kryptik infiltrace - kontrola logu

[holobit]

dobrý den, měl jsem v pc trojský kůň kryptik.MLH. Projel jsem pc combofixem a zdá se, že je to ok přesto však prosím o kontrolu logu, díky!

Logfile of random's system information tool 1.08 (written by random/random)
Run by bbb at 2011-04-09 22:33:30
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 29 GB (38%) free of 76 GB
Total RAM: 2047 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:33:37, on 9.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\FeedReader30\feedreader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerBlock\peerblock.exe
C:\Program Files\Codebox\BitMeter\BitMeter2.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
G:\_Backup\Apps\rsit\RSIT(1).exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\trend micro\bbb.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.3.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [UpdateReminder] C:\Program Files\Eset\UpdateReminder.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1993962763-1580818891-725345543-1013\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - http://dlm.tools.akamai.com/dlmanager/v ... .2.4.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 7935226609
O17 - HKLM\System\CCS\Services\Tcpip\..\{B92577DB-566C-465F-91C3-6E7BB1CC55C4}: NameServer = 93.190.56.17,93.190.56.41
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 9742 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-02-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files\Seznam.cz\core.3.dll [2010-10-06 1164568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2007-08-23 949376]
"LXSUPMON"=C:\WINDOWS\system32\LXSUPMON.EXE [2001-10-09 818688]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2007-09-26 734264]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]
""= []
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-14 500208]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-07-22 402432]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"UpdateReminder"=C:\Program Files\Eset\UpdateReminder.exe [2010-11-03 413696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-12-30 19972712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-03-26 13891176]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2011-02-24 1753192]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"feedreader.exe"=C:\Program Files\FeedReader30\feedreader.exe [2009-03-29 2058240]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-08-24 247144]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"PeerBlock"=C:\Program Files\PeerBlock\peerblock.exe [2010-11-06 1867888]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bitmeter2.lnk - C:\Program Files\Codebox\BitMeter\BitMeter2.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=181
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDriveAutoRun"=67108863
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\LEXPPS.EXE"="C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Konzola Microsoft Management Console"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Documents and Settings\bbb\Plocha\utorrent14981\utorrent.exe"="C:\Documents and Settings\bbb\Plocha\utorrent14981\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Documents and Settings\bbb\Plocha\utorrent-lite\utorrent.exe"="C:\Documents and Settings\bbb\Plocha\utorrent-lite\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Pidgin\pidgin.exe"="C:\Program Files\Pidgin\pidgin.exe:*:Enabled:Pidgin"
"C:\Program Files\ASUS\WL-520GC Wireless Router Utilities\Discovery.exe"="C:\Program Files\ASUS\WL-520GC Wireless Router Utilities\Discovery.exe:*:Enabled:ASUS Device Discovery Application"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\GAMES\pga\bin\TW2008.exe"="C:\GAMES\pga\bin\TW2008.exe:*:Enabled:Tiger Woods PGA TOUR(R) 08"
"G:\uComplete\Crysis2.PC.CLONEDVD-ALI213.NET\crysis2_ALI213.NET\bin32\Crysis2.exe"="G:\uComplete\Crysis2.PC.CLONEDVD-ALI213.NET\crysis2_ALI213.NET\bin32\Crysis2.exe:*:Enabled:Crysis2"
"C:\GAMES\crysis2\bin32\Crysis2.exe"="C:\GAMES\crysis2\bin32\Crysis2.exe:*:Enabled:Crysis2"
"G:\uComplete\Crysis2.PC.CLONEDVD-ALI213.NET\crysis2\bin32\Crysis2.exe"="G:\uComplete\Crysis2.PC.CLONEDVD-ALI213.NET\crysis2\bin32\Crysis2.exe:*:Enabled:Crysis2"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\GAMES\Dragon Age 2\bin_ship\DragonAge2.exe"="C:\GAMES\Dragon Age 2\bin_ship\DragonAge2.exe:*:Enabled:Dragon Age II"
"C:\GAMES\Dragon Age 2\DragonAge2Launcher.exe"="C:\GAMES\Dragon Age 2\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Launcher"

======List of files/folders created in the last 1 months======

2011-04-09 22:33:30 ----D---- C:\rsit
2011-04-07 19:27:48 ----D---- C:\Documents and Settings\bbb\Data aplikací\Rovio
2011-04-05 19:06:14 ----D---- C:\Documents and Settings\bbb\Data aplikací\dingogames
2011-04-05 19:06:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\dingogames
2011-04-02 11:24:50 ----D---- C:\Documents and Settings\bbb\Data aplikací\runic games
2011-04-02 01:08:11 ----RA---- C:\WINDOWS\system32\tmpBFBF.tmp
2011-04-02 01:08:11 ----RA---- C:\WINDOWS\system32\tmpBFBE.tmp
2011-03-30 19:31:21 ----ASH---- C:\hiberfil.sys
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvgenco322060.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvdispco3220140.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvcuda.dll
2011-03-30 19:25:32 ----AH---- C:\WINDOWS\system32\hamachi.sys
2011-03-30 19:24:38 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-03-30 19:21:36 ----A---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-03-28 23:54:46 ----D---- C:\Program Files\Common Files\Skype
2011-03-28 23:54:42 ----RD---- C:\Program Files\Skype
2011-03-28 16:09:47 ----A---- C:\WINDOWS\system32\SmartDefragBootTime.exe
2011-03-28 16:09:47 ----A---- C:\WINDOWS\system32\drivers\SmartDefragDriver.sys
2011-03-27 22:12:03 ----A---- C:\WINDOWS\system32\nvapi.dll
2011-03-26 01:47:42 ----A---- C:\WINDOWS\system32\nvwddi.dll
2011-03-26 01:47:42 ----A---- C:\WINDOWS\system32\easyUpdatusAPIU.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvmctray.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvmccs.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvcpl.dll
2011-03-26 01:47:14 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2011-03-26 01:47:14 ----A---- C:\WINDOWS\system32\nvcolor.exe
2011-03-25 11:05:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\pdf995
2011-03-24 18:04:31 ----D---- C:\Documents and Settings\bbb\Data aplikací\.doomseeker
2011-03-24 16:13:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2524375$
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\javaws.exe
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\javaw.exe
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 months======

