Nefunguji centrum zabezpečení a windows miniapp grafika

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
honza.kl
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 30 Led 2011 14:03

Nefunguji centrum zabezpečení a windows miniapp grafika

#1 Příspěvek od honza.kl »

pro Motji:
Dobrý den,
prosím poraďte nefunguje centrum zapezpečení a grafika ve windows mini app, a pár dlaších věcí jako windows update atd.
Presne jako na http://forums.cnet.com/7723-6142_102-51 ... Id=5054424
Děkuji


Logfile of random's system information tool 1.08 (written by random/random)
Run by jank at 2011-01-30 15:28:18
Microsoft Windows 7 Ultimate
System drive C: has 59 GB (25%) free of 238 GB
Total RAM: 3582 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:28:43, on 30.1.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\OEM04Mon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\LANDesk\LDClient\WebPortal\SDClientMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Users\jank\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Totalcmd\TOTALCMD.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Users\jank\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DFA07EFD\RSIT[1].exe
C:\Program Files\trend micro\jank.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\ProgramData\LangSoft\WebIE.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\jank\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\ProgramData\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [IntelAPMClient] "C:\Program Files\LANDesk\LDClient\amclient.exe" /apm /s /ro /Retry=2 /Tspan=60 /Rstart
O4 - HKLM\..\Run: [LANDeskCustomData] "C:\Program Files\LANDesk\LDClient\ldcstm32.exe" /s
O4 - HKLM\..\Run: [SDClientMonitor] "C:\Program Files\LANDesk\LDClient\webportal\sdclientmonitor.exe"
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [MSTEE.CxTransform] "C:\Program Files\LANDesk\LDClient\softmon.exe" /r rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\INF\ksfilter.inf,MSTEE.Interface.Install
O4 - HKLM\..\RunOnce: [MSTEE.Splitter] "C:\Program Files\LANDesk\LDClient\softmon.exe" /r rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\INF\ksfilter.inf,MSTEE.Interface.Install
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Google Update] "C:\Users\jank\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: zakaz_sdileni_disku.bat
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {00000000-0000-0000-0000-123456789012} - https://bezpecne.podani.gov.cz/ClientOb ... T35x86.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = office.netcentrum.cz
O17 - HKLM\Software\..\Telephony: DomainName = office.netcentrum.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = office.netcentrum.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = office.netcentrum.cz
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: x-owacid2 - {5B290518-830E-4C57-A66B-E4F748900C27} - C:\Program Files\Microsoft\SMIME Client (2010)\mimectl.dll
O23 - Service: LANDesk(R) Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FortiClient SSL VPN (FortiSslvpnDaemon) - Fortinet Inc. - C:\Windows\system32\FortiSSLVPNdaemon.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel Alert Handler - LANDesk Software Ltd. - C:\Windows\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\LocalSch.EXE
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\Windows\system32\cba\pds.exe
O23 - Service: LANDesk Targeted Multicast (Intel Targeted Multicast) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\tmcsvc.exe
O23 - Service: LANDesk Remote Control Service (ISSUSER) - LANDesk Software, Ltd. - C:\PROGRA~1\LANDesk\LDClient\issuser.exe
O23 - Service: LANDesk(R) Extended device discovery service (LDXDD) - Unknown owner - C:\Program Files\LANDesk\LDClient\xddclient.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: LANDesk(R) Software Monitoring Service (Softmon) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\softmon.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC4.exe
O23 - Service: SAMSUNG WiselinkPro Service (WiselinkPro) - Unknown owner - C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe

--
End of file - 12811 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948UA.job
C:\Windows\tasks\Moje uloha.job
C:\Windows\tasks\ZNRF.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\ProgramData\LangSoft\WebIE.dll [2009-11-08 520192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2010-12-08 3123072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2010-12-08 3123072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\jank\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\ProgramData\LangSoft\WebIE.dll [2009-11-08 520192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"OEM04Mon.exe"=C:\Windows\OEM04Mon.exe [2007-06-11 36864]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-10-26 1029416]
"DELL Webcam Manager"=C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [2007-07-27 118784]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe []
"IntelAPMClient"=C:\Program Files\LANDesk\LDClient\amclient.exe [2007-08-07 331776]
"LANDeskCustomData"=C:\Program Files\LANDesk\LDClient\ldcstm32.exe [2006-12-27 229376]
"SDClientMonitor"=C:\Program Files\LANDesk\LDClient\webportal\sdclientmonitor.exe [2006-11-01 258048]
"PSQLLauncher"=C:\Program Files\Fingerprint Reader Suite\launcher.exe [2007-04-16 49168]
"NWEReboot"= []
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NVHotkey"=C:\Windows\system32\nvHotkey.dll [2010-03-16 88168]
"BlackBerryAutoUpdate"=C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [2010-03-10 648536]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"SigmatelSysTrayApp"=C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2007-09-13 405504]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-11-18 2219184]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-12-09 1226608]
"DivX Download Manager"=C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe [2010-12-08 63360]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-11-29 421888]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"MSTEE.CxTransform"=C:\Program Files\LANDesk\LDClient\softmon.exe [2007-07-26 266240]
"MSTEE.Splitter"=C:\Program Files\LANDesk\LDClient\softmon.exe [2007-07-26 266240]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-12-20 443728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WEBTRAN"= []
"Google Update"=C:\Users\jank\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-03 135664]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2011-01-13 2424560]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe

C:\Users\jank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
zakaz_sdileni_disku.bat

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\Windows\system32\psqlpwd.dll [2007-04-16 86528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
psqlpwd

