pro motji, prosím o kontrolu

[sunv]

Prosím o kontrlu. Nejdou mi aktualizace windows a ani Microsoft Security Essentials.
log:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Milan at 2011-03-09 12:55:59
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 57 GB (38%) free of 151 GB
Total RAM: 3326 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:56:22, on 9.3.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19019)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\Program Files\Siano Mobile Silicon\SMS\SmsIRProcess.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Milan\Desktop\RSIT.exe
C:\Program Files\trend micro\Milan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://battlefield.play4free.com/en/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.14.1:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKLM\..\Run: [SmsIrProcess] "C:\Program Files\Siano Mobile Silicon\SMS\SmsIrProcess.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus.com/pub/ASUS/misc/d ... .2.5.0.cab
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} (Battlefield Play4Free Updater) - https://battlefield.play4free.com/stati ... 0.42.2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B34111F9-934E-414C-A437-0D91D4D067C2}: NameServer = 193.179.148.42,212.71.128.9
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\System32\guard32.dll C:\Windows\system32\guard32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (file missing)
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Update Service (gupdate1c9de051e6229f3) (gupdate1c9de051e6229f3) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files\Secunia\PSI\PSIA.exe
O23 - Service: Secunia Update Agent - Secunia - C:\Program Files\Secunia\PSI\sua.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

--
End of file - 7396 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Click Maintenance.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{ACD3081E-137A-4415-A280-DF4AC784C662}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Program Files\Orbitdownloader\orbitcth.dll [2011-01-13 241464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} - Grab Pro - C:\Program Files\Orbitdownloader\GrabPro.dll [2011-01-13 687808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-05-10 4468736]
"itype"=C:\Program Files\Microsoft IntelliType Pro\itype.exe [2008-06-10 1442888]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-01-19 2548552]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-10-26 98304]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2007-03-20 36864]
"ChangeFilterMerit"=C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe [2007-06-08 51280]
"Presto! PVR Monitor"=C:\Program Files\NewSoft\Presto! PVR\Monitor.exe [2009-02-20 157520]
"SmsIrProcess"=C:\Program Files\Siano Mobile Silicon\SMS\SmsIrProcess.exe [2009-12-10 81920]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\guard32.dll C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Orbitdownloader\orbitdm.exe"="C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Program Files\Orbitdownloader\orbitnet.exe"="C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-03-09 12:41:50 ----D---- C:\Program Files\Microsoft Security Client
2011-03-02 16:40:14 ----D---- C:\Program Files\Siano Mobile Silicon
2011-03-02 16:40:14 ----D---- C:\Program Files\Common Files\Siano Mobile Silicon
2011-03-02 16:39:19 ----D---- C:\Program Files\NewSoft
2011-02-27 10:28:43 ----D---- C:\Users\Milan\AppData\Roaming\vghd
2011-02-27 10:24:15 ----A---- C:\Windows\treeskp.sys
2011-02-23 11:23:51 ----D---- C:\ProgramData\WindowsSearch
2011-02-23 09:59:37 ----A---- C:\Windows\system32\XAudio2_6.dll
2011-02-23 09:59:37 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2011-02-23 09:59:36 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2011-02-22 20:11:36 ----D---- C:\Program Files\Download Manager
2011-02-15 14:44:03 ----A---- C:\Windows\system32\WUDFSvc.dll
2011-02-15 14:44:03 ----A---- C:\Windows\system32\WUDFCoinstaller.dll
2011-02-15 14:44:03 ----A---- C:\Windows\system32\drivers\WUDFRd.sys
2011-02-15 14:44:03 ----A---- C:\Windows\system32\drivers\WUDFPf.sys
2011-02-15 14:44:02 ----A---- C:\Windows\system32\WUDFx.dll
2011-02-15 14:44:02 ----A---- C:\Windows\system32\WUDFPlatform.dll
2011-02-15 14:44:02 ----A---- C:\Windows\system32\WUDFHost.exe
2011-02-15 14:14:08 ----D---- C:\Program Files\Common Files\PCSuite
2011-02-15 14:14:04 ----D---- C:\Program Files\Common Files\Nokia
2011-02-15 14:13:57 ----A---- C:\Windows\system32\drivers\pccsmcfd.sys
2011-02-15 14:13:42 ----D---- C:\Program Files\PC Connectivity Solution
2011-02-15 14:10:55 ----D---- C:\Program Files\Nokia
2011-02-14 21:04:19 ----A---- C:\Windows\avisplitter.ini
2011-02-14 21:04:16 ----A---- C:\Windows\system32\yv12vfw.dll
2011-02-14 21:04:16 ----A---- C:\Windows\system32\xvidvfw.dll
2011-02-14 21:04:16 ----A---- C:\Windows\system32\xvidcore.dll
2011-02-14 21:04:15 ----A---- C:\Windows\system32\ff_vfw.dll.manifest
2011-02-14 21:04:15 ----A---- C:\Windows\system32\ff_vfw.dll
2011-02-14 21:04:11 ----D---- C:\Program Files\K-Lite Codec Pack
2011-02-14 15:33:02 ----D---- C:\Users\Milan\AppData\Roaming\MOBILedit
2011-02-14 15:32:37 ----D---- C:\Program Files\COMPELSON Labs
2011-02-14 15:23:12 ----D---- C:\Program Files\Common Files\LogoManager