2011-04-09 22:33:37 ----D---- C:\Program Files\Trend Micro
2011-04-09 22:33:28 ----D---- C:\Program Files\PeerBlock
2011-04-09 22:33:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\Bitmeter2
2011-04-09 22:33:10 ----D---- C:\Documents and Settings\bbb\Data aplikací\Skype
2011-04-09 22:27:25 ----D---- C:\WINDOWS\temp
2011-04-09 22:03:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-04-09 21:51:36 ----D---- C:\Documents and Settings\bbb\Data aplikací\uTorrent
2011-04-09 21:50:23 ----D---- C:\GAMES
2011-04-09 19:17:57 ----D---- C:\Program Files\PowerISO
2011-04-09 19:01:51 ----D---- C:\Documents and Settings\bbb\Data aplikací\.purple
2011-04-09 16:08:58 ----D---- C:\Documents and Settings\bbb\Data aplikací\skypePM
2011-04-09 15:48:13 ----D---- C:\WINDOWS
2011-04-09 15:47:33 ----D---- C:\Program Files\CCleaner
2011-04-05 20:12:38 ----D---- C:\WINDOWS\Prefetch
2011-04-05 19:06:15 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-05 17:51:30 ----D---- C:\WINDOWS\system32\drivers
2011-04-04 10:02:55 ----D---- C:\Documents and Settings\bbb\Data aplikací\gtk-2.0
2011-04-03 10:58:29 ----D---- C:\Program Files\CDBurnerXP
2011-04-02 11:17:36 ----SHD---- C:\WINDOWS\Installer
2011-04-02 11:17:36 ----D---- C:\Config.Msi
2011-04-02 11:17:34 ----D---- C:\WINDOWS\WinSxS
2011-04-02 11:17:22 ----D---- C:\WINDOWS\system32
2011-04-02 11:17:22 ----D---- C:\WINDOWS\inf
2011-04-02 01:08:12 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2011-04-02 01:08:12 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2011-04-02 01:08:11 ----D---- C:\WINDOWS\system32\DirectX
2011-04-02 01:06:28 ----RSD---- C:\WINDOWS\assembly
2011-04-01 23:38:54 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-04-01 23:26:12 ----HD---- C:\Program Files\InstallShield Installation Information
2011-03-31 16:33:59 ----D---- C:\Program Files\Steam
2011-03-31 16:33:55 ----D---- C:\WINDOWS\Minidump
2011-03-30 21:46:12 ----D---- C:\Temp
2011-03-30 19:33:31 ----SD---- C:\WINDOWS\Tasks
2011-03-30 19:30:02 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-03-30 19:29:34 ----D---- C:\WINDOWS\Help
2011-03-30 19:29:29 ----D---- C:\Program Files\NVIDIA Corporation
2011-03-30 19:29:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA
2011-03-30 19:29:25 ----D---- C:\Documents and Settings
2011-03-30 19:25:30 ----DC---- C:\WINDOWS\system32\dllcache
2011-03-30 19:24:34 ----D---- C:\Program Files\LogMeIn Hamachi
2011-03-29 02:03:44 ----D---- C:\Program Files\Adobe
2011-03-28 23:54:46 ----D---- C:\Program Files\Common Files
2011-03-28 23:54:42 ----D---- C:\Program Files
2011-03-28 23:54:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-03-28 16:09:58 ----D---- C:\Documents and Settings\bbb\Data aplikací\IObit
2011-03-28 16:09:43 ----D---- C:\Program Files\IObit
2011-03-27 19:41:17 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-27 17:29:44 ----D---- C:\Program Files\uTorrent
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-03-24 16:12:02 ----D---- C:\WINDOWS\$hf_mig$
2011-03-22 12:21:05 ----D---- C:\Program Files\Mozilla Firefox
2011-03-21 20:26:15 ----A---- C:\WINDOWS\win.ini
2011-03-19 04:18:05 ----D---- C:\Program Files\DOSBox-0.74
2011-03-17 22:07:38 ----D---- C:\Documents and Settings\bbb\Data aplikací\XnView
2011-03-16 11:30:59 ----D---- C:\Documents and Settings\bbb\Data aplikací\vlc
2011-03-15 12:16:53 ----SHD---- C:\System Volume Information
2011-03-15 12:16:53 ----D---- C:\WINDOWS\system32\Restore
2011-03-15 11:35:23 ----D---- C:\WINDOWS\usgwmt
2011-03-15 10:22:08 ----RSD---- C:\WINDOWS\Fonts
2011-03-14 14:05:05 ----D---- C:\Program Files\Common Files\Adobe
2011-03-14 14:04:00 ----D---- C:\Documents and Settings\bbb\Data aplikací\Adobe
2011-03-14 01:50:13 ----D---- C:\WINDOWS\Debug
2011-03-12 15:37:29 ----D---- C:\Program Files\Pidgin
2011-03-11 17:45:49 ----D---- C:\Program Files\Common Files\Java
2011-03-11 17:45:29 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 sbp2port;Ovladač sběrnice pro přenos dat zařízení podporujícího protokol SBP-2; C:\WINDOWS\system32\DRIVERS\sbp2port.sys [2008-04-14 43904]
R0 SmartDefragDriver;SmartDefragDriver; C:\WINDOWS\System32\Drivers\SmartDefragDriver.sys [2011-02-23 13496]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2007-12-26 715248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2007-08-23 15424]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2010-04-12 59388]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2007-08-23 512096]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-06-14 279712]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-09-20 25888]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-12-30 6290024]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2009-06-17 28560]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-03-26 12492096]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2006-09-11 19968]
R3 pbfilter;pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys []
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-09-28 47360]
R3 sftplay;sftplay; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftplayXP.sys []
R3 sftvol;sftvol; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftvolXP.sys []
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-09-26 20240]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 sftfs;sftfs; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftfsXP.sys []
S3 Sftredir;Sftredir; C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys [2009-09-23 21864]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\WINDOWS\system32\DRIVERS\xusb21.sys [2007-02-26 61984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2001-10-09 300544]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2007-08-23 552064]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-03-26 155752]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-26 2218600]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-12-08 75064]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
R2 UPHClean;User Profile Hive Cleanup; C:\Program Files\UPHClean\uphclean.exe [2005-04-27 241725]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe [2009-09-23 203608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 1242504]
S2 sftlist;Application Virtualization Client; C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe [2009-09-23 447832]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-25 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-07-20 121360]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-05-06 2785582]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[holobit]

Tady je log, po projetí combofixem, ten předchozí je z doby infekce, nějak jsem to v rozčilení zaměnil


Logfile of random's system information tool 1.08 (written by random/random)
Run by bbb at 2011-04-10 01:18:57
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 29 GB (38%) free of 76 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:19:00, on 10.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\FeedReader30\feedreader.exe
C:\Program Files\PeerBlock\peerblock.exe
C:\Program Files\Codebox\BitMeter\BitMeter2.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
G:\_Backup\Apps\rsit\RSIT(1).exe
C:\Program Files\trend micro\bbb.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.3.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [UpdateReminder] C:\Program Files\Eset\UpdateReminder.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
O4 - HKUS\S-1-5-21-1993962763-1580818891-725345543-1013\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1993962763-1580818891-725345543-500\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - http://dlm.tools.akamai.com/dlmanager/v ... .2.4.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 7935226609
O17 - HKLM\System\CCS\Services\Tcpip\..\{B92577DB-566C-465F-91C3-6E7BB1CC55C4}: NameServer = 93.190.56.17,93.190.56.41
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 8815 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-02-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Ukazatel S-Rank - C:\Program Files\Seznam.cz\core.3.dll [2010-10-06 1164568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2007-08-23 949376]
"LXSUPMON"=C:\WINDOWS\system32\LXSUPMON.EXE [2001-10-09 818688]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2007-09-26 734264]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-14 500208]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-07-22 402432]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"UpdateReminder"=C:\Program Files\Eset\UpdateReminder.exe [2010-11-03 413696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-12-30 19972712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-03-26 13891176]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2011-02-24 1753192]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"feedreader.exe"=C:\Program Files\FeedReader30\feedreader.exe [2009-03-29 2058240]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-08-24 247144]
"PeerBlock"=C:\Program Files\PeerBlock\peerblock.exe [2010-11-06 1867888]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bitmeter2.lnk - C:\Program Files\Codebox\BitMeter\BitMeter2.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\LEXPPS.EXE"="C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Konzola Microsoft Management Console"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\Pidgin\pidgin.exe"="C:\Program Files\Pidgin\pidgin.exe:*:Enabled:Pidgin"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\GAMES\pga\bin\TW2008.exe"="C:\GAMES\pga\bin\TW2008.exe:*:Enabled:Tiger Woods PGA TOUR(R) 08"
"C:\GAMES\crysis2\bin32\Crysis2.exe"="C:\GAMES\crysis2\bin32\Crysis2.exe:*:Enabled:Crysis2"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\GAMES\Dragon Age 2\bin_ship\DragonAge2.exe"="C:\GAMES\Dragon Age 2\bin_ship\DragonAge2.exe:*:Enabled:Dragon Age II"
"C:\GAMES\Dragon Age 2\DragonAge2Launcher.exe"="C:\GAMES\Dragon Age 2\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Launcher"