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=Vítej Honzíku
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableCAD"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-01-30 15:12:40 ----D---- C:\rsit
2011-01-30 15:06:08 ----D---- C:\Program Files\Trend Micro
2011-01-30 14:52:33 ----D---- C:\Users\jank\AppData\Roaming\SUPERAntiSpyware.com
2011-01-30 14:52:33 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2011-01-30 14:52:22 ----D---- C:\Program Files\SUPERAntiSpyware
2011-01-30 13:54:42 ----D---- C:\Users\jank\AppData\Roaming\Malwarebytes
2011-01-30 13:54:33 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2011-01-30 13:54:32 ----D---- C:\ProgramData\Malwarebytes
2011-01-30 13:54:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-01-30 13:54:29 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-01-30 13:47:33 ----A---- C:\Windows\system32\WOEM_3_2awoem.tmp
2011-01-30 10:19:28 ----D---- C:\Program Files\AutoDWG
2011-01-29 20:07:46 ----RASH---- C:\Windows\system32\DHCPQEC2.dll
2011-01-28 10:29:28 ----A---- C:\FilterPack64bit.exe
2011-01-27 15:47:50 ----A---- C:\exchange_2010_key_zdenek_test.txt
2011-01-27 15:45:09 ----D---- C:\Exchange 2010 na R2
2011-01-27 15:32:56 ----A---- C:\tcmd756a.exe
2011-01-27 14:12:45 ----D---- C:\27-01-2011- ExportDB
2011-01-27 11:39:45 ----D---- C:\Hermes chyba ntfs
2011-01-27 10:03:23 ----A---- C:\vyhledaní emailu podle casu odeslani.txt
2011-01-25 18:03:20 ----D---- C:\Users\jank\AppData\Roaming\RDP6
2011-01-25 18:02:49 ----D---- C:\Alternativa pro NOS
2011-01-24 20:45:58 ----D---- C:\AAAAA
2011-01-24 20:45:41 ----A---- C:\test eseutil.txt
2011-01-24 19:57:47 ----D---- C:\_A_Hermes_Databaze15
2011-01-24 12:05:53 ----D---- C:\Program Files\QuickTime
2011-01-24 12:01:19 ----D---- C:\Hermes_Bluescreen_01_2011
2011-01-20 19:35:02 ----D---- C:\Analýza Hlavičky Emailu
2011-01-20 15:41:02 ----D---- C:\_Certifikat
2011-01-19 16:54:48 ----D---- C:\_H
2011-01-19 16:06:37 ----A---- C:\Recieve Connector - dotaz.txt
2011-01-18 12:05:37 ----D---- C:\KS Program
2011-01-12 18:59:20 ----A---- C:\Windows\system32\BASSMOD.dll
2011-01-12 11:42:27 ----A---- C:\Windows\system32\odbc32.dll
2011-01-12 11:42:18 ----A---- C:\Windows\system32\ntdll.dll
2011-01-12 11:41:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-01-12 11:41:32 ----A---- C:\Windows\system32\cdd.dll
2011-01-12 11:41:31 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-01-12 11:41:31 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-01-12 11:41:31 ----A---- C:\Windows\system32\mf.dll
2011-01-12 11:41:31 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-01-12 11:41:31 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-01-12 11:41:31 ----A---- C:\Windows\system32\d3d10_1.dll
2011-01-12 11:41:31 ----A---- C:\Windows\system32\d2d1.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\XpsPrint.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\FntCache.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\DWrite.dll
2011-01-12 11:41:30 ----A---- C:\Windows\system32\d3d10warp.dll
2011-01-10 17:50:58 ----D---- C:\Backup
2011-01-10 15:26:47 ----D---- C:\_G
2011-01-07 13:33:47 ----D---- C:\Windows\system32\Adobe
2011-01-06 15:07:56 ----D---- C:\Program Files\KS Program
2011-01-03 16:00:15 ----D---- C:\Z_NOD32
2011-01-02 20:56:23 ----D---- C:\Users\jank\AppData\Roaming\GARMIN
2011-01-02 20:56:23 ----D---- C:\ProgramData\GARMIN
2011-01-02 20:55:56 ----D---- C:\Program Files\Garmin
2011-01-02 20:50:51 ----HD---- C:\Garmin