======List of files/folders modified in the last 1 months======

2011-03-09 12:56:02 ----D---- C:\Program Files\trend micro
2011-03-09 12:51:00 ----D---- C:\Windows\temp
2011-03-09 12:42:13 ----SHD---- C:\Windows\Installer
2011-03-09 12:42:00 ----D---- C:\Windows\system32\drivers
2011-03-09 12:42:00 ----D---- C:\Windows\system32\catroot
2011-03-09 12:42:00 ----D---- C:\Windows\System32
2011-03-09 12:42:00 ----D---- C:\Windows\inf
2011-03-09 12:42:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-03-09 12:41:50 ----D---- C:\Program Files
2011-03-09 12:39:37 ----D---- C:\ProgramData\VMware
2011-03-09 12:36:59 ----HD---- C:\Windows\system32\GroupPolicy
2011-03-09 11:58:58 ----D---- C:\Windows
2011-03-09 11:37:59 ----D---- C:\Windows\Prefetch
2011-03-09 11:37:00 ----D---- C:\Windows\system32\Msdtc
2011-03-09 11:36:58 ----D---- C:\Windows\system32\wbem
2011-03-09 11:36:13 ----D---- C:\Windows\system32\config
2011-03-09 11:36:02 ----D---- C:\Windows\Tasks
2011-03-09 11:36:02 ----D---- C:\Windows\system32\Tasks
2011-03-09 11:36:02 ----D---- C:\Windows\system32\spool
2011-03-09 11:36:02 ----D---- C:\Windows\system32\drivers\etc
2011-03-09 11:36:02 ----D---- C:\Windows\system32\CodeIntegrity
2011-03-09 11:36:02 ----D---- C:\Windows\system32\catroot2
2011-03-09 11:36:02 ----D---- C:\Users\Milan\AppData\Roaming\vlc
2011-03-09 11:36:02 ----D---- C:\Users\Milan\AppData\Roaming\KeePass
2011-03-09 11:36:02 ----D---- C:\Users\Milan\AppData\Roaming\gtk-2.0
2011-03-09 11:36:02 ----D---- C:\Users\Milan\AppData\Roaming\GHISLER
2011-03-09 11:36:02 ----D---- C:\Users\Milan\AppData\Roaming\dvdcss
2011-03-09 11:36:02 ----D---- C:\Program Files\Steam
2011-03-09 11:36:02 ----D---- C:\Program Files\Mozilla Thunderbird
2011-03-09 11:36:01 ----D---- C:\Program Files\CCleaner
2011-03-09 11:36:01 ----D---- C:\Program Files\Ant Movie Catalog
2011-03-09 11:36:00 ----D---- C:\Windows\registration
2011-03-09 11:33:45 ----SHD---- C:\System Volume Information
2011-03-09 09:55:36 ----D---- C:\Users\Milan\AppData\Roaming\Media Player Classic
2011-03-09 04:28:01 ----D---- C:\Users\Milan\AppData\Roaming\Mipony
2011-03-08 22:32:08 ----D---- C:\Users\Milan\AppData\Roaming\Skype
2011-03-08 22:31:20 ----D---- C:\Users\Milan\AppData\Roaming\skypePM
2011-03-07 00:09:19 ----D---- C:\Users\Milan\AppData\Roaming\VMware
2011-03-02 16:40:18 ----HD---- C:\Program Files\InstallShield Installation Information
2011-03-02 16:40:14 ----D---- C:\Program Files\Common Files
2011-03-02 16:37:19 ----D---- C:\Program Files\Common Files\NewSoft
2011-03-02 01:59:03 ----A---- C:\Windows\hms_odpocet.ini
2011-02-26 22:49:00 ----D---- C:\Users\Milan\AppData\Roaming\Orbit
2011-02-25 11:49:42 ----D---- C:\Program Files\FastStone Image Viewer
2011-02-24 10:28:30 ----D---- C:\Program Files\Orbitdownloader
2011-02-23 11:23:51 ----D---- C:\ProgramData
2011-02-23 10:34:38 ----D---- C:\Windows\Microsoft.NET
2011-02-23 10:29:00 ----D---- C:\Windows\rescache
2011-02-23 10:02:25 ----D---- C:\Windows\winsxs
2011-02-21 12:34:59 ----RSD---- C:\Windows\assembly
2011-02-17 23:17:04 ----SD---- C:\Windows\Downloaded Program Files
2011-02-16 01:02:04 ----D---- C:\Windows\system32\cs-CZ
2011-02-15 14:45:23 ----D---- C:\Users\Milan\AppData\Roaming\Nokia
2011-02-15 14:43:46 ----D---- C:\Windows\system32\drivers\UMDF