======List of files/folders created in the last 1 months======

2011-04-10 00:49:14 ----SHD---- C:\RECYCLER
2011-04-10 00:44:17 ----A---- C:\ComboFix.txt
2011-04-10 00:34:02 ----D---- C:\WINDOWS\temp
2011-04-10 00:14:09 ----A---- C:\Boot.bak
2011-04-10 00:14:01 ----RASHD---- C:\cmdcons
2011-04-10 00:10:59 ----A---- C:\WINDOWS\PEV.exe
2011-04-10 00:10:59 ----A---- C:\WINDOWS\MBR.exe
2011-04-10 00:09:16 ----D---- C:\Qoobox
2011-04-09 23:00:05 ----D---- C:\Program Files\Enigma Software Group
2011-04-09 22:59:46 ----D---- C:\WINDOWS\41EBC322660F4D16A0DF53147210CBDB.TMP
2011-04-09 22:33:30 ----D---- C:\rsit
2011-04-07 19:27:48 ----D---- C:\Documents and Settings\bbb\Data aplikací\Rovio
2011-04-05 19:06:14 ----D---- C:\Documents and Settings\bbb\Data aplikací\dingogames
2011-04-05 19:06:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\dingogames
2011-04-02 11:24:50 ----D---- C:\Documents and Settings\bbb\Data aplikací\runic games
2011-04-02 01:08:11 ----RA---- C:\WINDOWS\system32\tmpBFBF.tmp
2011-04-02 01:08:11 ----RA---- C:\WINDOWS\system32\tmpBFBE.tmp
2011-03-30 19:31:21 ----ASH---- C:\hiberfil.sys
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvgenco322060.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvdispco3220140.dll
2011-03-30 19:27:55 ----A---- C:\WINDOWS\system32\nvcuda.dll
2011-03-30 19:25:32 ----AH---- C:\WINDOWS\system32\hamachi.sys
2011-03-30 19:24:38 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-03-30 19:21:36 ----A---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-03-28 23:54:46 ----D---- C:\Program Files\Common Files\Skype
2011-03-28 23:54:42 ----RD---- C:\Program Files\Skype
2011-03-28 16:09:47 ----A---- C:\WINDOWS\system32\SmartDefragBootTime.exe
2011-03-28 16:09:47 ----A---- C:\WINDOWS\system32\drivers\SmartDefragDriver.sys
2011-03-27 22:12:03 ----A---- C:\WINDOWS\system32\nvapi.dll
2011-03-26 01:47:42 ----A---- C:\WINDOWS\system32\nvwddi.dll
2011-03-26 01:47:42 ----A---- C:\WINDOWS\system32\easyUpdatusAPIU.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvmctray.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvmccs.dll
2011-03-26 01:47:16 ----A---- C:\WINDOWS\system32\nvcpl.dll
2011-03-26 01:47:14 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2011-03-26 01:47:14 ----A---- C:\WINDOWS\system32\nvcolor.exe
2011-03-25 11:05:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\pdf995
2011-03-24 18:04:31 ----D---- C:\Documents and Settings\bbb\Data aplikací\.doomseeker
2011-03-24 16:13:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2524375$
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\javaws.exe
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\javaw.exe
2011-03-11 17:45:31 ----A---- C:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 months======

2011-04-10 01:19:00 ----D---- C:\Program Files\Trend Micro
2011-04-10 01:18:52 ----D---- C:\Program Files\PeerBlock
2011-04-10 01:18:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Bitmeter2
2011-04-10 00:46:47 ----D---- C:\WINDOWS\system32\drivers
2011-04-10 00:46:29 ----D---- C:\WINDOWS
2011-04-10 00:45:09 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-10 00:43:29 ----SD---- C:\WINDOWS\Tasks
2011-04-10 00:43:07 ----D---- C:\WINDOWS\erdnt
2011-04-10 00:42:31 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-10 00:36:12 ----A---- C:\WINDOWS\system.ini
2011-04-10 00:35:45 ----D---- C:\WINDOWS\system32\drivers\etc
2011-04-10 00:33:23 ----DC---- C:\WINDOWS\system32\dllcache
2011-04-10 00:33:22 ----D---- C:\WINDOWS\system32
2011-04-10 00:32:18 ----D---- C:\WINDOWS\AppPatch
2011-04-10 00:32:13 ----D---- C:\Program Files\Common Files
2011-04-10 00:19:44 ----D---- C:\Program Files\PowerISO
2011-04-10 00:19:44 ----D---- C:\Program Files
2011-04-10 00:19:44 ----D---- C:\Config.Msi
2011-04-10 00:18:15 ----D---- C:\Documents and Settings\bbb\Data aplikací\.purple
2011-04-10 00:18:08 ----D---- C:\WINDOWS\system32\config
2011-04-10 00:14:50 ----D---- C:\Documents and Settings\bbb\Data aplikací\Skype
2011-04-10 00:14:10 ----RASH---- C:\boot.ini
2011-04-10 00:08:58 ----D---- C:\Documents and Settings\bbb\Data aplikací\skypePM
2011-04-09 23:42:21 ----SHD---- C:\WINDOWS\Installer
2011-04-09 23:11:41 ----D---- C:\Documents and Settings\bbb\Data aplikací\uTorrent
2011-04-09 22:59:43 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-04-09 22:03:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-04-09 21:50:23 ----D---- C:\GAMES
2011-04-09 15:47:33 ----D---- C:\Program Files\CCleaner
2011-04-05 20:12:38 ----D---- C:\WINDOWS\Prefetch
2011-04-04 10:02:55 ----D---- C:\Documents and Settings\bbb\Data aplikací\gtk-2.0
2011-04-03 10:58:29 ----D---- C:\Program Files\CDBurnerXP
2011-04-02 11:17:34 ----D---- C:\WINDOWS\WinSxS
2011-04-02 11:17:22 ----D---- C:\WINDOWS\inf
2011-04-02 01:08:12 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2011-04-02 01:08:12 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2011-04-02 01:08:11 ----D---- C:\WINDOWS\system32\DirectX