======List of files/folders modified in the last 1 months======

2011-01-30 15:28:43 ----D---- C:\Windows\Temp
2011-01-30 15:06:09 ----SHD---- C:\Windows\Installer
2011-01-30 15:06:08 ----RD---- C:\Program Files
2011-01-30 15:05:54 ----SHD---- C:\System Volume Information
2011-01-30 14:52:33 ----HD---- C:\ProgramData
2011-01-30 14:47:01 ----D---- C:\Windows\system32\config
2011-01-30 14:42:56 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-01-30 14:42:33 ----D---- C:\Windows\tracing
2011-01-30 14:42:21 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-01-30 14:27:10 ----D---- C:\Windows
2011-01-30 14:27:10 ----A---- C:\Windows\TRNCOM.INI
2011-01-30 13:54:43 ----D---- C:\Windows\System32
2011-01-30 13:54:43 ----D---- C:\Windows\inf
2011-01-30 13:54:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-01-30 13:54:33 ----D---- C:\Windows\system32\drivers
2011-01-30 13:48:30 ----D---- C:\Windows\system32\inetsrv
2011-01-30 13:46:52 ----D---- C:\ProgramData\vulScan
2011-01-30 13:46:46 ----D---- C:\Users\jank\AppData\Roaming\WTablet
2011-01-30 13:46:42 ----D---- C:\ProgramData\NVIDIA
2011-01-30 13:45:12 ----D---- C:\Windows\system32\Tasks
2011-01-30 13:45:07 ----D---- C:\Windows\Tasks
2011-01-30 13:20:43 ----D---- C:\Users\jank\AppData\Roaming\Skype
2011-01-30 13:12:04 ----D---- C:\Program Files\Common Files\InstallShield
2011-01-30 12:20:21 ----HD---- C:\Program Files\InstallShield Installation Information
2011-01-30 10:19:00 ----D---- C:\Windows\Prefetch
2011-01-30 08:03:03 ----D---- C:\Users\jank\AppData\Roaming\skypePM
2011-01-29 19:42:41 ----D---- C:\Program Files\JDownloader
2011-01-28 11:19:30 ----D---- C:\Windows\system32\NDF
2011-01-27 08:55:38 ----D---- C:\A - office
2011-01-26 15:44:31 ----D---- C:\Users\jank\AppData\Roaming\SAP
2011-01-25 10:17:35 ----D---- C:\Karat
2011-01-24 16:28:01 ----D---- C:\Program Files\Debugging Tools for Windows (x86)
2011-01-24 10:00:04 ----D---- C:\DRIVERY
2011-01-23 17:22:41 ----D---- C:\Video
2011-01-23 17:19:59 ----D---- C:\DLNA
2011-01-23 15:34:43 ----D---- C:\Program Files\Safari
2011-01-19 13:44:31 ----D---- C:\Users\jank\AppData\Roaming\WMICodeCreator
2011-01-18 11:07:58 ----D---- C:\Exchange 2003 - 2010 - postup migrace krok za krokem !!!
2011-01-17 16:45:43 ----D---- C:\Nos
2011-01-13 15:09:20 ----D---- C:\Mp3
2011-01-12 17:30:26 ----D---- C:\Soukromé
2011-01-12 11:48:22 ----D---- C:\Windows\winsxs
2011-01-12 11:42:53 ----A---- C:\Windows\system32\MRT.exe
2011-01-12 11:42:47 ----D---- C:\Windows\system32\catroot
2011-01-12 11:42:36 ----D---- C:\Windows\system32\catroot2
2011-01-11 08:59:47 ----D---- C:\Scripty
2011-01-09 09:15:41 ----D---- C:\Users\jank\AppData\Roaming\DivX
2011-01-07 13:34:31 ----D---- C:\Windows\system32\Macromed
2011-01-07 13:33:48 ----D---- C:\Windows\Downloaded Program Files
2011-01-06 17:46:38 ----D---- C:\Windows\Minidump
2011-01-06 13:17:34 ----D---- C:\_F
2011-01-02 21:21:24 ----D---- C:\Program Files\Google
2011-01-02 21:03:44 ----D---- C:\Windows\system32\DriverStore
2011-01-02 20:56:02 ----D---- C:\Program Files\DIFX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 NetworkX;NetworkX; C:\Windows\system32\ckldrv.sys [2008-03-17 19584]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
R1 vmm;Virtual Machine Monitor; \??\C:\Windows\system32\Drivers\vmm.sys [2010-03-15 229208]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-09-03 137144]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-15 32256]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2006-11-14 43520]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-26 179712]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-07-08 2506232]
R3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2006-11-06 78128]
R3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2006-11-06 80176]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-06 16560]
R3 ldmirror;ldmirror; C:\Windows\system32\DRIVERS\ldmirror.sys [2005-07-01 3328]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\DRIVERS\LVUSBSta.sys [2008-07-26 41752]
R3 mirrorflt;Mirror Filter Driver for Uninstall; C:\Windows\system32\DRIVERS\mirrorflt.sys [2005-07-01 3712]
R3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver; C:\Windows\system32\DRIVERS\OEM04Vfx.sys [2007-03-05 7424]
R3 OEM04Vid;Creative Camera OEM004 Driver; C:\Windows\system32\DRIVERS\OEM04Vid.sys [2007-10-11 234720]
R3 pppop;PPPoP WAN Adapter; C:\Windows\system32\DRIVERS\pppop.sys [2008-10-10 36384]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial.sys [2009-01-09 27136]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 84992]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-10-26 193456]
R3 VPCNetS2;Virtual Machine Network Services Driver; C:\Windows\system32\DRIVERS\VMNetSrv.sys [2007-01-29 59280]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
R3 wacommousefilter;Wacom Mouse Filter Driver; C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver; C:\Windows\system32\DRIVERS\wacomvhid.sys [2009-09-22 14120]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 Axtmvflt;Axesstel USB Filter Service; C:\Windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
S3 Axtmvmdm;Axesstel USB Modem; C:\Windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
S3 Axtmvprt;Axesstel Diagnostic Port; C:\Windows\System32\Drivers\Axtmvprt.sys [2007-03-26 38784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
S3 ldblank;Screen Blanking driver for Remote Control; C:\Windows\system32\DRIVERS\ldblank.sys [2005-07-01 11904]
S3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
S3 LVUVC;Logitech QuickCam Pro 9000(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
S3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-10-06 22016]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsu.sys [2009-10-06 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsuc.sys [2009-10-06 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RimUsb;zařízení BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb.sys [2008-05-20 22784]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-10-06 7936]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-10-06 7936]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 wacmoumonitor;Wacom Mode Helper; C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2010-01-25 16168]
S4 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys []
S4 RsFx0103;RsFx0103 Driver; C:\Windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 CBA8;LANDesk(R) Management Agent; C:\Program Files\LANDesk\Shared Files\residentagent.exe [2007-01-09 122880]
R2 Crypkey License;Crypkey License; C:\Windows\system32\crypserv.exe [2008-05-08 122880]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-18 810144]
R2 FortiSslvpnDaemon;FortiClient SSL VPN; C:\Windows\system32\FortiSSLVPNdaemon.exe [2009-03-09 510496]
R2 IISADMIN;@%windir%\system32\inetsrv\iisres.dll,-30007; C:\Windows\system32\inetsrv\inetinfo.exe [2009-07-14 13824]
R2 Intel Alert Handler;Intel Alert Handler; C:\Windows\system32\ams_ii\hndlrsvc.exe [2006-06-05 32839]
R2 Intel Local Scheduler Service;Intel Local Scheduler Service; C:\Program Files\LANDesk\LDClient\LocalSch.EXE [2006-08-14 86016]
R2 Intel PDS;Intel PDS; C:\Windows\system32\cba\pds.exe [2006-06-05 32819]
R2 Intel Targeted Multicast;LANDesk Targeted Multicast; C:\Program Files\LANDesk\LDClient\tmcsvc.exe [2007-01-05 114688]
R2 ISSUSER;LANDesk Remote Control Service; C:\PROGRA~1\LANDesk\LDClient\issuser.exe [2007-08-02 356864]
R2 LDXDD;LANDesk(R) Extended device discovery service; C:\Program Files\LANDesk\LDClient\xddclient.exe [2007-04-17 184320]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [2010-09-17 42773336]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
R2 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-03-16 129640]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Softmon;LANDesk(R) Software Monitoring Service; C:\Program Files\LANDesk\LDClient\softmon.exe [2007-07-26 266240]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-03-16 240232]
R2 TabletServiceWacom;TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [2010-03-09 5010288]
R2 TeamViewer4;TeamViewer 4; C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe [2009-01-28 185640]
R2 W3SVC;@%windir%\system32\inetsrv\iisres.dll,-30003; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-24 136176]
S2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-11-18 33584]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 370008]