2011-02-15 14:43:43 ----D---- C:\Users\Milan\AppData\Roaming\PC Suite
2011-02-15 14:43:41 ----D---- C:\ProgramData\PC Suite
2011-02-15 14:41:46 ----D---- C:\Program Files\Microsoft Silverlight
2011-02-15 14:13:57 ----DC---- C:\Windows\system32\DRVSTORE
2011-02-15 14:10:27 ----D---- C:\ProgramData\Installations
2011-02-14 18:24:54 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-02-14 18:08:38 ----D---- C:\Program Files\jv16 PowerTools 2010
2011-02-13 18:58:09 ----D---- C:\VueScan
2011-02-12 19:57:17 ----D---- C:\Users\Milan\AppData\Roaming\DVD Flick
2011-02-12 09:50:34 ----D---- C:\Windows\Debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 hotcore3;hc3ServiceName; C:\Windows\system32\drivers\hotcore3.sys [2010-02-03 40560]
R0 JGOGO;JMicron Hot-Plug Driver; C:\Windows\system32\DRIVERS\JGOGO.sys [2006-02-07 6912]
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2007-03-24 46208]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-08-14 691696]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2010-04-14 441760]
R1 Amfilter;A4Tech Mouse Filter Driver; C:\Windows\system32\DRIVERS\Amfilter.sys [2007-05-15 9216]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-01-13 236600]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-01-13 34744]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-01-13 80064]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-10-24 165264]
R1 Uim_IM;UIM Drive Backup Image Plugin; C:\Windows\System32\Drivers\Uim_IM.sys [2010-02-03 385544]
R1 UimBus;Universal Image Mounter Controller; C:\Windows\system32\DRIVERS\UimBus.sys [2010-02-03 34392]
R2 hcmon;VMware hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [2010-09-21 32304]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2008-01-21 95744]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2007-08-13 5120]
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2010-04-14 44384]
R2 vmci;VMware vmci; \??\C:\Windows\system32\Drivers\vmci.sys [2010-09-21 70704]
R2 VMnetBridge;VMware Bridge Protocol; C:\Windows\system32\DRIVERS\vmnetbridge.sys [2010-09-20 36400]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\Windows\system32\drivers\vmnetuserif.sys [2010-09-21 26288]
R2 vmx86;VMware vmx86; \??\C:\Windows\system32\Drivers\vmx86.sys [2010-09-21 854064]
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files\VMware\VMware Player\vstor2-ws60.sys [2010-08-19 22448]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-10-27 6573568]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-10-27 229888]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x86.sys [2007-10-31 46592]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdLH3.sys [2010-09-24 99856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-05-10 1775712]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-18 7680]
R3 smsbda;SMS Digital Video; C:\Windows\system32\drivers\smsbda.sys [2009-09-17 51872]
R3 STIrUsb;SigmaTel USB-IrDA Dongle; C:\Windows\system32\DRIVERS\irstusb.sys [2008-01-21 30208]
R3 vmkbd;VMware kbd; \??\C:\Windows\system32\drivers\VMkbd.sys [2010-09-21 24624]
R3 VRVD302;VRVD302; C:\Windows\system32\DRIVERS\VRVD302.sys [2008-08-31 11296]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