2011-04-02 01:06:28 ----RSD---- C:\WINDOWS\assembly
2011-04-01 23:26:12 ----HD---- C:\Program Files\InstallShield Installation Information
2011-03-31 16:33:59 ----D---- C:\Program Files\Steam
2011-03-31 16:33:55 ----D---- C:\WINDOWS\Minidump
2011-03-30 21:46:12 ----D---- C:\Temp
2011-03-30 19:29:34 ----D---- C:\WINDOWS\Help
2011-03-30 19:29:29 ----D---- C:\Program Files\NVIDIA Corporation
2011-03-30 19:29:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA
2011-03-30 19:29:25 ----D---- C:\Documents and Settings
2011-03-30 19:24:34 ----D---- C:\Program Files\LogMeIn Hamachi
2011-03-29 02:03:44 ----D---- C:\Program Files\Adobe
2011-03-28 23:54:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-03-28 16:09:58 ----D---- C:\Documents and Settings\bbb\Data aplikací\IObit
2011-03-28 16:09:43 ----D---- C:\Program Files\IObit
2011-03-27 19:41:17 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-27 17:29:44 ----D---- C:\Program Files\uTorrent
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2011-03-26 10:34:00 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-03-24 16:12:02 ----D---- C:\WINDOWS\$hf_mig$
2011-03-22 12:21:05 ----D---- C:\Program Files\Mozilla Firefox
2011-03-21 20:26:15 ----A---- C:\WINDOWS\win.ini
2011-03-19 04:18:05 ----D---- C:\Program Files\DOSBox-0.74
2011-03-17 22:07:38 ----D---- C:\Documents and Settings\bbb\Data aplikací\XnView
2011-03-16 11:30:59 ----D---- C:\Documents and Settings\bbb\Data aplikací\vlc
2011-03-15 12:16:53 ----SHD---- C:\System Volume Information
2011-03-15 12:16:53 ----D---- C:\WINDOWS\system32\Restore
2011-03-15 10:22:08 ----RSD---- C:\WINDOWS\Fonts
2011-03-14 14:05:05 ----D---- C:\Program Files\Common Files\Adobe
2011-03-14 14:04:00 ----D---- C:\Documents and Settings\bbb\Data aplikací\Adobe
2011-03-14 01:50:13 ----D---- C:\WINDOWS\Debug
2011-03-12 15:37:29 ----D---- C:\Program Files\Pidgin
2011-03-11 17:45:49 ----D---- C:\Program Files\Common Files\Java
2011-03-11 17:45:29 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 sbp2port;Ovladač sběrnice pro přenos dat zařízení podporujícího protokol SBP-2; C:\WINDOWS\system32\DRIVERS\sbp2port.sys [2008-04-14 43904]
R0 SmartDefragDriver;SmartDefragDriver; C:\WINDOWS\System32\Drivers\SmartDefragDriver.sys [2011-02-23 13496]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2007-12-26 715248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2007-08-23 15424]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2010-04-12 59388]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2007-08-23 512096]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-06-14 279712]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-09-20 25888]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-12-30 6290024]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2009-06-17 28560]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-03-26 12492096]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2006-09-11 19968]
R3 pbfilter;pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys []
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-09-28 47360]
R3 sftplay;sftplay; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftplayXP.sys []
R3 sftvol;sftvol; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftvolXP.sys []
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 catchme;catchme; \??\C:\grinder\catchme.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-09-26 20240]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 sftfs;sftfs; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftfsXP.sys []
S3 Sftredir;Sftredir; C:\WINDOWS\system32\DRIVERS\Sftredirxp.sys [2009-09-23 21864]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\WINDOWS\system32\DRIVERS\xusb21.sys [2007-02-26 61984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2001-10-09 300544]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2007-08-23 552064]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-03-26 155752]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-26 2218600]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-12-08 75064]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
R2 UPHClean;User Profile Hive Cleanup; C:\Program Files\UPHClean\uphclean.exe [2005-04-27 241725]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe [2009-09-23 203608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 1242504]
S2 sftlist;Application Virtualization Client; C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe [2009-09-23 447832]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-25 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2009-07-20 121360]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-05-06 2785582]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Predpokladam ze ten NOD32 mate legalni = zakoupena licence

