problem s Rootkit v system32/drivers

[Caroprd111]

Pro jednou udělám vyjímku, pokud si ovšem Windows co nejdříve obstaráte legálně

Konzolu pro zotavení neinstalujte a dejte log z ComboFixu.

[yowenka]

och dakujeeeeem moc, ja si urcite kupim windows,len teraz som trosku short of money
takze ten combofix log, hned ho urobim

tu je ten log:


ComboFix 10-03-16.02 - Evicka 16.03.2010 22:41:16.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.2046.1511 [GMT 1:00]
Running from: c:\documents and settings\Evicka\My Documents\Preberanie\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-16 to 2010-03-16 )))))))))))))))))))))))))))))))
.

2010-03-15 20:39 . 2010-03-15 20:39 -------- d-----w- c:\program files\Sophos
2010-03-15 20:04 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-03-15 20:04 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-03-15 20:04 . 2010-03-16 20:05 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-15 20:04 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-03-15 19:00 . 2010-03-15 19:00 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-15 18:59 . 2010-03-15 18:59 -------- d-----w- c:\program files\TrendMicro
2010-03-15 18:59 . 2010-03-15 18:59 -------- d-----w- c:\program files\Imagenomic
2010-03-15 18:59 . 2010-03-15 18:59 -------- d-----w- C:\!KillBox
2010-03-15 17:49 . 2010-03-15 18:59 -------- d-----w- C:\RECYCLER(2)
2010-03-15 17:02 . 2010-03-15 17:02 -------- d-----w- c:\documents and settings\Evicka\Application Data\Malwarebytes
2010-03-15 17:02 . 2010-03-15 17:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-15 16:44 . 2010-03-15 16:44 -------- d-----w- c:\documents and settings\Evicka\Local Settings\Application Data\Mozilla
2010-03-15 16:44 . 2010-03-15 18:59 -------- d-----w- c:\program files\Mozilla Firefox(2)
2010-03-15 15:57 . 2010-03-15 18:59 -------- d-----w- c:\program files\trend micro
2010-03-15 15:57 . 2010-03-15 15:58 -------- d-----w- C:\rsit
2010-03-15 14:33 . 2010-03-15 14:33 -------- d-----w- c:\program files\Avira
2010-03-15 14:33 . 2010-03-15 14:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-15 09:14 . 2010-03-16 20:54 -------- d-----w- c:\documents and settings\Evicka\Application Data\Skype
2010-03-15 09:14 . 2010-03-15 09:14 -------- d-----w- c:\program files\Common Files\Skype
2010-03-15 09:14 . 2010-03-15 09:14 -------- d-----r- c:\program files\Skype
2010-03-14 19:55 . 2010-03-14 19:55 -------- d--h--w- c:\windows\PIF
2010-03-14 18:35 . 2010-03-14 18:35 -------- d-----w- c:\documents and settings\Evicka\Local Settings\Application Data\Help
2010-03-11 16:34 . 2010-03-11 16:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-09 16:24 . 2008-04-13 23:13 14208 -c--a-w- c:\windows\system32\dllcache\wacompen.sys
2010-03-09 16:24 . 2008-04-13 23:13 14208 ----a-w- c:\windows\system32\drivers\wacompen.sys
2010-03-09 15:20 . 2010-03-09 23:14 4716 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll
2010-03-09 13:15 . 2010-03-09 13:17 -------- d-----w- c:\windows\_VOIDgewtiqmird
2010-03-09 13:15 . 2010-03-16 21:44 823296 ----a-w- c:\windows\system32\drivers\wrvkgg.sys
2010-03-08 21:32 . 2010-03-08 21:32 -------- d-----w- c:\documents and settings\Evicka\Application Data\CyberLink
2010-03-08 21:28 . 2010-03-08 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-03-08 21:27 . 2010-03-08 21:27 -------- d-----w- c:\program files\CyberLink