S1 MpKsl17aa2b2d;MpKsl17aa2b2d; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B93765CA-1DA2-4C82-8A82-BCBD13B6CFF6}\MpKsl17aa2b2d.sys []
S2 CX23880;WinFast CX2388x WDM Video Capture.; C:\Windows\system32\drivers\cx88vid.sys [2005-08-11 163584]
S2 CXAVXBAR;WinFast CX2388x WDM Crossbar.; C:\Windows\system32\drivers\cxavxbar.sys []
S2 CXTUNE;Conexant 2388x Tuner; C:\Windows\system32\drivers\CX88TUNE_IBV32.sys [2006-11-02 17664]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [2007-08-13 41984]
S3 aa23m8fx;aa23m8fx; C:\Windows\system32\drivers\aa23m8fx.sys []
S3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\Windows\system32\DRIVERS\Amusbprt.sys [2007-05-15 14336]
S3 atc9pp91;atc9pp91; C:\Windows\system32\drivers\atc9pp91.sys []
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2009-09-30 103440]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-10-27 6573568]
S3 CrystalSysInfo;CrystalSysInfo; \??\e:\Program Files\MediaCoder\SysInfo.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-05-29 27672]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2008-11-11 25280]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\Windows\system32\DRIVERS\MSIRCOMM.sys [2008-01-21 24064]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 pwdrvio;pwdrvio; \??\C:\Windows\system32\pwdrvio.sys [2009-12-21 16456]
S3 pwdspio;pwdspio; \??\C:\Windows\system32\pwdspio.sys [2009-12-21 11088]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-04-11 15872]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2010-10-08 100560]
S3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys []
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys [2010-09-20 16560]
S3 vmusb;VMware USB Client Driver; C:\Windows\System32\Drivers\vmusb.sys [2010-09-20 31280]
S3 WINUSB;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUSB.SYS [2009-04-11 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-10-27 176128]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-01-19 1803224]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 11736]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Secunia Update Agent;Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [2010-12-21 399416]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files\VMware\VMware Player\vmware-authd.exe [2010-09-21 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\Windows\system32\vmnetdhcp.exe [2010-09-21 334384]
R2 VMUSBArbService;VMware USB Arbitration Service; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
R2 VMware NAT Service;VMware NAT Service; C:\Windows\system32\vmnat.exe [2010-09-21 404016]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
S2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1c9de051e6229f3;Google Update Service (gupdate1c9de051e6229f3); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-26 133104]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 NisSrv;@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S3 Secunia PSI Agent;Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-12-08 628736]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S3 ufad-ws60;VMware Agent Service; C:\Program Files\VMware\VMware Player\vmware-ufad.exe [2010-08-19 191024]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