Vy umite pouzivate ComboFix - cist jeho log a nasledne vytvorit skript na docisteni ze si jej tak pouzivate CFko neni hracka - vizte nize

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Poprosim tedy o log z CFka, je ulozen v c:\combofix.txt

[holobit]

Dobrý den,

ano nod je legální, jediný co v pc nemám legální je Marvel Vs Capcom (hraju přes emulator, což vlastně porušuje pravidla užívání...)
Já bych se do toho CF ani nepouštěl, ale nešlo mi nikde úspěšně odeslat dotaz, ať už tady nebo na jiných fórech. Vždycky to zkončilo spadnutím stránky.
Tak to byla poslední možnost, jinak ten program nepoužívám, ale už jsem s tím jednou pracoval, tak jsem to prostě zkusil, protože už mě nic nenapadalo.

tadyk ten log:

c:\documents and settings\bbb\Data aplikací\.#
c:\documents and settings\bbb\WINDOWS
c:\windows\system32\dllcache\web
c:\windows\system32\Proxy.dll
c:\windows\usgwmt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-09 do 2011-04-09 )))))))))))))))))))))))))))))))
.
.
2011-04-09 21:00 . 2011-04-09 21:43 -------- d-----w- c:\program files\Enigma Software Group
2011-04-09 20:59 . 2011-04-09 21:41 -------- d-----w- c:\windows\41EBC322660F4D16A0DF53147210CBDB.TMP
2011-04-09 20:33 . 2011-04-09 20:33 -------- d-----w- C:\rsit
2011-04-07 17:27 . 2011-04-07 17:27 -------- d-----w- c:\documents and settings\bbb\Data aplikací\Rovio
2011-04-05 17:06 . 2011-04-05 17:06 -------- d-----w- c:\documents and settings\bbb\Data aplikací\dingogames
2011-04-05 17:06 . 2011-04-05 17:06 -------- d-----w- c:\documents and settings\All Users\Data aplikací\dingogames
2011-04-02 09:24 . 2011-04-02 14:55 -------- d-----w- c:\documents and settings\bbb\Data aplikací\runic games
2011-04-01 23:08 . 2009-06-03 07:25 809496 ----a-r- c:\windows\system32\tmpBFBF.tmp
2011-04-01 23:08 . 2009-06-03 07:25 809496 ----a-r- c:\windows\system32\tmpBFBE.tmp
2011-03-30 17:29 . 2011-03-31 09:08 -------- d-----w- c:\documents and settings\UpdatusUser
2011-03-30 17:27 . 2011-03-26 08:34 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-03-30 17:27 . 2011-03-26 08:34 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-03-30 17:27 . 2011-03-26 08:34 5210112 ----a-w- c:\windows\system32\nvcuda.dll
2011-03-30 17:27 . 2011-03-26 08:34 14852096 ----a-w- c:\windows\system32\nvoglnt.dll
2011-03-30 17:25 . 2009-03-18 15:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-30 17:24 . 2011-03-26 08:34 4110208 ----a-w- c:\windows\system32\nv4_disp.dll
2011-03-30 17:24 . 2008-04-14 06:51 4274816 -c--a-w- c:\windows\system32\dllcache\nv4_disp.dll
2011-03-30 17:21 . 2011-03-26 08:34 12492096 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-03-30 17:21 . 2008-04-13 20:04 1897408 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-03-28 21:54 . 2011-03-28 21:54 -------- d-----w- c:\program files\Common Files\Skype
2011-03-28 21:54 . 2011-03-28 21:54 -------- d-----r- c:\program files\Skype
2011-03-28 14:09 . 2011-02-23 15:04 13496 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-03-28 14:09 . 2011-02-23 14:54 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-03-27 20:12 . 2011-03-26 08:34 2027008 ----a-w- c:\windows\system32\nvapi.dll
2011-03-25 23:47 . 2011-03-25 23:47 81920 ----a-w- c:\windows\system32\nvwddi.dll
2011-03-25 23:47 . 2011-03-25 23:47 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-03-25 23:47 . 2011-03-25 23:47 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-03-25 23:47 . 2011-03-25 23:47 13891176 ----a-w- c:\windows\system32\nvcpl.dll
2011-03-25 23:47 . 2011-03-25 23:47 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-03-25 23:47 . 2011-03-25 23:47 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2011-03-25 23:47 . 2011-03-25 23:47 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-03-25 09:05 . 2011-03-25 09:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\pdf995
2011-03-24 21:29 . 2011-03-24 21:45 -------- d-----w- c:\documents and settings\bbb\Local Settings\Data aplikací\DFUserRoot
2011-03-24 16:04 . 2011-03-24 16:04 -------- d-----w- c:\documents and settings\bbb\Data aplikací\.doomseeker
2011-03-22 10:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-03-22 10:21 . 2011-03-18 17:55 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-03-22 10:21 . 2011-03-18 17:55 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-03-22 10:21 . 2011-03-18 17:55 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-03-22 10:21 . 2011-03-18 17:55 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-03-22 10:21 . 2011-03-18 17:55 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-03-22 10:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-03-22 10:21 . 2011-03-18 17:55 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-03-12 11:28 . 2011-03-12 11:28 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-03-12 11:28 . 2011-03-12 11:28 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-01 23:08 . 2007-08-23 16:42 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-01 23:08 . 2007-08-23 16:42 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-03-26 08:34 . 2010-01-21 11:51 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-03-26 08:34 . 2010-01-21 11:51 13000704 ----a-w- c:\windows\system32\nvcompiler.dll
2011-03-26 08:34 . 2009-06-10 04:03 2770536 ----a-w- c:\windows\system32\nvcuvid.dll
2011-03-26 08:34 . 2009-06-10 04:03 2074216 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 08:27 . 2011-02-27 19:06 837736 ----a-w- c:\windows\system32\nvgenco322040.dll
2011-02-22 07:58 . 2011-02-22 07:58 86016 ----a-w- c:\windows\system32\frapsvid.dll
2011-02-09 13:53 . 2002-09-20 16:04 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2002-09-20 16:03 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 20:40 . 2010-05-11 14:30 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 18:19 . 2007-08-23 14:53 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-02-02 07:58 . 2007-08-23 12:38 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2007-08-23 12:38 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-09-20 16:04 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-03-18 17:55 . 2011-03-22 10:21 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2008-04-14 06:52 60416 --sha-w- c:\windows\ServicePackFiles\i386\msimn.exe
2008-04-14 06:52 1695232 --sha-w- c:\windows\ServicePackFiles\i386\msmsgs.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2009-03-29 2058240]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]
"PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-06 1867888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-08-23 949376]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818688]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 734264]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-14 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"UpdateReminder"="c:\program files\Eset\UpdateReminder.exe" [2010-11-03 413696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"RTHDCPL"="RTHDCPL.EXE" [2010-12-30 19972712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
"NvMediaCenter"="NvMCTray.dll" [2011-03-25 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-03-25 13891176]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-02-24 1753192]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bitmeter2.lnk - c:\program files\Codebox\BitMeter\BitMeter2.exe [2010-8-28 1462272]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-22 813584]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 10:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Pidgin\\pidgin.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\GAMES\\pga\\bin\\TW2008.exe"=
