF6A253FE3666224C4DB730D89A8F5A3DB9C4D8BB26FCF9A3ACD9D2C6F564DE94CF55FC280EF3254AF98EA159C01FD754017584140875211ADD9E8F292936AB3AB5B8AE5D7719F9626EF62BC739F02651269ECA3771901424509AC44CCEA19295DBC678EE2A2A598C03579C5EE01AF0D253FAA6EC38456D3AA7727F833C1489F864E784F7C0E44F93D5213A2D3F3B5FB6E56F711737FD762ADDA621FBA526A5F6ED7847565927FCF7C455879CC9D4AB20800FDB13812087A4179A6F7BFAA77A380B517"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\guard32.dll
d:\programy\SuperAntispyware\SASWINLO.DLL
c:\program files\ActivIdentity\ActivClient\ackpbsc.dll
c:\program files\ActivIdentity\ActivClient\aclog.dll
c:\program files\ActivIdentity\ActivClient\accrypto.dll
c:\program files\ActivIdentity\ActivClient\ACLIBEAY.dll
c:\program files\ActivIdentity\ActivClient\acunlock.dll
c:\program files\ActivIdentity\ActivClient\aipingui.dll
c:\program files\ActivIdentity\ActivClient\acevtsub.dll
c:\program files\ActivIdentity\ActivClient\asphat32.dll
c:\program files\ActivIdentity\ActivClient\acerrmes.dll
c:\program files\ActivIdentity\ActivClient\aiwinext.dll
c:\program files\ActivIdentity\ActivClient\aspcom.dll
c:\program files\ActivIdentity\ActivClient\aicext.dll
c:\program files\ActivIdentity\ActivClient\Resources\acerrmrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\asphatrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\aipinguirc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIlrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\acunlockrc.dll

- - - - - - - > 'lsass.exe'(984)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(548)
c:\windows\system32\guard32.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-21 21:50:27
ComboFix-quarantined-files.txt 2011-01-21 20:50
ComboFix2.txt 2011-01-21 14:34

Pre-Run: Volných bajtů: 11 695 955 968
Post-Run: Volných bajtů: 11 668 127 744

- - End Of File - - 21DA66FEA836607DFC763BA508BDC082


V tom PC mám Windows XP Prof. Je tam Serveci pack 3. HD mám rozdelený na C a D. Na "C-éčku" mám nainštalovaný systém. Data mám na "D-éčku" Taktiež som aj programy na tom PC išntaloval na D

Na tomto notebooku mám tiež Windows XP Prof, Service pack3.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#11 Příspěvek od motji »

A zvládl by jste přeinstalovat systém, aniž by jste třeba omylem zrušil oddíl s daty?
Nebo se pokusíme o opravu systému?



:arrow: Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


:arrow: Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



:arrow: Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

:arrow: Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#12 Příspěvek od Kovas »

Predpokladám, že najlepšie by bola preinštalácia.

Bol by ale veľký problém skúsiť opravu systému?
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#13 Příspěvek od motji »

Pro mě ne :D .

Návod od tempesta
Tento krok proveď na PC s vypalovačkou, do které vlož prázdné CD vhodné k zápisu:

Stáhni si MSDaRT pro svůj příslušný operační systém:

Windows XP -> http://www.mediafire.com/?ddsfd2xdndw
Windows Vista -> http://www.mediafire.com/?knvmygelfxy
Windows 7 -> http://www.mediafire.com/?5qmmdkzjeg3

Nainstaluj program dle pokynů staženého instalátoru.
Po dokončení instalace spusť tento soubor: C:\Program Files\Microsoft Diagnostics and Recovery Toolset\ERDC.exe
Klikej postupně na tlačítko Next, nech vytvořit .iso soubor a pomocí průvodce ho vypal na CD.

2) Restartuj počítač, na kterém máš problémy a vlož do jeho mechaniky vypálené CD. Předtím, než se Windows načtou, mačkej libovolnou klávesu a počítač začne bootovat z CD.
Po nabootování jdi přes menu Start - System Tools - System Files Repair.
Spustí se průvodce, který vyhledá virem narušené / poškozené systémové soubory. Všechny soubory, které najde, nech opravit.

Jdi přes menu Start - Log Off - Restart - OK a tvůj počítač se restartuje.

3) Po restartu počítače jdi v OS přes menu Start - Nastavení - Ovládací panely - Přidat nebo odebrat programy - vyber: Microsoft Diagnostics and Recovery Toolset - klikni na Odebrat. Tohle MSDaRT zase odinstaluje.

Napiš výsledky. Po provedení těchto kroků vlož nový log z ComboFixu.