-----------------EOF-----------------
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#2 Příspěvek od motji »

:arrow: Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
honza.kl
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 30 Led 2011 14:03

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#3 Příspěvek od honza.kl »

Zdravím
Jeste nez jsem pustil combofix jsem nasel pricinu tohoto chování -> DHCPQEC2.dll ktera se poustela jako parametr rundll32.exe v naplanovaných ulohách. Vyresil jsem tak problem centra zabezpečení. Combofix pak opravil grafiku u miniapp. Ručně jsem nahodil zakazané services v services.msc. zatím jsem příšel jen na jeden setrvávající problem a to s nefunkčním Windows Update které končí chybou 8024402C coz možná vyřeší přítomnost počítače na firemní síti kde je WSUS.
Jsou už logy vpořádku?
Děkuji Honza


Log u Combofix přikládám:

ComboFix 11-01-29.03 - jank 30.01.2011 16:07:31.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3582.2410 [GMT 1:00]
Spuštěný z: c:\users\jank\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\jank\AppData\Roaming\karat
c:\users\jank\AppData\Roaming\karat\karat.ini
c:\users\jank\AppData\Roaming\Local
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\4.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\5.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\6.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\7.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\cdztum0cm2bir.avi.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\jmouzqfxnjyg.avi.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\qpdairalnysg.avi.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\tcnuknjxmtrr.avi.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\cdztum0cm2bir.avi.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\jmouzqfxnjyg.avi.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\qpdairalnysg.avi.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\tcnuknjxmtrr.avi
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\tvevmcveuynm.avi.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\ylpuxkwwodtw.avi(2).ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\ylpuxkwwodtw.avi.ddp
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\tvevmcveuynm.avi.ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\ylpuxkwwodtw.avi(2).ddr
c:\users\jank\AppData\Roaming\Local\Temp\DDM\Settings\ylpuxkwwodtw.avi.ddr
c:\users\jank\mahogany_w32.dll
c:\windows\Uninstall.ini

----- BITS: Možné infikované stránky -----

hxxp://p-mg01
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-28 do 2011-01-30 )))))))))))))))))))))))))))))))
.

2011-01-30 15:18 . 2011-01-30 15:18 73728 ----a-w- c:\windows\system32\WOEM_3_2awoem.tmp
2011-01-30 15:14 . 2011-01-30 15:18 -------- d-----w- c:\users\jank\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\pc\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\image\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\davidvo\AppData\Local\temp
2011-01-30 15:14 . 2011-01-30 15:14 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-01-30 14:12 . 2011-01-30 14:12 -------- d-----w- C:\rsit
2011-01-30 14:06 . 2011-01-30 14:28 -------- d-----w- c:\program files\Trend Micro
2011-01-30 14:06 . 2011-01-30 14:06 388096 ----a-r- c:\users\jank\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-30 13:52 . 2011-01-30 13:52 -------- d-----w- c:\users\jank\AppData\Roaming\SUPERAntiSpyware.com
2011-01-30 13:52 . 2011-01-30 13:52 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-01-30 13:52 . 2011-01-30 13:53 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\users\jank\AppData\Roaming\Malwarebytes
2011-01-30 12:54 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\programdata\Malwarebytes
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-30 12:54 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-30 09:19 . 2011-01-30 12:11 -------- d-----w- c:\program files\AutoDWG
2011-01-29 19:07 . 2011-01-29 19:07 86016 --sha-r- c:\windows\system32\DHCPQEC2.dll
2011-01-28 09:29 . 2011-01-28 09:29 4065080 ----a-w- C:\FilterPack64bit.exe
2011-01-27 14:45 . 2011-01-27 14:45 -------- d-----w- C:\Exchange 2010 na R2
2011-01-27 14:32 . 2011-01-27 14:33 3280704 ----a-w- C:\tcmd756a.exe
2011-01-27 13:12 . 2011-01-27 13:13 -------- d-----w- C:\27-01-2011- ExportDB
2011-01-27 10:39 . 2011-01-27 11:17 -------- d-----w- C:\Hermes chyba ntfs
2011-01-26 13:21 . 2011-01-26 13:21 -------- dc----w- c:\users\jank\AppData\Local\MigWiz
2011-01-25 17:03 . 2011-01-25 17:23 -------- d-----w- c:\users\jank\AppData\Roaming\RDP6
2011-01-25 17:02 . 2011-01-25 17:20 -------- d-----w- C:\Alternativa pro NOS
2011-01-24 19:45 . 2011-01-28 10:55 -------- d-----w- C:\AAAAA
2011-01-24 18:57 . 2011-01-24 19:12 -------- d-----w- C:\_A_Hermes_Databaze15
2011-01-24 11:01 . 2011-01-24 12:15 -------- d-----w- C:\Hermes_Bluescreen_01_2011
2011-01-20 18:35 . 2011-01-21 10:21 -------- d-----w- C:\Analýza Hlavičky Emailu
2011-01-20 14:41 . 2011-01-20 15:53 -------- d-----w- C:\_Certifikat
2011-01-19 15:54 . 2011-01-30 12:09 -------- d-----w- C:\_H
2011-01-19 10:34 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{11C406B6-BDEA-4049-8577-144FC4B3DD67}\mpengine.dll
2011-01-18 11:05 . 2011-01-18 13:09 -------- d-----w- C:\KS Program
2011-01-12 10:42 . 2010-10-16 04:34 573440 ----a-w- c:\windows\system32\odbc32.dll
2011-01-12 10:42 . 2010-10-16 04:33 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 10:42 . 2010-10-16 04:33 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 10:42 . 2010-10-16 04:33 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 10:42 . 2010-10-16 04:33 208896 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 10:42 . 2010-10-20 05:00 1289536 ----a-w- c:\windows\system32\ntdll.dll
2011-01-10 16:50 . 2011-01-10 16:53 -------- d-----w- C:\Backup
2011-01-10 14:26 . 2011-01-20 10:16 -------- d-----w- C:\_G
2011-01-07 12:33 . 2011-01-07 12:34 -------- d-----w- c:\windows\system32\Adobe
2011-01-06 14:07 . 2011-01-06 14:09 -------- d-----w- c:\program files\KS Program
2011-01-03 15:00 . 2011-01-05 10:40 -------- d-----w- C:\Z_NOD32
2011-01-02 19:56 . 2011-01-02 19:56 -------- d-----w- c:\users\jank\AppData\Roaming\GARMIN
2011-01-02 19:56 . 2011-01-02 19:56 -------- d-----w- c:\programdata\GARMIN
2011-01-02 19:55 . 2011-01-02 20:04 -------- d-----w- c:\program files\Garmin
2011-01-02 19:50 . 2011-01-07 13:22 -------- d-----w- C:\Garmin