2010-03-07 18:12 . 2010-03-07 18:12 -------- d-----w- c:\documents and settings\Evicka\Application Data\PlayFirst
2010-03-07 18:12 . 2010-03-07 18:12 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-03-06 19:02 . 2010-03-06 19:02 -------- d-----w- c:\documents and settings\Evicka\Application Data\Total Eclipse
2010-03-05 17:39 . 2010-03-05 17:40 -------- d-----w- c:\program files\AutoCAD 2008
2010-03-05 17:39 . 2010-03-05 17:40 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-03-05 17:39 . 2010-03-05 17:39 -------- d-----w- c:\program files\Autodesk
2010-03-02 20:36 . 2010-03-02 20:36 -------- d-----w- c:\documents and settings\Evicka\Application Data\Imagenomic
2010-02-21 10:45 . 2010-02-21 10:45 -------- d-----w- c:\documents and settings\Evicka\Application Data\MAGIX
2010-02-21 10:45 . 2001-05-16 16:54 309616 ----a-w- c:\windows\system32\wmv8dmod.dll
2010-02-21 10:45 . 2001-05-11 12:18 420240 ----a-w- c:\windows\system32\mpg4c32.dll
2010-02-21 10:43 . 2010-02-21 11:31 -------- d-----w- c:\program files\MAGIX
2010-02-21 10:43 . 2007-04-27 09:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2010-02-21 10:43 . 2010-02-21 11:28 -------- d-----w- c:\program files\Common Files\MAGIX Services
2010-02-15 20:21 . 2010-02-15 20:21 -------- d-----w- c:\program files\NCH Software
2010-02-15 20:11 . 2010-02-15 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 21:18 . 2009-11-19 15:35 -------- d-----w- c:\program files\Alwil Software
2010-03-16 15:08 . 2009-11-28 09:18 -------- d-----w- c:\documents and settings\Evicka\Application Data\skypePM
2010-03-15 09:14 . 2009-11-19 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-08 21:27 . 2009-11-19 13:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-08 21:27 . 2009-11-19 13:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-06 10:16 . 2009-12-20 12:27 -------- d-----w- c:\documents and settings\Evicka\Application Data\CameraWindowDC
2010-03-06 10:13 . 2009-11-19 18:05 -------- d-----w- c:\documents and settings\Evicka\Application Data\ZoomBrowser EX
2010-03-05 17:41 . 2009-12-28 15:29 112632 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-03-05 17:28 . 2009-11-20 11:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2010-02-21 11:31 . 2010-02-21 10:44 -------- d-----w- c:\documents and settings\All Users\Application Data\MAGIX
2010-02-15 20:21 . 2010-02-15 20:21 -------- d-----w- c:\program files\NCH Software
2010-02-15 20:16 . 2009-11-18 22:38 -------- d-----w- c:\program files\totalcmd
2010-02-14 19:53 . 2010-02-14 19:52 -------- d-----w- c:\program files\The KMPlayer
2010-01-22 15:42 . 2010-01-22 15:42 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-22 15:41 . 2010-01-22 15:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-15 23:07 . 2010-01-15 23:05 152576 ----a-w- c:\documents and settings\Evicka\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-15 23:07 . 2010-01-15 23:05 79488 ----a-w- c:\documents and settings\Evicka\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-15 23:05 . 2010-01-15 23:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-15 23:05 . 2010-01-15 23:05 -------- d-----w- c:\program files\Java
2009-12-23 20:29 . 2009-12-23 20:29 16 ----a-w- c:\documents and settings\LocalService\Application Data\fvgqad.dat
2009-12-21 15:16 . 2009-12-21 15:16 16 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
.

