VIRY.CZ

A ked ho odinstalujem, tak to bude uz ok?

Ani ja ich nepodporujem, ja to ani nepouzivam, len som raz potreboavala surne napalit cd, tak som si to stiahla. Inak som to uz chcela zmazat, lebo to ani nepotrbeujem.

Vecer to spravim

Odinstalujte ho

Ten burnaware je inak freeware, neviem preco sa mi tam dostalo z neho nieco, ale uz som ho odinstalovala.

pripajam log z rsitu:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Saga at 2010-12-14 19:31:17
Microsoft Windows 7 Professional
System drive C: has 11 GB (10%) free of 110 GB
Total RAM: 2046 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:31:30, on 14. 12. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\System32\WLTRAY.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\setup_9.0.0.722_03.09.2010_20-26.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Saga\Desktop\RSIT.exe
C:\Program Files\trend micro\Saga.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'Default user')
O4 - Startup: setup_9.0.0.722_03.09.2010_20-26.lnk = Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\startup.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 4989 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2009-01-20 3563520]
"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-11-29 963976]

C:\Users\Saga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
setup_9.0.0.722_03.09.2010_20-26.lnk - C:\Users\Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\startup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\97571542.sys
2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\97571541.sys
2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\9757154.sys
2010-12-13 22:44:25 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_22.44.25_log.txt
2010-12-13 21:08:46 ----D---- C:\ProgramData\Kaspersky Lab
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409422.sys
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409421.sys
2010-12-13 21:07:44 ----A---- C:\Windows\system32\drivers\0740942.sys
2010-12-13 20:50:08 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_20.50.08_log.txt
2010-12-12 22:01:02 ----A---- C:\Windows\zip.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWSC.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWREG.exe
2010-12-12 22:01:02 ----A---- C:\Windows\sed.exe
2010-12-12 22:01:02 ----A---- C:\Windows\PEV.exe
2010-12-12 22:01:02 ----A---- C:\Windows\NIRCMD.exe
2010-12-12 22:01:02 ----A---- C:\Windows\MBR.exe
2010-12-12 22:01:02 ----A---- C:\Windows\grep.exe
2010-12-12 22:00:44 ----D---- C:\Windows\ERDNT
2010-12-12 22:00:43 ----SD---- C:\beruška.com
2010-12-12 22:00:12 ----D---- C:\Qoobox
2010-12-12 21:59:49 ----A---- C:\Windows\SWXCACLS.exe
2010-12-12 21:59:43 ----RD---- C:\32788R22FWJFW
2010-12-12 11:54:53 ----D---- C:\Users\Saga\AppData\Roaming\Malwarebytes
2010-12-12 11:54:44 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-12-12 11:54:43 ----D---- C:\ProgramData\Malwarebytes
2010-12-12 11:54:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-12 11:54:39 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-12-12 11:21:58 ----A---- C:\Program Files\lvzqx.txt
2010-12-12 09:49:39 ----D---- C:\_OTL
2010-12-11 22:41:05 ----D---- C:\Program Files\trend micro
2010-12-11 22:41:04 ----D---- C:\rsit
2010-12-11 21:13:53 ----D---- C:\Program Files\Sophos
2010-12-11 12:29:28 ----D---- C:\Program Files\WIDCOMM
2010-12-11 12:24:20 ----D---- C:\Users\Saga\AppData\Roaming\Dell
2010-12-11 12:24:02 ----D---- C:\Program Files\Cisco
2010-12-11 12:22:05 ----A---- C:\Windows\system32\BCMLogon.dll
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.exe
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\Uninst_EAPModules.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\drivers\bcm42rly.sys
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlu00.exe
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlrmt.dll
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmttls.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\wltrynt.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\WLTRAY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\WLTRYSVC.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\BCMWLTRY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\bcmwlapi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\drivers\BCMWL6.SYS
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmwlcoi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvui.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvsrv.dll
2010-12-11 12:21:58 ----D---- C:\Program Files\Dell
2010-12-11 12:21:37 ----D---- C:\Users\Saga\AppData\Roaming\InstallShield
2010-12-11 11:44:29 ----A---- C:\Windows\ntbtlog.txt
2010-12-11 09:01:03 ----D---- C:\Windows\Minidump
2010-12-11 08:58:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-12-11 08:58:39 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-12-11 08:58:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-12-11 08:58:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-12-11 08:58:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-12-11 08:58:20 ----A---- C:\Windows\system32\aswBoot.exe
2010-12-04 08:31:10 ----A---- C:\Windows\ODBC.INI