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 17:53 . 2010-06-27 15:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-08 16:00 . 2010-11-08 16:00 53248 ----a-r- c:\users\jank\AppData\Roaming\Microsoft\Installer\{23C12370-3A82-4558-B727-F345B473AD87}\ARPPRODUCTICON.exe
2010-11-04 05:52 . 2010-12-15 12:42 978944 ----a-w- c:\windows\system32\wininet.dll
2010-11-04 05:48 . 2010-12-15 12:42 44544 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-04 04:41 . 2010-12-15 12:42 386048 ----a-w- c:\windows\system32\html.iec
2010-11-04 04:08 . 2010-12-15 12:42 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-11-02 04:41 . 2010-12-15 12:42 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-02 04:40 . 2010-12-15 12:42 496128 ----a-w- c:\windows\system32\taskschd.dll
2010-11-02 04:40 . 2010-12-15 12:42 305152 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-02 04:39 . 2010-12-15 12:42 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 04:34 . 2010-12-15 12:42 192000 ----a-w- c:\windows\system32\taskeng.exe
2010-11-02 04:34 . 2010-12-15 12:42 179712 ----a-w- c:\windows\system32\schtasks.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-16 22:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-16 22:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-02-03 135664]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEM04Mon.exe"="c:\windows\OEM04Mon.exe" [2007-06-11 36864]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"IntelAPMClient"="c:\program files\LANDesk\LDClient\amclient.exe" [2007-08-07 331776]
"LANDeskCustomData"="c:\program files\LANDesk\LDClient\ldcstm32.exe" [2006-12-27 229376]
"SDClientMonitor"="c:\program files\LANDesk\LDClient\webportal\sdclientmonitor.exe" [2006-11-01 258048]
"PSQLLauncher"="c:\program files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 49168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-03-16 88168]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-10 648536]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-18 2219184]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MSTEE.CxTransform"="c:\program files\LANDesk\LDClient\softmon.exe" [2007-07-26 266240]
"MSTEE.Splitter"="c:\program files\LANDesk\LDClient\softmon.exe" [2007-07-26 266240]

c:\users\jank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
zakaz_sdileni_disku.bat [2010-9-9 20]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-16 22:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 136176]
R3 Axtmvflt;Axesstel USB Filter Service;c:\windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
R3 Axtmvmdm;Axesstel USB Modem;c:\windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
R3 Axtmvprt;Axesstel Diagnostic Port;c:\windows\system32\Drivers\Axtmvprt.sys [2007-03-26 38784]
R3 ldblank;Screen Blanking driver for Remote Control;c:\windows\system32\DRIVERS\ldblank.sys [2005-07-01 11904]
R3 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-10-06 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-10-06 8320]
R3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 370008]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-01-24 16168]
R3 WiselinkPro;SAMSUNG WiselinkPro Service;c:\program files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [2009-10-20 4708864]
R3 WMSVC;Služba webové správy;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 9728]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 CBA8;LANDesk(R) Management Agent;c:\program files\LANDesk\Shared Files\residentagent.exe [2007-01-09 122880]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-09-03 137144]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-18 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S2 FortiSslvpnDaemon;FortiClient SSL VPN;c:\windows\system32\FortiSSLVPNdaemon.exe [2009-03-09 510496]
S2 LDXDD;LANDesk(R) Extended device discovery service;c:\program files\LANDesk\LDClient\xddclient.exe [2007-04-17 184320]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Softmon;LANDesk(R) Software Monitoring Service;c:\program files\LANDesk\LDClient\softmon.exe [2007-07-26 266240]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-03-16 240232]
S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2010-03-09 5010288]
S2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2009-01-28 185640]
S3 ldmirror;ldmirror;c:\windows\system32\DRIVERS\ldmirror.sys [2005-07-01 3328]
S3 mirrorflt;Mirror Filter Driver for Uninstall;c:\windows\system32\DRIVERS\mirrorflt.sys [2005-07-01 3712]
S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-03-05 7424]
S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-10-11 234720]
S3 pppop;PPPoP WAN Adapter;c:\windows\system32\DRIVERS\pppop.sys [2008-10-10 36384]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S3 WOEM_3_2a;WinPcap Packet Driver (WOEM_3_2a);c:\windows\system32\drivers\WOEM_3_2a.sys [x]
S3 xpvcom;XPVCOM Port;c:\windows\system32\Drivers\xpvcom.sys [2007-03-23 30032]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 17:55]

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 17:55]

2011-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948Core.job
- c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-03 07:56]

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948UA.job
- c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-03 07:56]