------- Sigcheck -------

[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll

c:\windows\System32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\windows\TBPanel.exe" [2007-04-23 2173744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-02-23 7774208]
"nwiz"="nwiz.exe" [2007-02-23 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-02-23 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-15 149280]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-09-08 44544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15.3.2010 21:04 108289]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13.11.2009 12:31 92008]
S0 FGXSCSI;FGXSCSI;c:\windows\system32\DRIVERS\fgxscsi.sys --> c:\windows\system32\DRIVERS\fgxscsi.sys [?]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [25.11.2009 23:45 691696]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\2C.tmp --> c:\windows\system32\2C.tmp [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - wrvkgg
.
Contents of the 'Scheduled Tasks' folder

2010-03-16 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-12-26 21:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Evicka\Application Data\Mozilla\Firefox\Profiles\guexenzp.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-16 22:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\2C.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wrvkgg]

.
Completion time: 2010-03-16 22:45:25
ComboFix-quarantined-files.txt 2010-03-16 21:45
ComboFix2.txt 2010-03-15 17:29

Pre-Run: 23 081 078 784 bytes free
Post-Run: 23 067 885 568 bytes free

- - End Of File - - 1D1CCD4816CE08413AAD3C0C96F6D232

[Caroprd111]

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Driver::
MEMSWEEP2
wrvkgg

File::
c:\windows\system32\2C.tmp 
C:\WINDOWS\system32\drivers\wrvkgg.sys

Restore::
c:\windows\System32\regsvc.dll

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[yowenka]

dakujeeeem moc moc moc, uz to tam nemam
jezisimaria konecne
Len jeden problem stale ostal a to je to divne dlhe pipnutie po zapnuti pocitaca,ked uz sa mi zobrazi pracovna plocha.
Ale inak super, ja Vam tak moc dakujem.

tu je ten log:

ComboFix 10-03-16.02 - Evicka 17.03.2010 22:11:18.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.2046.1585 [GMT 1:00]
Running from: c:\documents and settings\Evicka\My Documents\Preberanie\ComboFix.exe
Command switches used :: c:\documents and settings\Evicka\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\system32\2C.tmp"
"c:\windows\system32\drivers\wrvkgg.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\wrvkgg.sys

Infected copy of c:\windows\System32\regsvc.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\regsvc.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Legacy_WRVKGG
-------\Service_MEMSWEEP2
-------\Service_wrvkgg