======List of files/folders modified in the last 1 months======

2010-12-14 19:31:26 ----D---- C:\Windows\Temp
2010-12-14 19:29:43 ----RD---- C:\Program Files
2010-12-14 19:29:42 ----D---- C:\Windows\System32
2010-12-14 00:38:23 ----D---- C:\Windows\system32\config
2010-12-14 00:25:31 ----SHD---- C:\System Volume Information
2010-12-13 23:17:29 ----D---- C:\Windows
2010-12-13 22:45:07 ----D---- C:\Windows\system32\drivers
2010-12-13 21:45:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-13 21:45:50 ----D---- C:\Windows\inf
2010-12-13 21:08:46 ----HD---- C:\ProgramData
2010-12-13 20:39:47 ----D---- C:\Windows\system32\drivers\etc
2010-12-13 20:37:35 ----D---- C:\Windows\system32\catroot2
2010-12-13 20:35:03 ----D---- C:\Windows\Tasks
2010-12-13 20:34:36 ----SHD---- C:\Windows\Installer
2010-12-13 19:15:43 ----D---- C:\Program Files\Mozilla Firefox
2010-12-12 22:12:32 ----D---- C:\Windows\AppPatch
2010-12-12 22:12:31 ----D---- C:\Program Files\Common Files
2010-12-12 21:54:18 ----D---- C:\Windows\Setup
2010-12-12 21:52:44 ----D---- C:\Windows\system32\Tasks
2010-12-12 20:31:47 ----D---- C:\Windows\system32\wfp
2010-12-12 20:31:47 ----D---- C:\Windows\system32\DriverStore
2010-12-12 20:31:43 ----D---- C:\Windows\system32\CodeIntegrity
2010-12-12 20:31:43 ----D---- C:\Users\Saga\AppData\Roaming\BitTorrent
2010-12-12 20:31:31 ----D---- C:\Windows\system32\wbem
2010-12-12 20:31:31 ----D---- C:\Windows\registration
2010-12-12 20:31:29 ----D---- C:\Windows\winsxs
2010-12-12 20:31:27 ----SD---- C:\Windows\system32\Microsoft
2010-12-12 20:31:24 ----D---- C:\Windows\system32\catroot
2010-12-12 20:31:09 ----SD---- C:\ProgramData\Microsoft
2010-12-12 20:30:54 ----D---- C:\Users\Saga\AppData\Roaming\vlc
2010-12-12 20:29:09 ----D---- C:\Windows\system32\LogFiles
2010-12-12 17:40:08 ----D---- C:\ProgramData\Microsoft Help
2010-12-11 12:22:04 ----D---- C:\Windows\Help
2010-12-11 11:40:44 ----D---- C:\Windows\system32\NDF
2010-12-11 10:15:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-11 10:15:07 ----D---- C:\Users\Saga\AppData\Roaming\COWON
2010-12-11 08:58:17 ----D---- C:\ProgramData\Alwil Software
2010-12-10 21:01:33 ----D---- C:\Windows\system32\sysprep
2010-12-10 20:56:07 ----D---- C:\Users\Saga\AppData\Roaming\Skype
2010-12-10 18:49:15 ----D---- C:\Users\Saga\AppData\Roaming\skypePM
2010-12-04 19:20:09 ----D---- C:\Program Files\Microsoft Office
2010-12-04 19:17:37 ----RSD---- C:\Windows\assembly
2010-12-04 19:17:36 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-04 19:17:27 ----D---- C:\Windows\ShellNew
2010-12-04 19:16:26 ----D---- C:\Windows\system32\appmgmt
2010-12-04 19:10:23 ----D---- C:\Program Files\MSBuild
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Works
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio
2010-12-04 19:09:44 ----SD---- C:\Users\Saga\AppData\Roaming\Microsoft
2010-12-04 19:09:31 ----D---- C:\ProgramData\Adobe
2010-12-04 08:29:53 ----D---- C:\Windows\system
2010-11-20 22:59:38 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 07409422;07409422 Boot Guard Driver; C:\Windows\system32\DRIVERS\07409422.sys [2009-10-22 37392]
R0 97571542;97571542 Boot Guard Driver; C:\Windows\system32\DRIVERS\97571542.sys [2009-10-22 37392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 07409421;07409421; C:\Windows\system32\DRIVERS\07409421.sys [2009-09-25 128016]
R1 97571541;97571541; C:\Windows\system32\DRIVERS\97571541.sys [2009-09-25 128016]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 setup_9.0.0.722_03.09.2010_20-26drv;setup_9.0.0.722_03.09.2010_20-26drv; C:\Windows\system32\DRIVERS\9757154.sys [2009-10-09 311312]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-06-25 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-25 155136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2009-01-20 18424]
R3 BCM43XX;Ovládač karty Dell bezdrôtovej WLAN; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-01-20 1207288]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 catchme;catchme; \??\C:\Users\Saga\AppData\Local\Temp\catchme.sys []
S3 kxrdypow;kxrdypow; \??\C:\Users\Saga\AppData\Local\Temp\kxrdypow.sys []
S3 mbr;mbr; \??\C:\Users\Saga\AppData\Local\Temp\mbr.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2009-01-20 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------