2010-05-15 c:\windows\Tasks\Moje uloha.job
- c:\windows\system32\calc.exe [2009-07-13 01:14]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
Trusted Zone: chservices.cz\oa.lab
Trusted Zone: netcentrum.cz\p-bb02.office
Trusted Zone: podani.gov.cz\bezpecne
Trusted Zone: postsignum.cz\www
Handler: x-owacid2 - {5B290518-830E-4C57-A66B-E4F748900C27} - c:\program files\Microsoft\SMIME Client (2010)\mimectl.dll
DPF: {00000000-0000-0000-0000-123456789012} - hxxps://bezpecne.podani.gov.cz/ClientObjects/SignatureControlInstallerNET35x86.CAB
FF - ProfilePath - c:\users\jank\AppData\Roaming\Mozilla\Firefox\Profiles\t1edjyyh.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: WebTran: {003D3EDC-99B9-4a34-9C20-60CB94F7E829} - %profile%\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-Locked - (no file)
HKCU-Run-WEBTRAN - (no file)
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-NWEReboot - (no file)
HKLM-Run-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
AddRemove-PC Translator - c:\users\jank\AppData\Local\Temp\UN32.EXE
AddRemove-2660162645.www.mstv.cz - c:\program files\Microsoft Silverlight\4.0.50917.0\Silverlight.Configuration.exe
AddRemove-Winamp Detect - c:\program files\Winamp Detect\UninstWaDetect.exe


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(4432)
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\windows\system32\crypserv.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\LANDesk\LDClient\LocalSch.EXE
c:\windows\system32\cba\pds.exe
c:\progra~1\LANDesk\LDClient\collector.exe
c:\windows\system32\conhost.exe
c:\program files\LANDesk\LDClient\tmcsvc.exe
c:\progra~1\LANDesk\LDClient\issuser.exe
c:\windows\system32\taskhost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\progra~1\LANDesk\LDClient\rcgui.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
c:\windows\System32\snmptrap.exe
c:\windows\system32\STacSV.exe
c:\program files\RealVNC\WinVNC4.exe
c:\windows\system32\ams_ii\hndlrsvc.exe
c:\windows\system32\MsgSys.EXE
c:\program files\TeamViewer\Version4\TeamViewer.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Fingerprint Reader Suite\psqltray.exe
c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
c:\users\jank\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Totalcmd\TOTALCMD.EXE
.
**************************************************************************
.
Celkový čas: 2011-01-30 16:23:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-30 15:23

Před spuštěním: Volných bajtů: 62 107 086 848
Po spuštění: Volných bajtů: 62 041 620 480

- - End Of File - - 909206BB1458969995E8C6C4403708DA
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#4 Příspěvek od motji »

Vidím mbam, našel něco?

:arrow: tyto složky znáte?
C:\AAAAA
C:\_H a podobné


:arrow: tuto naplánovanou ulohu znáte?
2010-05-15 c:\windows\Tasks\Moje uloha.job
- c:\windows\system32\calc.exe [2009-07-13 01:14]

:arrow: Otestujte na http://www.virustotal.com
c:\windows\system32\WOEM_3_2awoem.tmp
c:\windows\system32\DHCPQEC2.dll
C:\tcmd756a.exe
-Na virustotalu dáte procházet, a do spodního okénka nakopírujete přímo cestu k souboru a dáte odeslat
-z prohlížeče zkopírujete adresu ke stránce s výsledky
-pokud se Vás zeptá, dejte soubor otestovat znovu, tak aby to byl soubor z Vašeho počítače
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
honza.kl
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 30 Led 2011 14:03

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#5 Příspěvek od honza.kl »

DHCPQEC.DLL
http://www.virustotal.com/file-scan/rep ... 1296414309

WOEM_3_2awoem.tmp
http://www.virustotal.com/file-scan/rep ... 1296414883

nedokážu posoudit

C:\AAAAA
C:\_H a podobné
obsahově znám a jsou určitě vpořádku

C:\tcmd756a.exe
Instalacka Total Commanderu smazal jsem

Naplanované ulohy jsem vsechny smazal jedna z nich byla příčina problému jak jsem již psal (knihovna DHCPQEC.DLL
s chybou souvisela).
Děkuji Honza
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#6 Příspěvek od motji »

:arrow: Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Collect::
c:\windows\system32\WOEM_3_2awoem.tmp
c:\windows\system32\DHCPQEC2.dll

DDS::
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip

Firefox::
FF - ProfilePath - c:\users\jank\AppData\Roaming\Mozilla\Firefox\Profiles\t1edjyyh.default\
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek


-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci



:arrow: V mbamu koukněte do záložky protokoly, zda se tam uložil protokol z toho, co jste mazal.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
honza.kl
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 30 Led 2011 14:03

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#7 Příspěvek od honza.kl »

Dobrý den,
posilam log z opravy COMBOFIXEM a MBAM:

COMBOFIX:
ComboFix 11-01-31.01 - jank 31.01.2011 20:00:16.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3582.2477 [GMT 1:00]
Spuštěný z: c:\users\jank\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\jank\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

file zipped: c:\windows\system32\DHCPQEC2.dll
file zipped: c:\windows\system32\WOEM_3_2awoem.tmp
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\jank\AppData\Roaming\karat
c:\users\jank\AppData\Roaming\karat\karat.ini
c:\windows\system32\DHCPQEC2.dll
c:\windows\system32\WOEM_3_2awoem.tmp

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-28 do 2011-01-31 )))))))))))))))))))))))))))))))
.