((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-17 21:11 . 2008-04-14 04:42 59904 ----a-w- c:\windows\system32\regsvc.dll
2010-03-15 20:39 . 2010-03-15 20:39 -------- d-----w- c:\program files\Sophos
2010-03-15 20:04 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-03-15 20:04 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-03-15 20:04 . 2010-03-16 20:05 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-15 20:04 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-03-15 19:00 . 2010-03-15 19:00 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-15 18:59 . 2010-03-15 18:59 -------- d-----w- c:\program files\TrendMicro
2010-03-15 18:59 . 2010-03-15 18:59 -------- d-----w- c:\program files\Imagenomic
2010-03-15 17:49 . 2010-03-15 18:59 -------- d-----w- C:\RECYCLER(2)
2010-03-15 17:02 . 2010-03-15 17:02 -------- d-----w- c:\documents and settings\Evicka\Application Data\Malwarebytes
2010-03-15 17:02 . 2010-03-15 17:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-15 16:44 . 2010-03-15 16:44 -------- d-----w- c:\documents and settings\Evicka\Local Settings\Application Data\Mozilla
2010-03-15 16:44 . 2010-03-15 18:59 -------- d-----w- c:\program files\Mozilla Firefox(2)
2010-03-15 15:57 . 2010-03-15 18:59 -------- d-----w- c:\program files\trend micro
2010-03-15 15:57 . 2010-03-15 15:58 -------- d-----w- C:\rsit
2010-03-15 14:33 . 2010-03-15 14:33 -------- d-----w- c:\program files\Avira
2010-03-15 14:33 . 2010-03-15 14:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-15 09:14 . 2010-03-17 21:03 -------- d-----w- c:\documents and settings\Evicka\Application Data\Skype
2010-03-15 09:14 . 2010-03-15 09:14 -------- d-----w- c:\program files\Common Files\Skype
2010-03-15 09:14 . 2010-03-15 09:14 -------- d-----r- c:\program files\Skype
2010-03-14 19:55 . 2010-03-14 19:55 -------- d--h--w- c:\windows\PIF
2010-03-14 18:35 . 2010-03-14 18:35 -------- d-----w- c:\documents and settings\Evicka\Local Settings\Application Data\Help
2010-03-11 16:34 . 2010-03-11 16:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-09 16:24 . 2008-04-13 23:13 14208 -c--a-w- c:\windows\system32\dllcache\wacompen.sys
2010-03-09 16:24 . 2008-04-13 23:13 14208 ----a-w- c:\windows\system32\drivers\wacompen.sys
2010-03-09 15:20 . 2010-03-09 23:14 4716 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll
2010-03-09 13:15 . 2010-03-09 13:17 -------- d-----w- c:\windows\_VOIDgewtiqmird
2010-03-08 21:32 . 2010-03-08 21:32 -------- d-----w- c:\documents and settings\Evicka\Application Data\CyberLink
2010-03-08 21:28 . 2010-03-08 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-03-08 21:27 . 2010-03-08 21:27 -------- d-----w- c:\program files\CyberLink
2010-03-07 18:12 . 2010-03-07 18:12 -------- d-----w- c:\documents and settings\Evicka\Application Data\PlayFirst
2010-03-07 18:12 . 2010-03-07 18:12 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-03-06 19:02 . 2010-03-06 19:02 -------- d-----w- c:\documents and settings\Evicka\Application Data\Total Eclipse
2010-03-05 17:39 . 2010-03-05 17:40 -------- d-----w- c:\program files\AutoCAD 2008
2010-03-05 17:39 . 2010-03-05 17:40 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-03-05 17:39 . 2010-03-05 17:39 -------- d-----w- c:\program files\Autodesk
2010-03-02 20:36 . 2010-03-02 20:36 -------- d-----w- c:\documents and settings\Evicka\Application Data\Imagenomic
2010-02-21 10:45 . 2010-02-21 10:45 -------- d-----w- c:\documents and settings\Evicka\Application Data\MAGIX
2010-02-21 10:45 . 2001-05-16 16:54 309616 ----a-w- c:\windows\system32\wmv8dmod.dll
2010-02-21 10:45 . 2001-05-11 12:18 420240 ----a-w- c:\windows\system32\mpg4c32.dll