"c:\\GAMES\\crysis2\\bin32\\Crysis2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57763:TCP"= 57763:TCP:Pando Media Booster
"57763:UDP"= 57763:UDP:Pando Media Booster
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [28.3.2011 16:09 13496]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.12.2007 14:38 715248]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [23.8.2007 15:34 15424]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [30.3.2011 19:29 2218600]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24.8.2010 11:38 92008]
R3 sftplay;sftplay;c:\program files\Microsoft Application Virtualization Client\drivers\sftplayxp.sys [23.9.2009 15:04 190312]
R3 sftvol;sftvol;c:\program files\Microsoft Application Virtualization Client\drivers\SftVolXP.sys [23.9.2009 15:04 14680]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [23.9.2009 15:04 203608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.3.2011 15:41 1242504]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [23.9.2009 15:04 447832]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [22.1.2009 12:07 1691480]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 sftfs;sftfs;c:\program files\Microsoft Application Virtualization Client\drivers\SftFSXP.sys [23.9.2009 15:04 543064]
S3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [23.9.2009 15:05 21864]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [25.10.2001 14:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - uphcleanhlp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-03-14 11:55]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {B92577DB-566C-465F-91C3-6E7BB1CC55C4} = 93.190.56.17,93.190.56.41
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\bbb\Data aplikací\Mozilla\Firefox\Profiles\5zv3l1ug.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8 ... &gfns=1&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-10 00:37
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1993962763-1580818891-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:cc,fb,e0,d0,e3,cc,04,e4,34,7e,e4,03,e0,5d,a4,15,cc,3b,b6,9e,dc,50,aa,
89,22,d6,64,0d,1b,36,bd,c7,22,dc,10,fc,00,7e,09,7c,7c,23,f0,9b,0b,1d,db,bc,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
.
[HKEY_USERS\S-1-5-21-1993962763-1580818891-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:7d,6d,19,73,84,47,ea,a3,14,e0,f2,44,ac,3a,bb,4b,25,e3,62,d5,82,
c8,3c,e4,af,02,9e,9f,a8,dc,d9,1c,5a,5e,6e,c4,23,b3,11,b2,e2,f1,31,4a,64,89,\
"rkeysecu"=hex:93,d5,ad,3d,7a,68,5d,37,ab,b8,09,9f,6e,b8,67,a0
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="0C5093D5848E8AE3D597911BB13B4F81ED7D626E80BBC1A216EAC61A5AE6A0CA9CF1128176770E169425AA26C0E87C8BDF7A52C47D65DC7F86C94100D8C7A3885E4A98172C25A2FC04309AB7A26EA78CA74FB5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933FEBC9E127BECC74CA9C6AECB7A5D1407BA7FD869164D679487E06F8E45BD2F880219C249813A65B32030AB7EA4404DA46B9B9B5E9D994D77B08BA93648DBAB2E54082E9DFAB638C6A365F4633088018EC4017A56AEC91BD22FD1B8DBD6C4F5DCB5CE87CD701C46C022960AB30AA4F5F3E0F52E487090B040B7373AC93061F7FA13426C222538C915628CA75722675677FDDAB4D59BE1C9AC234F8D80F36C1CE080CD3D96462A002BCF2951E64BF5D2AB80A35256CC8A257AED43D6B4A875D3DD32EE205C60E7AADD795DCB2F3DCA1C9A70D90DD305A7887D3AD17DCAB7E094B303B87E58E6BA10FA92B0A23393B369BDF897318C272E3A7ECBCAAF61ED665619EFCF8423AE3E7847EF40A3A74E517686EA8FCCF2FB6306BB0D945B46FC9195369BEFA387F3E333790EBA60F6CE1B0158B98434AEB1623C650927B6FDF84354ABCBE6900854EE913C0DE1AE3CDED84B0C7DCEFD19D5992F217290383FDD2D9509E997C55852FA68AEAC0EA9CBA7A91D6D715B05415F4CB7069B721CF5885961D505F77E61547212E257AAAF2ABA7E41BC762968E92490B1A38002E3C038A1C78BCD92BD3EA417EAE19437E110099E832C11CE0D0963D27B7ABB08D275143755181A84474172FDD6A316C527EB6C223AE5E67296C8BB50F97D8F61F019251C22DD6580A5EECE8F391BADFE2ADE1F773A0646D07488321C141860800A69D8AAC3334BCD25FEB087FC28519DD73F41E0DE9A9C3B51DA2E1DB52636EAB053818C59E09046D6DD737790A39D70E195D4F385298015A4077D8ECDF9BF3736FC524382A698D690ABD3C4E3D7D0DBBF9F429A122A2756230550FD51D6CC1633BC67216335ED84E93E75286D844D552CCED4916A08EE8B47853A50B676D247051D3B4D26B23FE2429DDD2EA65B1A6A2349BBEAF92456D6536AB33AFA06E91F4A5FB1C5763ADD9DB88578B78D04E2B8E8E78A8D2ED18168C6C91B471DA64F88E8F58FD884D7BF72B3E71378A299F5F382B938B27BD9B88C6A6F2ED6206D6500880A7CAB0690FEB45C675FF96DABC5E33AFC21E7D777671ECAD8121A0DE3AE1794F48834B257D8C81F5F7599F63C6BE21FAA848EBC5A9D8CB539501A6D84D472BDC6A33F481830AA2E594E87CBC39EE1026B84DDA9270FDCBD75D32F5343A5CC77C4A36B07300AE7FC9749C8FDAAC0E1789BAADDA2F693A7B92AED0A500511F1FA6341AEB2F09023C60E28B524D2D2FBDFCDDF6D2CD3A719C6A553"
"OODEFRAG10.00.00.01WORKSTATION"="E703E9BB73404D23DBA44A0E3C47BBDEDF9C65978ACCCCEFF6AA1C3992A81FEEFDD19DC4CE2990889F797EA964727D3D1C1D1EC649804F32D691E236C4B0DF0C45D9BE3B3958AC6098048D344374CD33CA20B5A5A45FCF82EB3FA74B029ED26B4E8A23C26B3EF252F35ED0C040B41525D608A85753E76E28FCFC2DCB6D2E67D45D33F10097EBCCC71203F564374150C0DE984A037C40D93007770B121CBA25D4EB0CA89C5D98346E895000BB78478FF2B6F942D43E31D86A3740FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B555A6A0AC4980AC7933BA7FD869164D6794F436643733EEDBF11C9D028BA7631FFC54D290A0F199233FCE1BA1FEB9E032433132FED834A9B77A7E0CD707B75859FECE2E37921823D865D792D9CC5B0047A24622BF00B6A20B79E43722A3600C360195B7AAA8312725B51B3903D792F9FA1B2FB82EB5C263E0EFED61370260E51A6F0BE0ABBF4E0EEBA35E526D52E6584F4A382D47A5F3B476C10BD3DEE60715A216E72671549886C58440A75B94726A78AC83B87A9FFBA840B885D8583C3C061F26B781A4884781009331080497E641E027869A2D171E10627FF541D20D776F93B5597363A22A33996EF44591FA053226020C17B4A4B28239A74C5F738B47C8B6BD8202BF8BA3164918A6B3A38225599966B1725F04A6DB53244B8C548DCB4DF39BB836C051A9E57576302ECE93339440E5E8F86D95783B714F88A3020AB97E6A11599ADF2646A43C54549117BA2D84D473F6F891DB3F030C6470047C1E5C206FC293C10AE09818ECDF27BF7926A71144E4F6C3F30121DA4C03C011BA8C10B9093BEB3FA379D1C78CAC121E642748E32F7755B131CD5BAD12B10C3424B8C517F2E7B92C0110B801D32F5017BB37CB6A6CC9541DD835BD2BEE573A5696AA82CA1D19A725EB64A757AF42F318D5700156055F0AE36FC82CC529C006E9E21160272B04B6CAA35E0C9C3F26E212FC11CA9F369F5FE96CC220353B1EFBE04DBC8BC3F4443A42D9866A6DD87AD2FB727CA17FF0D59314BBFC25F4558482B290A147FD83D4DA33338A56230448D2CDE5398EF3DCB1B6CEBE775BC2586B4DDBD7D8E6F49998934A4CBDFBE1FC78C386027233BFD1463087C8D777A35C2F685CC59FD40EA85433B8B015190E35D8D8A6DEF641E75E0BB8B1A0E4C1DC2A9132376ED78DF0D9B15F34E32AFE4F509D1C350DB981B7425CDDC3048A96FAC0365DF25A04A309873D0F745ABB951527DBE9BA8FD24E3D74770338A15865CBD225721E884E3B0841690E3480ABD58FC68EF2455C7A164A1F81DB0E1F03B264474BC945E7830D60CB8B7CB7B2FE4F33ED143D67DF915EF49D82F3479261971B3878137E5F16674B9BDCCC41C3DF23BA"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(896)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'lsass.exe'(952)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
- - - - - - - > 'explorer.exe'(1452)
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Eset\nod32krn.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\windows\system32\PnkBstrA.exe
c:\program files\UPHClean\uphclean.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2011-04-10 00:44:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-09 22:44
.
Před spuštěním: Volných bajtů: 29 716 283 392
Po spuštění: Volných bajtů: 30 151 196 672
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /usepmtimer
.
- - End Of File - - A6786403C49DF991C744A94E24592E5B