2011-01-31 19:09 . 2011-01-31 19:09 73728 ----a-w- c:\windows\system32\WOEM_3_2awoem.tmp
2011-01-31 19:07 . 2011-01-31 19:10 -------- d-----w- c:\users\jank\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\pc\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\image\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\davidvo\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp
2011-01-31 19:07 . 2011-01-31 19:07 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-01-31 15:03 . 2011-01-31 15:52 -------- d-----w- C:\P-ms01_install
2011-01-31 08:17 . 2011-01-31 08:17 -------- d-----w- C:\IBM
2011-01-31 08:14 . 2011-01-31 08:15 1874313 ----a-w- C:\ibm_dd_sraidmr_4.32a_windows_32-64.exe
2011-01-31 07:03 . 2011-01-31 15:04 -------- d-----w- C:\P-MS01
2011-01-30 14:12 . 2011-01-30 14:12 -------- d-----w- C:\rsit
2011-01-30 14:06 . 2011-01-30 14:28 -------- d-----w- c:\program files\Trend Micro
2011-01-30 14:06 . 2011-01-30 14:06 388096 ----a-r- c:\users\jank\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-30 13:52 . 2011-01-30 13:52 -------- d-----w- c:\users\jank\AppData\Roaming\SUPERAntiSpyware.com
2011-01-30 13:52 . 2011-01-30 13:52 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-01-30 13:52 . 2011-01-30 15:55 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\users\jank\AppData\Roaming\Malwarebytes
2011-01-30 12:54 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\programdata\Malwarebytes
2011-01-30 12:54 . 2011-01-30 12:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-30 12:54 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-30 09:19 . 2011-01-30 12:11 -------- d-----w- c:\program files\AutoDWG
2011-01-28 09:29 . 2011-01-28 09:29 4065080 ----a-w- C:\FilterPack64bit.exe
2011-01-27 14:45 . 2011-01-27 14:45 -------- d-----w- C:\Exchange 2010 na R2
2011-01-27 13:12 . 2011-01-27 13:13 -------- d-----w- C:\27-01-2011- ExportDB
2011-01-27 10:39 . 2011-01-27 11:17 -------- d-----w- C:\Hermes chyba ntfs
2011-01-26 13:21 . 2011-01-26 13:21 -------- dc----w- c:\users\jank\AppData\Local\MigWiz
2011-01-25 17:03 . 2011-01-25 17:23 -------- d-----w- c:\users\jank\AppData\Roaming\RDP6
2011-01-25 17:02 . 2011-01-25 17:20 -------- d-----w- C:\Alternativa pro NOS
2011-01-24 19:45 . 2011-01-28 10:55 -------- d-----w- C:\AAAAA
2011-01-24 18:57 . 2011-01-24 19:12 -------- d-----w- C:\_A_Hermes_Databaze15
2011-01-24 11:01 . 2011-01-24 12:15 -------- d-----w- C:\Hermes_Bluescreen_01_2011
2011-01-20 18:35 . 2011-01-21 10:21 -------- d-----w- C:\Analýza Hlavičky Emailu
2011-01-20 14:41 . 2011-01-20 15:53 -------- d-----w- C:\_Certifikat
2011-01-19 15:54 . 2011-01-31 12:50 -------- d-----w- C:\_H
2011-01-19 10:34 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{11C406B6-BDEA-4049-8577-144FC4B3DD67}\mpengine.dll
2011-01-18 11:05 . 2011-01-18 13:09 -------- d-----w- C:\KS Program
2011-01-12 10:42 . 2010-10-16 04:34 573440 ----a-w- c:\windows\system32\odbc32.dll
2011-01-12 10:42 . 2010-10-16 04:33 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 10:42 . 2010-10-16 04:33 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 10:42 . 2010-10-16 04:33 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 10:42 . 2010-10-16 04:33 208896 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 10:42 . 2010-10-20 05:00 1289536 ----a-w- c:\windows\system32\ntdll.dll
2011-01-10 16:50 . 2011-01-10 16:53 -------- d-----w- C:\Backup
2011-01-10 14:26 . 2011-01-20 10:16 -------- d-----w- C:\_G
2011-01-07 12:33 . 2011-01-07 12:34 -------- d-----w- c:\windows\system32\Adobe
2011-01-06 14:07 . 2011-01-06 14:09 -------- d-----w- c:\program files\KS Program
2011-01-03 15:00 . 2011-01-05 10:40 -------- d-----w- C:\Z_NOD32
2011-01-02 19:56 . 2011-01-02 19:56 -------- d-----w- c:\users\jank\AppData\Roaming\GARMIN
2011-01-02 19:56 . 2011-01-02 19:56 -------- d-----w- c:\programdata\GARMIN
2011-01-02 19:55 . 2011-01-02 20:04 -------- d-----w- c:\program files\Garmin
2011-01-02 19:50 . 2011-01-07 13:22 -------- d-----w- C:\Garmin

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-31 08:32 . 2011-01-31 08:32 3351097 ----a-w- C:\eaton_sw_pdu_v01.05b3_anyos_noarch.zip
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 17:53 . 2010-06-27 15:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2010-11-08 16:00 . 2010-11-08 16:00 53248 ----a-r- c:\users\jank\AppData\Roaming\Microsoft\Installer\{23C12370-3A82-4558-B727-F345B473AD87}\ARPPRODUCTICON.exe
2010-11-04 05:52 . 2010-12-15 12:42 978944 ----a-w- c:\windows\system32\wininet.dll
2010-11-04 05:48 . 2010-12-15 12:42 44544 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-04 04:41 . 2010-12-15 12:42 386048 ----a-w- c:\windows\system32\html.iec
2010-11-04 04:08 . 2010-12-15 12:42 1638912 ----a-w- c:\windows\system32\mshtml.tlb
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-16 22:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-16 22:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-02-03 135664]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEM04Mon.exe"="c:\windows\OEM04Mon.exe" [2007-06-11 36864]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"IntelAPMClient"="c:\program files\LANDesk\LDClient\amclient.exe" [2007-08-07 331776]
"LANDeskCustomData"="c:\program files\LANDesk\LDClient\ldcstm32.exe" [2006-12-27 229376]
"SDClientMonitor"="c:\program files\LANDesk\LDClient\webportal\sdclientmonitor.exe" [2006-11-01 258048]
"PSQLLauncher"="c:\program files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 49168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-03-16 88168]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-10 648536]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-18 2219184]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MSTEE.CxTransform"="c:\program files\LANDesk\LDClient\softmon.exe" [2007-07-26 266240]
"MSTEE.Splitter"="c:\program files\LANDesk\LDClient\softmon.exe" [2007-07-26 266240]