2010-02-21 10:43 . 2010-02-21 11:31 -------- d-----w- c:\program files\MAGIX
2010-02-21 10:43 . 2007-04-27 09:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2010-02-21 10:43 . 2010-02-21 11:28 -------- d-----w- c:\program files\Common Files\MAGIX Services

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 16:15 . 2009-11-28 09:18 -------- d-----w- c:\documents and settings\Evicka\Application Data\skypePM
2010-03-16 21:18 . 2009-11-19 15:35 -------- d-----w- c:\program files\Alwil Software
2010-03-15 09:14 . 2009-11-19 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-08 21:27 . 2009-11-19 13:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-08 21:27 . 2009-11-19 13:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-06 10:16 . 2009-12-20 12:27 -------- d-----w- c:\documents and settings\Evicka\Application Data\CameraWindowDC
2010-03-06 10:13 . 2009-11-19 18:05 -------- d-----w- c:\documents and settings\Evicka\Application Data\ZoomBrowser EX
2010-03-05 17:41 . 2009-12-28 15:29 112632 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-03-05 17:28 . 2009-11-20 11:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2010-02-21 11:31 . 2010-02-21 10:44 -------- d-----w- c:\documents and settings\All Users\Application Data\MAGIX
2010-02-15 20:21 . 2010-02-15 20:21 -------- d-----w- c:\program files\NCH Software
2010-02-15 20:16 . 2009-11-18 22:38 -------- d-----w- c:\program files\totalcmd
2010-02-15 20:11 . 2010-02-15 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2010-02-14 19:53 . 2010-02-14 19:52 -------- d-----w- c:\program files\The KMPlayer
2010-01-22 15:42 . 2010-01-22 15:42 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-22 15:41 . 2010-01-22 15:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-15 23:07 . 2010-01-15 23:05 152576 ----a-w- c:\documents and settings\Evicka\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-15 23:07 . 2010-01-15 23:05 79488 ----a-w- c:\documents and settings\Evicka\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-15 23:05 . 2010-01-15 23:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-23 20:29 . 2009-12-23 20:29 16 ----a-w- c:\documents and settings\LocalService\Application Data\fvgqad.dat
2009-12-21 15:16 . 2009-12-21 15:16 16 ----a-w- c:\documents and settings\NetworkService\Application Data\fvgqad.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-03-16_21.44.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-17 21:16 . 2010-03-17 21:16 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\windows\TBPanel.exe" [2007-04-23 2173744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-02-23 7774208]
"nwiz"="nwiz.exe" [2007-02-23 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-02-23 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-15 149280]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-09-08 44544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [25.11.2009 23:45 691696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15.3.2010 21:04 108289]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13.11.2009 12:31 92008]
S0 FGXSCSI;FGXSCSI;c:\windows\system32\DRIVERS\fgxscsi.sys --> c:\windows\system32\DRIVERS\fgxscsi.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-17 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-12-26 21:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Evicka\Application Data\Mozilla\Firefox\Profiles\guexenzp.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2788)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\oodag.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-17 22:18:11 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-17 21:18
ComboFix2.txt 2010-03-16 21:45
ComboFix3.txt 2010-03-15 17:29