[motji]

Ahoj
Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix
-pžejmenujte combofix na žižala.com

[sunv]

Nejsem si jist jestli jsem to s tím přejmenováním na žížala.com pochopil?
Windows update hlásí chybu 80246008 mělo by to být něco s Služby inteligentního přenosu na pozadí (BITS), ale to taky nepomohlo.
Je zajímavé, že vše jde jen ne aktualizace od programů Microsoftu?

Tady je log:

ComboFix 11-03-09.01 - Milan 09.03.2011 23:17:04.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3326.2275 [GMT 1:00]
Spuštěný z: c:\users\Milan\Desktop\žižala.com.exe
AV: Microsoft Security Essentials *Enabled/Outdated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: COMODO Firewall *Enabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE}
SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28}
SP: Microsoft Security Essentials *Enabled/Outdated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-09 do 2011-03-09 )))))))))))))))))))))))))))))))
.
.
2011-03-09 22:20 . 2011-03-09 22:21 -------- d-----w- c:\users\Milan\AppData\Local\temp
2011-03-09 22:20 . 2011-03-09 22:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-03-09 22:20 . 2011-03-09 22:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-09 22:15 . 2011-03-09 22:21 -------- d-----w- C:\žižala.com
2011-03-09 21:41 . 2010-11-30 09:43 439632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-03-09 21:41 . 2010-11-30 09:43 439632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{936A0B44-E501-473E-BAEE-199AE33D33E9}\gapaengine.dll
2011-03-09 21:41 . 2010-11-30 09:43 439632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2C49A74B-7C94-4025-B75F-4A5463F8B93B}\gapaengine.dll
2011-03-09 11:41 . 2011-03-09 11:43 -------- d-----w- c:\program files\Microsoft Security Client
2011-03-02 15:40 . 2011-03-02 15:40 -------- d-----w- c:\program files\Siano Mobile Silicon
2011-03-02 15:40 . 2011-03-02 15:40 -------- d-----w- c:\program files\Common Files\Siano Mobile Silicon
2011-03-02 15:39 . 2011-03-02 15:39 -------- d-----w- c:\program files\NewSoft
2011-02-27 09:28 . 2011-02-27 09:28 -------- d-----w- c:\users\Milan\AppData\Roaming\vghd
2011-02-27 09:24 . 2011-02-27 09:26 7 ----a-w- c:\windows\treeskp.sys
2011-02-27 09:24 . 2011-02-27 09:26 7 ----a-w- c:\windows\sbacknt.bin
2011-02-23 10:23 . 2011-02-23 10:23 -------- d-----w- c:\programdata\WindowsSearch
2011-02-23 08:59 . 2010-02-04 09:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2011-02-23 08:59 . 2010-02-04 09:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2011-02-23 08:59 . 2010-02-04 09:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2011-02-22 19:11 . 2011-02-22 19:11 -------- d-----w- c:\program files\Download Manager
2011-02-19 19:57 . 2011-02-19 21:45 -------- d-----w- c:\users\Milan\AppData\Local\Microsoft Games
2011-02-15 13:44 . 2009-07-14 17:48 64512 ----a-w- c:\windows\system32\WUDFSvc.dll
2011-02-15 13:44 . 2009-07-14 17:48 39936 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2011-02-15 13:44 . 2009-07-14 17:45 92672 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2011-02-15 13:44 . 2009-07-14 17:45 132224 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2011-02-15 13:44 . 2009-07-14 17:48 567808 ----a-w- c:\windows\system32\WUDFx.dll
2011-02-15 13:44 . 2009-07-14 17:48 162304 ----a-w- c:\windows\system32\WUDFPlatform.dll
2011-02-15 13:44 . 2009-07-14 17:45 195584 ----a-w- c:\windows\system32\WUDFHost.exe
2011-02-15 13:14 . 2011-02-15 13:14 -------- d-----w- c:\program files\Common Files\PCSuite
2011-02-15 13:14 . 2011-02-15 13:14 -------- d-----w- c:\program files\Common Files\Nokia
2011-02-15 13:13 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2011-02-15 13:13 . 2011-02-15 13:13 -------- d-----w- c:\program files\PC Connectivity Solution
2011-02-15 13:10 . 2011-02-15 13:14 -------- d-----w- c:\program files\Nokia
2011-02-14 20:04 . 2010-12-07 18:40 183808 ----a-w- c:\windows\system32\xvidvfw.dll
2011-02-14 20:04 . 2010-12-07 18:22 810496 ----a-w- c:\windows\system32\xvidcore.dll
2011-02-14 20:04 . 2010-11-03 19:08 237568 ----a-w- c:\windows\system32\yv12vfw.dll
2011-02-14 20:04 . 2010-01-17 16:18 151552 ----a-w- c:\windows\system32\ac3acm.acm
2011-02-14 20:04 . 2006-10-18 19:05 232448 ----a-w- c:\windows\system32\mp3fhg.acm
2011-02-14 20:04 . 2011-01-28 08:00 80896 ----a-w- c:\windows\system32\ff_vfw.dll
2011-02-14 20:04 . 2011-03-02 14:28 -------- d-----w- c:\program files\K-Lite Codec Pack
2011-02-14 14:33 . 2011-02-14 16:53 -------- d-----w- c:\users\Milan\AppData\Roaming\MOBILedit
2011-02-14 14:32 . 2011-02-14 14:32 -------- d-----w- c:\program files\COMPELSON Labs
2011-02-14 14:23 . 2011-02-14 14:30 -------- d-----w- c:\program files\Common Files\LogoManager
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-09 10:40 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-18 16:49 . 2009-03-01 19:42 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-02-17 23:13 . 2008-08-27 20:44 270904 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-02-05 10:18 . 2011-02-05 10:18 22 --sha-w- c:\users\Milan\AppData\Roaming\Sys6925.Config Collection.sys
2011-01-28 10:23 . 2008-08-27 20:48 138056 ----a-w- c:\users\Milan\AppData\Roaming\PnkBstrK.sys