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  File::
  c:\windows\41EBC322660F4D16A0DF53147210CBDB.TMP
  c:\windows\system32\tmpBFBF.tmp
  c:\windows\system32\tmpBFBE.tmp
  c:\windows\Tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "feedreader.exe"=-
  "TomTomHOME.exe"=-
  "PeerBlock"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "HP Software Update"=-
  "AdobeAAMUpdater-1.0"=-
  "SwitchBoard"=-
  "AdobeCS5ServiceManager"=-
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "UpdateReminder"=-
  "SunJavaUpdateSched"=-
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000000
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "5985:TCP"=-
  
  Driver::
  uphcleanhlp
  
  DDS::
  uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
  
  Firefox::
  FF - ProfilePath - c:\documents and settings\bbb\Data aplikací\Mozilla\Firefox\Profiles\5zv3l1ug.default\
  FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&o ... &gfns=1&q=
  
  RegLock::
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[holobit]

níže log. přestal se mi automaticky spuštět feedreader(rss čtečka) a peer block, ale ručně spustit jdou tak, si to znova nastavím, nevím jestli to byl záměr...
jinak samože díky za pomoc


ComboFix 11-04-08.03 - bbb 10.04.2011 17:02:08.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1501 [GMT 2:00]
Spuštěný z: c:\documents and settings\bbb\Plocha\grinder.com
Použité ovládací přepínače :: c:\docume~1\bbb\Plocha\CFScript.txt
.
.
.
FILE ::
"c:\windows\41EBC322660F4D16A0DF53147210CBDB.TMP"
"c:\windows\system32\tmpBFBE.tmp"
"c:\windows\system32\tmpBFBF.tmp"
"c:\windows\Tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\tmpBFBE.tmp
c:\windows\system32\tmpBFBF.tmp
c:\windows\Tasks\AdobeAAMUpdater-1.0-BBB-P3PMEMWH850-bbb.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_UPHCLEANHLP
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-10 do 2011-04-10 )))))))))))))))))))))))))))))))
.
.
2011-04-09 21:00 . 2011-04-09 21:43 -------- d-----w- c:\program files\Enigma Software Group
2011-04-09 20:59 . 2011-04-09 21:41 -------- d-----w- c:\windows\41EBC322660F4D16A0DF53147210CBDB.TMP
2011-04-07 17:27 . 2011-04-07 17:27 -------- d-----w- c:\documents and settings\bbb\Data aplikací\Rovio
2011-04-05 17:06 . 2011-04-05 17:06 -------- d-----w- c:\documents and settings\bbb\Data aplikací\dingogames
2011-04-05 17:06 . 2011-04-05 17:06 -------- d-----w- c:\documents and settings\All Users\Data aplikací\dingogames
2011-04-02 09:24 . 2011-04-02 14:55 -------- d-----w- c:\documents and settings\bbb\Data aplikací\runic games
2011-03-30 17:29 . 2011-03-31 09:08 -------- d-----w- c:\documents and settings\UpdatusUser
2011-03-30 17:27 . 2011-03-26 08:34 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-03-30 17:27 . 2011-03-26 08:34 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-03-30 17:27 . 2011-03-26 08:34 5210112 ----a-w- c:\windows\system32\nvcuda.dll
2011-03-30 17:27 . 2011-03-26 08:34 14852096 ----a-w- c:\windows\system32\nvoglnt.dll
2011-03-30 17:25 . 2009-03-18 15:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-30 17:24 . 2011-03-26 08:34 4110208 ----a-w- c:\windows\system32\nv4_disp.dll
2011-03-30 17:24 . 2008-04-14 06:51 4274816 -c--a-w- c:\windows\system32\dllcache\nv4_disp.dll
2011-03-30 17:21 . 2011-03-26 08:34 12492096 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-03-30 17:21 . 2008-04-13 20:04 1897408 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-03-28 21:54 . 2011-03-28 21:54 -------- d-----w- c:\program files\Common Files\Skype
2011-03-28 21:54 . 2011-03-28 21:54 -------- d-----r- c:\program files\Skype
2011-03-28 14:09 . 2011-02-23 15:04 13496 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-03-28 14:09 . 2011-02-23 14:54 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-03-27 20:12 . 2011-03-26 08:34 2027008 ----a-w- c:\windows\system32\nvapi.dll
2011-03-25 23:47 . 2011-03-25 23:47 81920 ----a-w- c:\windows\system32\nvwddi.dll
2011-03-25 23:47 . 2011-03-25 23:47 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-03-25 23:47 . 2011-03-25 23:47 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-03-25 23:47 . 2011-03-25 23:47 13891176 ----a-w- c:\windows\system32\nvcpl.dll
2011-03-25 23:47 . 2011-03-25 23:47 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-03-25 23:47 . 2011-03-25 23:47 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2011-03-25 23:47 . 2011-03-25 23:47 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-03-25 09:05 . 2011-03-25 09:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\pdf995
2011-03-24 21:29 . 2011-03-24 21:45 -------- d-----w- c:\documents and settings\bbb\Local Settings\Data aplikací\DFUserRoot
2011-03-24 16:04 . 2011-03-24 16:04 -------- d-----w- c:\documents and settings\bbb\Data aplikací\.doomseeker
2011-03-22 10:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-03-22 10:21 . 2011-03-18 17:55 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-03-22 10:21 . 2011-03-18 17:55 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-03-22 10:21 . 2011-03-18 17:55 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-03-22 10:21 . 2011-03-18 17:55 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-03-22 10:21 . 2011-03-18 17:55 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-03-22 10:21 . 2011-03-18 17:55 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-03-22 10:21 . 2011-03-18 17:55 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-03-12 11:28 . 2011-03-12 11:28 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-03-12 11:28 . 2011-03-12 11:28 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-01 23:08 . 2007-08-23 16:42 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2011-04-01 23:08 . 2007-08-23 16:42 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-03-26 08:34 . 2010-01-21 11:51 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-03-26 08:34 . 2010-01-21 11:51 13000704 ----a-w- c:\windows\system32\nvcompiler.dll
2011-03-26 08:34 . 2009-06-10 04:03 2770536 ----a-w- c:\windows\system32\nvcuvid.dll
2011-03-26 08:34 . 2009-06-10 04:03 2074216 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 08:27 . 2011-02-27 19:06 837736 ----a-w- c:\windows\system32\nvgenco322040.dll
2011-02-22 07:58 . 2011-02-22 07:58 86016 ----a-w- c:\windows\system32\frapsvid.dll
2011-02-09 13:53 . 2002-09-20 16:04 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2002-09-20 16:03 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 20:40 . 2010-05-11 14:30 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 18:19 . 2007-08-23 14:53 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-02-02 07:58 . 2007-08-23 12:38 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2007-08-23 12:38 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-09-20 16:04 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-03-18 17:55 . 2011-03-22 10:21 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2008-04-14 06:52 60416 --sha-w- c:\windows\ServicePackFiles\i386\msimn.exe
2008-04-14 06:52 1695232 --sha-w- c:\windows\ServicePackFiles\i386\msmsgs.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-08-23 949376]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818688]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 734264]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"RTHDCPL"="RTHDCPL.EXE" [2010-12-30 19972712]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
"NvMediaCenter"="NvMCTray.dll" [2011-03-25 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-03-25 13891176]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-02-24 1753192]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bitmeter2.lnk - c:\program files\Codebox\BitMeter\BitMeter2.exe [2010-8-28 1462272]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-22 813584]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 10:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Pidgin\\pidgin.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\GAMES\\pga\\bin\\TW2008.exe"=