Pre-Run: 22 974 410 752 bytes free
Post-Run: 22 892 077 056 bytes free

- - End Of File - - A34F5FEBCD1539448E6BFCDE5A966C9C

[Caroprd111]

Poprosím o nový log z RSIT.

[yowenka]

Neviem nikde najst,kde by som mohla stiahnut RSIT
myslela som, ze tu http://images.malwareremoval.com/random/RSIT.exe ale nefunguje to

[Caroprd111]

http://www.edisk.cz/stahni/48909/RSIT.exe_763.58KB.html

[yowenka]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Evicka at 2010-03-19 21:59:22
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 22 GB (27%) free of 80 GB
Total RAM: 2046 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:36, on 19.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\vVX3000.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Evicka\My Documents\Preberanie\RSIT.exe
C:\Program Files\trend micro\Evicka.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF29852.cfxxe" /c "C:\ComboFix\C.bat"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - C:\Program Files\StreamingStar\HiDownload\hidownload.exe (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 8373 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-24 263280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-24 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-16 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-16 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-11-24 263280]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Gainward"=C:\WINDOWS\TBPanel.exe [2007-04-23 2173744]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-02-23 7774208]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-02-23 81920]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-11-14 16270848]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"VX3000"=C:\WINDOWS\vVX3000.exe [2007-04-10 709992]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2007-05-17 279912]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-01-16 149280]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-01-12 32768]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"combofix"=C:\ComboFix\CF29852.cfxxe /c C:\ComboFix\C.bat []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2009-11-13 247144]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-08-24 133120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutorun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceClassicControlPanel"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.scr - open - "C:\WINDOWS\system32\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-03-19 21:59:22 ----D---- C:\rsit
2010-03-19 21:59:22 ----D---- C:\Program Files\trend micro
2010-03-17 22:50:13 ----D---- C:\Documents and Settings\Evicka\Application Data\Yahoo!
2010-03-17 22:50:13 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2010-03-17 22:50:12 ----D---- C:\Program Files\Yahoo!
2010-03-17 22:50:11 ----D---- C:\Program Files\CCleaner
2010-03-17 22:46:05 ----SHD---- C:\RECYCLER
2010-03-17 22:11:17 ----N---- C:\WINDOWS\system32\regsvc.dll
2010-03-16 22:24:41 ----D---- C:\Program Files\Mozilla Firefox
2010-03-15 21:39:30 ----D---- C:\Program Files\Sophos
2010-03-15 19:59:41 ----D---- C:\Program Files\TrendMicro
2010-03-15 19:59:41 ----D---- C:\Program Files\Imagenomic
2010-03-15 18:02:26 ----D---- C:\Documents and Settings\Evicka\Application Data\Malwarebytes
2010-03-15 18:02:21 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-03-15 17:44:00 ----D---- C:\Program Files\Mozilla Firefox(2)
2010-03-15 15:33:57 ----D---- C:\Program Files\Avira
2010-03-15 15:33:57 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2010-03-15 10:14:20 ----D---- C:\Documents and Settings\Evicka\Application Data\Skype
2010-03-15 10:14:14 ----D---- C:\Program Files\Common Files\Skype
2010-03-15 10:14:11 ----RD---- C:\Program Files\Skype
2010-03-14 20:55:47 ----HD---- C:\WINDOWS\PIF
2010-03-14 19:35:33 ----D---- C:\Documents and Settings\Evicka\Application Data\Help
2010-03-11 17:34:54 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-03-10 19:32:29 ----A---- C:\WINDOWS\system32\tmp.txt
2010-03-09 16:20:05 ----A---- C:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
2010-03-09 14:15:32 ----D---- C:\WINDOWS\_VOIDgewtiqmird
2010-03-08 22:32:36 ----D---- C:\Documents and Settings\Evicka\Application Data\CyberLink
2010-03-08 22:28:13 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2010-03-08 22:27:32 ----D---- C:\Program Files\CyberLink
2010-03-07 19:12:37 ----D---- C:\Documents and Settings\Evicka\Application Data\PlayFirst
2010-03-07 19:12:37 ----D---- C:\Documents and Settings\All Users\Application Data\PlayFirst
2010-03-06 20:02:01 ----D---- C:\Documents and Settings\Evicka\Application Data\Total Eclipse
2010-03-05 18:39:47 ----D---- C:\Program Files\AutoCAD 2008
2010-03-05 18:39:12 ----D---- C:\Program Files\Common Files\Autodesk Shared
2010-03-05 18:39:12 ----D---- C:\Program Files\Autodesk
2010-03-02 21:36:04 ----D---- C:\Documents and Settings\Evicka\Application Data\Imagenomic
2010-02-21 11:45:46 ----D---- C:\Documents and Settings\Evicka\Application Data\MAGIX
2010-02-21 11:45:41 ----A---- C:\WINDOWS\system32\wmv8dmod.dll
2010-02-21 11:45:41 ----A---- C:\WINDOWS\system32\mpg4c32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\TTIC32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\TTI32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\STRING32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\MXRestore.exe
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\mgxcdr.txt
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLTPO32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLRES32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLRD32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLPTL32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLPRJ32.dll
2010-02-21 11:44:42 ----A---- C:\WINDOWS\system32\DLLPRF32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLPNT32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLMSC32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLIX.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLISO32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLIO32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLIMG32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLDRV32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLDIR32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLDEV32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLCPY32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLCDF32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLCDA32.dll
2010-02-21 11:44:41 ----A---- C:\WINDOWS\system32\DLLAV32.dll
2010-02-21 11:44:24 ----A---- C:\WINDOWS\system32\msxml4a.dll
2010-02-21 11:44:05 ----D---- C:\Documents and Settings\All Users\Application Data\MAGIX
2010-02-21 11:43:43 ----D---- C:\Program Files\MAGIX
2010-02-21 11:43:43 ----A---- C:\WINDOWS\system32\DLLDEV32i.dll
2010-02-21 11:43:21 ----D---- C:\Program Files\Common Files\MAGIX Services