bude sa este nieco robit?

Ale to jste měla verzi profesional, která je trial, takže jste určitě měla k n nějakou nelegální součást...

Copak máte spuštěno za program, který nám vytváří tyhle soubory , otestujte na www.virustotal.com
C:\Windows\TEMP\Rjv.exe

ja som si uz myslela, ze je to vsetko ok uz.

taky subor RJV.exe tam nemam v tom Temp.

co teraz ?

na virustotalu dáte procházet a cestu k tomu souboru nakopírujete do toho spodního okénka.


Já také myslela že je to vše, ale tohle bude určitě nějaká příšerka

no ale ja ked ho tam chcem vlozit na test, tak nemozem k nemu najst cestu, nic pod nazvom rjv.exe neexistuje vo foldri Temp. nie je to tam

Protože je skrytý. Když dáte procházet, objeví se Vám okno, kde soubor vybíráte, Vy ale nic nevybírejte, jen prostě celou cestu k souboru C:\Windows\TEMP\Rjv.exe nakopírujte do spodního okénka.

no ale uz som to skusala aj tak, ale vyskakuje mi ,, ze nemoze najst cestu k nemu. neexistuje

Nevadí, poprosím o nový log ze Rsitu

Logfile of random's system information tool 1.08 (written by random/random)
Run by Saga at 2010-12-16 22:04:12
Microsoft Windows 7 Professional
System drive C: has 11 GB (10%) free of 110 GB
Total RAM: 2046 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:04:23, on 16. 12. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\System32\WLTRAY.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\setup_9.0.0.722_03.09.2010_20-26.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Saga\Desktop\RSIT.exe
C:\Program Files\trend micro\Saga.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'Default user')
O4 - Startup: setup_9.0.0.722_03.09.2010_20-26.lnk = Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\startup.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 5035 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2009-01-20 3563520]
"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-11-29 963976]