A pak dejte vědět, zda to pomohlo.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Kovas
Návštěvník
Návštěvník
Příspěvky: 331
Registrován: 24 pro 2008 13:10

Re: Log pre motji

#14 Příspěvek od Kovas »

Log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-01-21 22:39:28
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 14 GB (46%) free of 30 GB
Total RAM: 1976 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:39:39, on 21. 1. 2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\WINDOWS\system32\oodag.exe
D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Programy\totalcmd\TOTALCMD.EXE
D:\Instal\RSIT\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=;ftp=;https=;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [acevents] "C:\Program Files\ActivIdentity\ActivClient\acevents.exe"
O4 - HKLM\..\Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: Nastavení aplikace &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1542008234
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Programy\SuperAntispyware\SASWINLO.DLL
O20 - Winlogon Notify: ackpbsc - C:\Program Files\ActivIdentity\ActivClient\ackpbsc.dll
O20 - Winlogon Notify: acunlock - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ActivIdentity Shared Store Service (ac.sharedstore) - ActivIdentity - C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 7980 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-02 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll [2010-02-23 2121728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-11-02 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-04-04 1044480]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-03-13 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-03-13 173592]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-03-13 142360]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032]
"acevents"=C:\Program Files\ActivIdentity\ActivClient\acevents.exe [2009-06-03 153640]
"accrdsub"=C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [2009-06-03 400936]
"vspdfprsrv.exe"=D:\Programy\Visagesoft\eXPert PDF 5\vspdfprsrv.exe [2007-07-02 1179648]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
D:\Programy\SuperAntispyware\SASWINLO.DLL [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ackpbsc]
C:\Program Files\ActivIdentity\ActivClient\ackpbsc.dll [2009-06-03 113152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acunlock]
C:\Program Files\ActivIdentity\ActivClient\acunlock.dll [2009-06-03 299520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-03-09 205824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=D:\Programy\SuperAntispyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\Programy\Pinnacle\Studio 14\Programs\RM.exe"="D:\Programy\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager"
"D:\Programy\Pinnacle\Studio 14\Programs\Studio.exe"="D:\Programy\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio"
"D:\Programy\Pinnacle\Studio 14\Programs\umi.exe"="D:\Programy\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi"
"D:\Programy\totalcmd\TOTALCMD.EXE"="D:\Programy\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\Programy\Skype\Plugin Manager\skypePM.exe"="D:\Programy\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Programy\Skype\Phone\Skype.exe"="D:\Programy\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-01-21 22:39:28 ----D---- C:\rsit
2011-01-21 22:28:13 ----SHD---- C:\RECYCLER
2011-01-21 09:26:13 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-01-21 09:26:12 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-01-21 09:26:11 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-01-21 09:26:10 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-01-21 09:26:09 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-01-21 09:26:09 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-01-21 09:26:08 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-01-21 09:25:55 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-01-14 20:50:38 ----A---- C:\Documents and Settings\All Users\Data aplikací\__wdump.txt
2011-01-13 19:07:20 ----A---- C:\WINDOWS\system32\vsmon1.dll
2011-01-13 19:07:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF Jobs
2011-01-13 19:07:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF
2011-01-13 18:54:41 ----D---- C:\WINDOWS\My Documents
2011-01-13 16:36:50 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-01-13 16:35:43 ----D---- C:\Program Files\Avanquest update
2011-01-12 11:56:31 ----D---- C:\Program Files\MSECache
2011-01-12 10:52:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2010-12-28 12:47:07 ----D---- C:\VritualRoot
2010-12-25 16:43:07 ----D---- C:\Program Files\AVS4YOU
2010-12-25 16:42:42 ----A---- C:\WINDOWS\system32\libmfxsw32.dll
2010-12-25 16:42:41 ----A---- C:\WINDOWS\system32\libmfxhw32.dll
2010-12-25 01:52:01 ----D---- C:\Documents and Settings\Administrator\Data aplikací\AVS4YOU
2010-12-25 01:51:04 ----D---- C:\Program Files\Common Files\AVSMedia
2010-12-25 01:50:29 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2010-12-25 01:50:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVS4YOU
2010-12-25 01:50:28 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-12-25 00:36:43 ----D---- C:\Documents and Settings\Administrator\Data aplikací\avidemux