"c:\\GAMES\\crysis2\\bin32\\Crysis2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57763:TCP"= 57763:TCP:Pando Media Booster
"57763:UDP"= 57763:UDP:Pando Media Booster
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [28.3.2011 16:09 13496]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.12.2007 14:38 715248]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [23.8.2007 15:34 15424]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.3.2011 15:41 1242504]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [30.3.2011 19:29 2218600]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24.8.2010 11:38 92008]
R3 sftplay;sftplay;c:\program files\Microsoft Application Virtualization Client\drivers\sftplayxp.sys [23.9.2009 15:04 190312]
R3 sftvol;sftvol;c:\program files\Microsoft Application Virtualization Client\drivers\SftVolXP.sys [23.9.2009 15:04 14680]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [23.9.2009 15:04 203608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [23.9.2009 15:04 447832]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [22.1.2009 12:07 1691480]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 sftfs;sftfs;c:\program files\Microsoft Application Virtualization Client\drivers\SftFSXP.sys [23.9.2009 15:04 543064]
S3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [23.9.2009 15:05 21864]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [25.10.2001 14:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - UPHCLEANHLP
*Deregistered* - uphcleanhlp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {B92577DB-566C-465F-91C3-6E7BB1CC55C4} = 93.190.56.17,93.190.56.41
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\bbb\Data aplikací\Mozilla\Firefox\Profiles\5zv3l1ug.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-10 17:09
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1993962763-1580818891-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:cc,fb,e0,d0,e3,cc,04,e4,34,7e,e4,03,e0,5d,a4,15,cc,3b,b6,9e,dc,50,aa,
89,22,d6,64,0d,1b,36,bd,c7,22,dc,10,fc,00,7e,09,7c,7c,23,f0,9b,0b,1d,db,bc,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
.
[HKEY_USERS\S-1-5-21-1993962763-1580818891-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:7d,6d,19,73,84,47,ea,a3,14,e0,f2,44,ac,3a,bb,4b,25,e3,62,d5,82,
c8,3c,e4,af,02,9e,9f,a8,dc,d9,1c,5a,5e,6e,c4,23,b3,11,b2,e2,f1,31,4a,64,89,\
"rkeysecu"=hex:93,d5,ad,3d,7a,68,5d,37,ab,b8,09,9f,6e,b8,67,a0
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="0C5093D5848E8AE3D597911BB13B4F81ED7D626E80BBC1A216EAC61A5AE6A0CA9CF1128176770E169425AA26C0E87C8BDF7A52C47D65DC7F86C94100D8C7A3885E4A98172C25A2FC04309AB7A26EA78CA74FB5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933FEBC9E127BECC74CA9C6AECB7A5D1407BA7FD869164D679487E06F8E45BD2F880219C249813A65B32030AB7EA4404DA46B9B9B5E9D994D77B08BA93648DBAB2E54082E9DFAB638C6A365F4633088018EC4017A56AEC91BD22FD1B8DBD6C4F5DCB5CE87CD701C46C022960AB30AA4F5F3E0F52E487090B040B7373AC93061F7FA13426C222538C915628CA75722675677FDDAB4D59BE1C9AC234F8D80F36C1CE080CD3D96462A002BCF2951E64BF5D2AB80A35256CC8A257AED43D6B4A875D3DD32EE205C60E7AADD795DCB2F3DCA1C9A70D90DD305A7887D3AD17DCAB7E094B303B87E58E6BA10FA92B0A23393B369BDF897318C272E3A7ECBCAAF61ED665619EFCF8423AE3E7847EF40A3A74E517686EA8FCCF2FB6306BB0D945B46FC9195369BEFA387F3E333790EBA60F6CE1B0158B98434AEB1623C650927B6FDF84354ABCBE6900854EE913C0DE1AE3CDED84B0C7DCEFD19D5992F217290383FDD2D9509E997C55852FA68AEAC0EA9CBA7A91D6D715B05415F4CB7069B721CF5885961D505F77E61547212E257AAAF2ABA7E41BC762968E92490B1A38002E3C038A1C78BCD92BD3EA417EAE19437E110099E832C11CE0D0963D27B7ABB08D275143755181A84474172FDD6A316C527EB6C223AE5E67296C8BB50F97D8F61F019251C22DD6580A5EECE8F391BADFE2ADE1F773A0646D07488321C141860800A69D8AAC3334BCD25FEB087FC28519DD73F41E0DE9A9C3B51DA2E1DB52636EAB053818C59E09046D6DD737790A39D70E195D4F385298015A4077D8ECDF9BF3736FC524382A698D690ABD3C4E3D7D0DBBF9F429A122A2756230550FD51D6CC1633BC67216335ED84E93E75286D844D552CCED4916A08EE8B47853A50B676D247051D3B4D26B23FE2429DDD2EA65B1A6A2349BBEAF92456D6536AB33AFA06E91F4A5FB1C5763ADD9DB88578B78D04E2B8E8E78A8D2ED18168C6C91B471DA64F88E8F58FD884D7BF72B3E71378A299F5F382B938B27BD9B88C6A6F2ED6206D6500880A7CAB0690FEB45C675FF96DABC5E33AFC21E7D777671ECAD8121A0DE3AE1794F48834B257D8C81F5F7599F63C6BE21FAA848EBC5A9D8CB539501A6D84D472BDC6A33F481830AA2E594E87CBC39EE1026B84DDA9270FDCBD75D32F5343A5CC77C4A36B07300AE7FC9749C8FDAAC0E1789BAADDA2F693A7B92AED0A500511F1FA6341AEB2F09023C60E28B524D2D2FBDFCDDF6D2CD3A719C6A553"
"OODEFRAG10.00.00.01WORKSTATION"="E703E9BB73404D23DBA44A0E3C47BBDEDF9C65978ACCCCEFF6AA1C3992A81FEEFDD19DC4CE2990889F797EA964727D3D1C1D1EC649804F32D691E236C4B0DF0C45D9BE3B3958AC6098048D344374CD33CA20B5A5A45FCF82EB3FA74B029ED26B4E8A23C26B3EF252F35ED0C040B41525D608A85753E76E28FCFC2DCB6D2E67D45D33F10097EBCCC71203F564374150C0DE984A037C40D93007770B121CBA25D4EB0CA89C5D98346E895000BB78478FF2B6F942D43E31D86A3740FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B555A6A0AC4980AC7933BA7FD869164D6794F436643733EEDBF11C9D028BA7631FFC54D290A0F199233FCE1BA1FEB9E032433132FED834A9B77A7E0CD707B75859FECE2E37921823D865D792D9CC5B0047A24622BF00B6A20B79E43722A3600C360195B7AAA8312725B51B3903D792F9FA1B2FB82EB5C263E0EFED61370260E51A6F0BE0ABBF4E0EEBA35E526D52E6584F4A382D47A5F3B476C10BD3DEE60715A216E72671549886C58440A75B94726A78AC83B87A9FFBA840B885D8583C3C061F26B781A4884781009331080497E641E027869A2D171E10627FF541D20D776F93B5597363A22A33996EF44591FA053226020C17B4A4B28239A74C5F738B47C8B6BD8202BF8BA3164918A6B3A38225599966B1725F04A6DB53244B8C548DCB4DF39BB836C051A9E57576302ECE93339440E5E8F86D95783B714F88A3020AB97E6A11599ADF2646A43C54549117BA2D84D473F6F891DB3F030C6470047C1E5C206FC293C10AE09818ECDF27BF7926A71144E4F6C3F30121DA4C03C011BA8C10B9093BEB3FA379D1C78CAC121E642748E32F7755B131CD5BAD12B10C3424B8C517F2E7B92C0110B801D32F5017BB37CB6A6CC9541DD835BD2BEE573A5696AA82CA1D19A725EB64A757AF42F318D5700156055F0AE36FC82CC529C006E9E21160272B04B6CAA35E0C9C3F26E212FC11CA9F369F5FE96CC220353B1EFBE04DBC8BC3F4443A42D9866A6DD87AD2FB727CA17FF0D59314BBFC25F4558482B290A147FD83D4DA33338A56230448D2CDE5398EF3DCB1B6CEBE775BC2586B4DDBD7D8E6F49998934A4CBDFBE1FC78C386027233BFD1463087C8D777A35C2F685CC59FD40EA85433B8B015190E35D8D8A6DEF641E75E0BB8B1A0E4C1DC2A9132376ED78DF0D9B15F34E32AFE4F509D1C350DB981B7425CDDC3048A96FAC0365DF25A04A309873D0F745ABB951527DBE9BA8FD24E3D74770338A15865CBD225721E884E3B0841690E3480ABD58FC68EF2455C7A164A1F81DB0E1F03B264474BC945E7830D60CB8B7CB7B2FE4F33ED143D67DF915EF49D82F3479261971B3878137E5F16674B9BDCCC41C3DF23BA"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(896)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'lsass.exe'(952)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
- - - - - - - > 'explorer.exe'(3776)
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\UPHClean\uphclean.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2011-04-10 17:15:48 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-10 15:15
ComboFix2.txt 2011-04-09 22:44
.
Před spuštěním: Volných bajtů: 30 250 835 968
Po spuštění: Volných bajtů: 30 243 495 936
.
- - End Of File - - 90FFBF339236412AABF32229934449E2

[vyosek]

Omlouvam se, ja mam ve zvyku mazat co nejvice veci spoustenych po startu at ma uzivatel rychlejsi nabeh OS...bud si je tedy nastavte z5 sam nebo to udelam ja pres registr...

[vyosek]

Jinak log jiz vypada cisty, jak se chova PC

[holobit]

Vše se zdá být v pořádku, ještě jednou díky!

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

A pokud nejsou problemy ci dotazy, je to z me strany vse A nemate zac, rad jsem pomohl