======List of files/folders modified in the last 1 months======

2010-03-19 21:59:24 ----D---- C:\WINDOWS\Prefetch
2010-03-19 21:59:22 ----RD---- C:\Program Files
2010-03-19 21:58:06 ----D---- C:\WINDOWS\Temp
2010-03-19 21:58:04 ----A---- C:\WINDOWS\DFC.INI
2010-03-19 21:58:02 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-19 17:46:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-19 16:01:49 ----D---- C:\Documents and Settings\Evicka\Application Data\skypePM
2010-03-18 22:59:14 ----D---- C:\hidownload
2010-03-18 09:37:36 ----D---- C:\WINDOWS
2010-03-18 09:37:16 ----SHD---- C:\System Volume Information
2010-03-18 09:37:16 ----D---- C:\WINDOWS\system32\Restore
2010-03-17 22:52:39 ----D---- C:\WINDOWS\Debug
2010-03-17 22:32:10 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-03-17 22:18:14 ----D---- C:\WINDOWS\system32\drivers
2010-03-17 22:16:19 ----A---- C:\WINDOWS\system.ini
2010-03-17 22:14:39 ----D---- C:\WINDOWS\system32\config
2010-03-17 22:13:41 ----D---- C:\WINDOWS\system32
2010-03-17 22:13:41 ----D---- C:\WINDOWS\AppPatch
2010-03-17 22:13:38 ----D---- C:\Program Files\Common Files
2010-03-16 22:18:27 ----D---- C:\Program Files\Alwil Software
2010-03-16 22:03:56 ----D---- C:\Documents and Settings
2010-03-15 21:04:35 ----HD---- C:\WINDOWS\inf
2010-03-15 21:03:37 ----SHD---- C:\WINDOWS\Installer
2010-03-15 21:03:34 ----D---- C:\WINDOWS\WinSxS
2010-03-15 20:00:04 ----D---- C:\WINDOWS\system32\wbem
2010-03-15 20:00:04 ----D---- C:\WINDOWS\Registration
2010-03-15 17:44:06 ----D---- C:\Documents and Settings\Evicka\Application Data\Mozilla
2010-03-15 10:14:11 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2010-03-11 10:07:19 ----D---- C:\WINDOWS\Minidump
2010-03-09 17:24:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-09 16:17:42 ----SD---- C:\WINDOWS\Tasks
2010-03-08 22:27:35 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-08 22:27:13 ----D---- C:\Program Files\Common Files\InstallShield
2010-03-06 11:16:53 ----D---- C:\Documents and Settings\Evicka\Application Data\CameraWindowDC
2010-03-06 11:13:41 ----D---- C:\Documents and Settings\Evicka\Application Data\ZoomBrowser EX
2010-03-05 18:41:18 ----RSD---- C:\WINDOWS\assembly
2010-03-05 18:41:18 ----D---- C:\WINDOWS\Microsoft.NET
2010-03-05 18:40:43 ----RSD---- C:\WINDOWS\Fonts
2010-03-05 18:40:01 ----D---- C:\WINDOWS\Help
2010-03-05 18:39:03 ----D---- C:\WINDOWS\system32\DirectX
2010-03-05 18:28:14 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2010-03-02 21:36:04 ----SD---- C:\Documents and Settings\Evicka\Application Data\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-03-16 56816]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 NuidFltr;NUID filter driver; C:\WINDOWS\system32\DRIVERS\NuidFltr.sys [2009-05-09 14736]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-02-23 5749472]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2006-11-08 21760]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 VX3000;VX-3000; C:\WINDOWS\system32\DRIVERS\VX3000.sys [2007-04-10 1966696]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-11-25 691696]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2007-01-31 96370]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-16 153376]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-02-23 168004]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2004-05-17 184320]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2010-03-05 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-26 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-19 182768]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Caroprd111]

Otevřete si Poznámkový blok a zkopírujte do něj text (z bílého políčka):

Kód: Vybrat vše

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

Nyní uložte jako (typ: všechny soubory) kde za název souboru zadáte "smazani.reg" bez uvozovek, klik na uložit, pak na soubor standardně 2X kliknete a potvrďte dialogové okno.


Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

• Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
• Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

• Spusťte.
• Klikněte na "CleanUp!". Potvrďte hlášky stiskem "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

• Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.
  
  Záložka Čistič
• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
  OK Zavřít

V logu nevidím firewall, doinstalujte Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

[Caroprd111]

Po provedení předchozích kroků.

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.