2011-01-13 16:44 . 2010-03-03 15:54 285480 ----a-w- c:\windows\system32\guard32.dll
2011-01-13 16:44 . 2010-03-03 15:53 80064 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-13 16:44 . 2010-03-03 15:53 34744 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-13 16:44 . 2010-03-03 15:53 17256 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-01-13 16:44 . 2010-03-23 16:39 236600 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-12-28 15:55 . 2011-01-12 13:34 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-20 17:09 . 2009-10-12 11:43 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2009-10-12 11:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-14 14:49 . 2011-01-12 13:34 1169408 ----a-w- c:\windows\system32\sdclt.exe
2006-05-03 10:06 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\System32\nbDX.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 4468736]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-19 2548552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-26 98304]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"ChangeFilterMerit"="c:\program files\NewSoft\Presto! PVR\ChangeFilterMerit.exe" [2007-06-08 51280]
"Presto! PVR Monitor"="c:\program files\NewSoft\Presto! PVR\Monitor.exe" [2009-02-20 157520]
"SmsIrProcess"="c:\program files\Siano Mobile Silicon\SMS\SmsIrProcess.exe" [2009-12-10 81920]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Windows Mobile Device Center"=%windir%\WindowsMobile\wmdc.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Samsung PanelMgr"=c:\windows\Samsung\PanelMgr\SSMMgr.exe /autorun
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1617985853-1512789681-1251605036-1000]
"EnableNotificationsRef"=dword:00000001
.
R1 MpKsl17aa2b2d;MpKsl17aa2b2d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B93765CA-1DA2-4C82-8A82-BCBD13B6CFF6}\MpKsl17aa2b2d.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9de051e6229f3;Google Update Service (gupdate1c9de051e6229f3);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 133104]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2009-12-21 16456]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2009-12-21 11088]
R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2010-12-21 987704]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-10-08 100560]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2010-02-03 40560]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-14 691696]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-01-13 236600]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-01-13 34744]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-10-27 176128]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2010-12-21 399416]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2007-08-13 5120]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2010-09-21 70704]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-10-27 6573568]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-10-27 229888]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [2007-10-31 46592]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-09-24 99856]
S3 smsbda;SMS Digital Video;c:\windows\system32\drivers\smsbda.sys [2009-09-17 51872]
S3 VRVD302;VRVD302;c:\windows\system32\DRIVERS\VRVD302.sys [2008-08-31 11296]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'
.
2011-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 13:22]
.
2011-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-26 13:22]
.
2011-03-09 c:\windows\Tasks\User_Feed_Synchronization-{ACD3081E-137A-4415-A280-DF4AC784C662}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://battlefield.play4free.com/en/
uInternet Settings,ProxyServer = 10.0.14.1:3128
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
LSP: c:\program files\VMware\VMware Player\vsocklib.dll
TCP: {B34111F9-934E-414C-A437-0D91D4D067C2} = 193.179.148.42,212.71.128.9
DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - hxxps://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.42.2.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-09 23:20
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory:
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,1e,ca,a3,86,3d,2d,40,89,d4,8c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,1e,ca,a3,86,3d,2d,40,89,d4,8c,\
.
[HKEY_USERS\S-1-5-21-1617985853-1512789681-1251605036-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-1617985853-1512789681-1251605036-1000\Software\SecuROM\License information*]
"datasecu"=hex:d2,8e,58,5d,33,e5,b2,55,40,2c,aa,1a,f8,e3,2e,33,d4,d9,27,92,e1,
ac,c3,c5,e9,7a,0d,f4,54,cf,9a,c9,26,60,14,e2,33,d2,29,ad,19,3f,f6,4e,5a,a4,\
"rkeysecu"=hex:21,2e,7e,94,ec,0a,72,67,ae,52,2d,bb,61,68,9a,a1
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(708)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(1760)
c:\windows\system32\guard32.dll
.
Celkový čas: 2011-03-09 23:22:26
ComboFix-quarantined-files.txt 2011-03-09 22:22
ComboFix2.txt 2011-03-09 21:50
.
Před spuštěním: Volných bajtů: 59 232 763 904
Po spuštění: Volných bajtů: 59 178 094 592
.
- - End Of File - - 600E62B97B84436CCADBA6E51C8A26C5