c:\users\jank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
zakaz_sdileni_disku.bat [2010-9-9 20]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-16 22:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 136176]
R3 Axtmvflt;Axesstel USB Filter Service;c:\windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
R3 Axtmvmdm;Axesstel USB Modem;c:\windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
R3 Axtmvprt;Axesstel Diagnostic Port;c:\windows\system32\Drivers\Axtmvprt.sys [2007-03-26 38784]
R3 CFcatchme;CFcatchme;c:\users\jank\AppData\Local\Temp\CFcatchme.sys [x]
R3 ldblank;Screen Blanking driver for Remote Control;c:\windows\system32\DRIVERS\ldblank.sys [2005-07-01 11904]
R3 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-10-06 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-10-06 8320]
R3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 370008]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-01-24 16168]
R3 WiselinkPro;SAMSUNG WiselinkPro Service;c:\program files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [2009-10-20 4708864]
R3 WMSVC;Služba webové správy;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 9728]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 CBA8;LANDesk(R) Management Agent;c:\program files\LANDesk\Shared Files\residentagent.exe [2007-01-09 122880]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-09-03 137144]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-18 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S2 FortiSslvpnDaemon;FortiClient SSL VPN;c:\windows\system32\FortiSSLVPNdaemon.exe [2009-03-09 510496]
S2 LDXDD;LANDesk(R) Extended device discovery service;c:\program files\LANDesk\LDClient\xddclient.exe [2007-04-17 184320]
S2 Softmon;LANDesk(R) Software Monitoring Service;c:\program files\LANDesk\LDClient\softmon.exe [2007-07-26 266240]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-03-16 240232]
S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2010-03-09 5010288]
S2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2009-01-28 185640]
S3 ldmirror;ldmirror;c:\windows\system32\DRIVERS\ldmirror.sys [2005-07-01 3328]
S3 mirrorflt;Mirror Filter Driver for Uninstall;c:\windows\system32\DRIVERS\mirrorflt.sys [2005-07-01 3712]
S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-03-05 7424]
S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-10-11 234720]
S3 pppop;PPPoP WAN Adapter;c:\windows\system32\DRIVERS\pppop.sys [2008-10-10 36384]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S3 WOEM_3_2a;WinPcap Packet Driver (WOEM_3_2a);c:\windows\system32\drivers\WOEM_3_2a.sys [x]
S3 xpvcom;XPVCOM Port;c:\windows\system32\Drivers\xpvcom.sys [2007-03-23 30032]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'

2011-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 17:55]

2011-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-24 17:55]

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948Core.job
- c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-03 07:56]

2011-01-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3643220983-3174800827-2681472606-1948UA.job
- c:\users\jank\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-03 07:56]

2010-05-15 c:\windows\Tasks\Moje uloha.job
- c:\windows\system32\calc.exe [2009-07-13 01:14]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
Trusted Zone: chservices.cz\oa.lab
Trusted Zone: netcentrum.cz\p-bb02.office
Trusted Zone: podani.gov.cz\bezpecne
Trusted Zone: postsignum.cz\www
Handler: x-owacid2 - {5B290518-830E-4C57-A66B-E4F748900C27} - c:\program files\Microsoft\SMIME Client (2010)\mimectl.dll
DPF: {00000000-0000-0000-0000-123456789012} - hxxps://bezpecne.podani.gov.cz/ClientObjects/SignatureControlInstallerNET35x86.CAB
FF - ProfilePath - c:\users\jank\AppData\Roaming\Mozilla\Firefox\Profiles\t1edjyyh.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: WebTran: {003D3EDC-99B9-4a34-9C20-60CB94F7E829} - %profile%\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(5900)
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\windows\system32\crypserv.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\LANDesk\LDClient\LocalSch.EXE
c:\windows\system32\cba\pds.exe
c:\program files\LANDesk\LDClient\tmcsvc.exe
c:\progra~1\LANDesk\LDClient\collector.exe
c:\windows\system32\conhost.exe
c:\progra~1\LANDesk\LDClient\issuser.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
c:\windows\system32\taskhost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\progra~1\LANDesk\LDClient\rcgui.exe
c:\windows\System32\snmptrap.exe
c:\windows\system32\STacSV.exe
c:\program files\RealVNC\WinVNC4.exe
c:\windows\system32\ams_ii\hndlrsvc.exe
c:\windows\system32\conhost.exe
c:\program files\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\MsgSys.EXE
c:\windows\system32\DllHost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Fingerprint Reader Suite\psqltray.exe
c:\users\jank\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2011-01-31 20:15:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-31 19:15
ComboFix2.txt 2011-01-30 15:23

Před spuštěním: Volných bajtů: 61 577 248 768
Po spuštění: Volných bajtů: 61 503 463 424

- - End Of File - - 306CCD83AB40552D72979C57918AC9D1



MBAM:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5639

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30.1.2011 23:23:10
mbam-log-2011-01-30 (23-23-10).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 436293
Uplynulý čas: 1 hodin, 38 minut, 26 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 5

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\VXEG3ZNNE5 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\a - office\a - batky\firefox - zmena a zamknutí homepage\set_mozilla\lsrunase.exe (Trojan.Dropper.PGen) -> Not selected for removal. Software který znám
c:\a - office\poweriso 4.7 - full\rozbaleno\PISO4.7\poweriso.v4.7.winall.incl.keygen-crd\crd.exe (TheftMarker.Crude) -> Quarantined and deleted successfully.
c:\a - office\sharepoint migration tool - vyzkoušeno a funkční\rozbaleno\CORE10k.EXE (Dont.Steal.Our.Software) -> Not selected for removal.nerad bych mazal nemam v planu jej spoustet
c:\a - office\northon ghost 14\Crack\norton.ghost.v14.0.keygen.only-edge\EDGE\KEYGEN.EXE (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
c:\program files\snadboy's revelation v2\revelation.exe (HackTool.Snadboy) -> Not selected for removal.software který rozkrývá heslo z hvězdiček
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#8 Příspěvek od motji »

Jste si jistý, že ty soubory jsou bez virů?
V naplánovaných ulohách máte stále
2010-05-15 c:\windows\Tasks\Moje uloha.job
- c:\windows\system32\calc.exe [2009-07-13 01:14]
Znáte to? Je to Vámi plánované?

Jak to vypadá s počítačem?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
honza.kl
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 30 Led 2011 14:03

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#9 Příspěvek od honza.kl »

Počítač funguje nyní již zcela bez problému.Chtěl bych Vám poděkovat z pomoc.
Naplanovanou ulohu znám - vytvarel jsem ji na zkoušku skrze powershell - odstranil jsem ji :-)
Honza
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: Nefunguji centrum zabezpečení a windows miniapp grafika

#10 Příspěvek od motji »

:arrow: Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


:arrow: Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



:arrow: Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

:arrow: Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“