======List of files/folders modified in the last 1 months======

2011-01-21 22:39:39 ----D---- C:\Program Files\trend micro
2011-01-21 22:39:37 ----D---- C:\WINDOWS\Prefetch
2011-01-21 22:39:27 ----D---- C:\WINDOWS\temp
2011-01-21 22:39:18 ----A---- C:\WINDOWS\wincmd.ini
2011-01-21 22:38:48 ----D---- C:\WINDOWS
2011-01-21 22:38:24 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-21 22:37:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-21 22:28:13 ----D---- C:\WINDOWS\Minidump
2011-01-21 22:28:13 ----D---- C:\WINDOWS\Debug
2011-01-21 22:28:13 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Media Player Classic
2011-01-21 22:08:37 ----SHD---- C:\System Volume Information
2011-01-21 22:08:37 ----D---- C:\WINDOWS\system32\Restore
2011-01-21 21:49:04 ----A---- C:\WINDOWS\system.ini
2011-01-21 21:46:10 ----D---- C:\WINDOWS\system32\drivers
2011-01-21 21:46:10 ----D---- C:\WINDOWS\system32
2011-01-21 21:46:10 ----D---- C:\WINDOWS\AppPatch
2011-01-21 21:46:07 ----D---- C:\Program Files\Common Files
2011-01-21 09:26:04 ----SHD---- C:\WINDOWS\Installer
2011-01-21 09:26:04 ----D---- C:\WINDOWS\WinSxS
2011-01-21 09:25:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-01-21 09:25:49 ----D---- C:\Program Files\Alwil Software
2011-01-21 09:19:02 ----HD---- C:\WINDOWS\inf
2011-01-21 08:55:42 ----D---- C:\WINDOWS\system32\config
2011-01-21 08:55:31 ----D---- C:\WINDOWS\system32\wbem
2011-01-21 08:55:30 ----D---- C:\WINDOWS\Registration
2011-01-20 23:47:05 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-01-20 22:54:00 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2011-01-17 23:32:20 ----A---- C:\WINDOWS\VPlayer.INI
2011-01-17 23:31:19 ----A---- C:\WINDOWS\NeroDigital.ini
2011-01-14 23:53:30 ----A---- C:\WINDOWS\wcx_ftp.ini
2011-01-14 20:52:22 ----A---- C:\WINDOWS\win.ini
2011-01-14 09:39:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\BVRP Software
2011-01-14 09:39:54 ----RD---- C:\Program Files
2011-01-13 19:10:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\eXPert PDF 5
2011-01-13 19:05:47 ----HD---- C:\Program Files\InstallShield Installation Information
2011-01-12 11:57:48 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2011-01-12 11:56:47 ----RSD---- C:\WINDOWS\Fonts
2011-01-12 11:56:44 ----D---- C:\Program Files\Microsoft Office
2011-01-12 11:56:43 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-01-12 10:52:48 ----A---- C:\WINDOWS\system32\MRT.exe
2011-01-12 10:52:41 ----DC---- C:\WINDOWS\system32\dllcache
2011-01-12 10:49:46 ----HD---- C:\WINDOWS\$hf_mig$
2011-01-11 19:19:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\COMODO
2011-01-11 18:57:28 ----A---- C:\WINDOWS\system32\guard32.dll
2010-12-29 21:29:03 ----D---- C:\WINDOWS\system32\oodag

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hotcore3;hotcore3; C:\WINDOWS\system32\drivers\hotcore3.sys [2007-05-04 38448]
R0 hpdskflt;HP Disk Filter Driver; C:\WINDOWS\system32\DRIVERS\hpdskflt.sys [2006-10-17 17920]
R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2011-01-11 94784]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-08-25 36528]
R0 SFAUDIO;Sonic Focus DSP Driver; C:\WINDOWS\system32\drivers\sfaudio.sys [2008-03-28 24064]
R0 Vax347b;Vax347b; C:\WINDOWS\system32\DRIVERS\Vax347b.sys [2005-04-25 159616]
R0 Vax347s;Vax347s; C:\WINDOWS\System32\Drivers\Vax347s.sys [2004-04-30 5248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-01-13 29392]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-01-13 23632]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-01-13 294608]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-01-13 47440]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2011-01-11 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2011-01-11 27576]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SASDIFSV;SASDIFSV; \??\D:\Programy\SuperAntispyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\D:\Programy\SuperAntispyware\SASKUTIL.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-01-13 100176]
R3 Accelerometer;Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [2006-10-17 22016]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-04-11 338944]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-07-13 94976]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2008-11-21 1204128]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver; C:\WINDOWS\System32\Drivers\ATSwpWDF.sys [2009-07-29 482176]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-04-03 37424]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-04-03 879624]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2008-04-28 9344]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-03-09 6278016]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2008-07-23 44800]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NETw5x32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2009-11-16 4221952]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S1 SABKUTIL;SABKUTIL; \??\D:\Programy\SuperAntispyware\SABKUTIL.sys []
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 b57w2k;BCM5701 Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2001-10-24 97120]
S3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2008-04-03 539512]
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-04-03 156392]
S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-04-03 55352]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-04-03 74688]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\NSNDIS5.SYS []
S3 Revoflt;Revoflt; C:\WINDOWS\system32\DRIVERS\revoflt.sys [2009-12-30 27064]
S3 Ser2pl;Prolific2 Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2005-07-25 48640]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ac.sharedstore;ActivIdentity Shared Store Service; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [2009-06-03 207400]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [2008-08-26 14336]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-03-31 264800]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-01-21 1803224]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-02 153376]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2009-02-25 1352960]
R2 StarWindService;StarWind iSCSI Service; D:\Programy\Alkohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2010-04-02 603904]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-12 135664]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2010-04-02 360192]

-----------------EOF-----------------
Idem sa pustiť do opravy sytému
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Log pre motji

#15 Příspěvek od motji »

Když tak si ve službách ještě vypněte
TuneUp Program Statistics Service

Popřemýšlejte nad firewallem, ten ve windows není nic moc. :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Zpět na „Preventivní kontroly logů“