[motji]

Aktualizace blokovával vir, tad ho však nevidím . Nicméně Gmeru se něco nelíbí

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.




Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

[sunv]

MBAM i Spybota jsem zkoušel. Zkusím toho Gmera. Pokouším se ty jednotlivé aktualizace nainstalovat ručně, je možné, že se to při některé seklo a již to nepustí další. Nejde totiž pustit služba BITS. Večer se mi, ale zničeho nic podařilo aktualizovat antivir (essentials)?

log z MBAM:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 6009

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

10.3.2011 11:05:21
mbam-log-2011-03-10 (11-05-21).txt

Typ kontroly: Úplný test (C:\|E:\|G:\|H:\|)
Testované objekty: 334840
Uplynulý čas: 1 hodin, 7 minut, 53 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

čisté jako křišťál

[motji]

Uvidíme, co najde Gmer

[sunv]

log z gmr:
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2011-03-10 11:24:22
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD502IJ rev.1AA01112
Running: gmer.exe; Driver: C:\Users\Milan\AppData\Local\Temp\aglcypow.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 09: copy of MBR

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 86EFE1F8
Device \Driver\atapi \Device\Ide\IdePort0 86EFE1F8
Device \Driver\atapi \Device\Ide\IdePort1 86EFE1F8
Device \Driver\atapi \Device\Ide\IdePort2 86EFE1F8
Device \Driver\atapi \Device\Ide\IdePort3 86EFE1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 86EFE1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-4 86EFE1F8
Device \Driver\JRAID \Device\Scsi\JRAID1Port4Path0Target0Lun0 86EFF1F8
Device \Driver\ay1kq56c \Device\Scsi\ay1kq56c1 88055500
Device \Driver\JRAID \Device\Scsi\JRAID1 86EFF1F8
Device \Driver\ay1kq56c \Device\Scsi\ay1kq56c1Port6Path0Target0Lun0 88055500
Device \FileSystem\Ntfs \Ntfs 86F001F8

AttachedDevice \Driver\tdx \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 VMkbd.sys

---- EOF - GMER 1.0.15 ----

[sunv]

Jak nejlíp poslat ten velký log? Je to velký jako prasátko...

[motji]

zabalte do raru a upněte zde do přílohy

[sunv]

log v raru

[sunv]

Ahoj. Myslím, že se mi počítač podařilo opravit. Vrátil jsem windows až do února před aktualizaci kb890830 (nástroj na odstranění škodlivého softwaru). Systém si sám znovu tuto aktualiza stáhl a naistaloval a po restartu to vypadá, že to bude ok. Nyní si stahuje nějakých 127 MB MS essentials, tak uvidímjak to bude potom...

[sunv]

Tak kolize způsobuje antivir Essentials. Aktualizace systému a antiviru asi používají stejnou službu a tak se to pere. Konkrétně šlo o KB2310138(Definition1.97.840.0 a 1.99.1034.0) pro antivir.

[motji]

S tím jsem se zatím nesetkala. Takže je vše v pořádku?

[sunv]

Vše vypadá v pořádku a aktualizace jdou jak mají.
Moc, moc děkuji

[motji]

Není zač