C:\Users\Saga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
setup_9.0.0.722_03.09.2010_20-26.lnk - C:\Users\Saga\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.09.2010_20-26\startup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\97571542.sys
2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\97571541.sys
2010-12-13 22:45:00 ----A---- C:\Windows\system32\drivers\9757154.sys
2010-12-13 22:44:25 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_22.44.25_log.txt
2010-12-13 21:08:46 ----D---- C:\ProgramData\Kaspersky Lab
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409422.sys
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409421.sys
2010-12-13 21:07:44 ----A---- C:\Windows\system32\drivers\0740942.sys
2010-12-13 20:50:08 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_20.50.08_log.txt
2010-12-12 22:01:02 ----A---- C:\Windows\zip.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWSC.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWREG.exe
2010-12-12 22:01:02 ----A---- C:\Windows\sed.exe
2010-12-12 22:01:02 ----A---- C:\Windows\PEV.exe
2010-12-12 22:01:02 ----A---- C:\Windows\NIRCMD.exe
2010-12-12 22:01:02 ----A---- C:\Windows\MBR.exe
2010-12-12 22:01:02 ----A---- C:\Windows\grep.exe
2010-12-12 22:00:44 ----D---- C:\Windows\ERDNT
2010-12-12 22:00:43 ----SD---- C:\beruška.com
2010-12-12 22:00:12 ----D---- C:\Qoobox
2010-12-12 21:59:49 ----A---- C:\Windows\SWXCACLS.exe
2010-12-12 21:59:43 ----RD---- C:\32788R22FWJFW
2010-12-12 11:54:53 ----D---- C:\Users\Saga\AppData\Roaming\Malwarebytes
2010-12-12 11:54:44 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-12-12 11:54:43 ----D---- C:\ProgramData\Malwarebytes
2010-12-12 11:54:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-12 11:54:39 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-12-12 11:21:58 ----A---- C:\Program Files\lvzqx.txt
2010-12-12 09:49:39 ----D---- C:\_OTL
2010-12-11 22:41:05 ----D---- C:\Program Files\trend micro
2010-12-11 22:41:04 ----D---- C:\rsit
2010-12-11 21:13:53 ----D---- C:\Program Files\Sophos
2010-12-11 12:29:28 ----D---- C:\Program Files\WIDCOMM
2010-12-11 12:24:20 ----D---- C:\Users\Saga\AppData\Roaming\Dell
2010-12-11 12:24:02 ----D---- C:\Program Files\Cisco
2010-12-11 12:22:05 ----A---- C:\Windows\system32\BCMLogon.dll
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.exe
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\Uninst_EAPModules.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\drivers\bcm42rly.sys
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlu00.exe
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlrmt.dll
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmttls.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\wltrynt.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\WLTRAY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\WLTRYSVC.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\BCMWLTRY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\bcmwlapi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\drivers\BCMWL6.SYS
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmwlcoi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvui.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvsrv.dll
2010-12-11 12:21:58 ----D---- C:\Program Files\Dell
2010-12-11 12:21:37 ----D---- C:\Users\Saga\AppData\Roaming\InstallShield
2010-12-11 11:44:29 ----A---- C:\Windows\ntbtlog.txt
2010-12-11 09:01:03 ----D---- C:\Windows\Minidump
2010-12-11 08:58:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-12-11 08:58:39 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-12-11 08:58:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-12-11 08:58:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-12-11 08:58:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-12-11 08:58:20 ----A---- C:\Windows\system32\aswBoot.exe
2010-12-04 08:31:10 ----A---- C:\Windows\ODBC.INI

======List of files/folders modified in the last 1 months======

2010-12-16 22:04:17 ----D---- C:\Windows\Temp
2010-12-16 21:26:33 ----D---- C:\Users\Saga\AppData\Roaming\vlc
2010-12-14 19:29:43 ----RD---- C:\Program Files
2010-12-14 19:29:42 ----D---- C:\Windows\System32
2010-12-14 07:58:28 ----SHD---- C:\System Volume Information
2010-12-14 00:38:23 ----D---- C:\Windows\system32\config
2010-12-13 23:17:29 ----D---- C:\Windows
2010-12-13 22:45:07 ----D---- C:\Windows\system32\drivers
2010-12-13 21:45:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-13 21:45:50 ----D---- C:\Windows\inf
2010-12-13 21:08:46 ----HD---- C:\ProgramData
2010-12-13 20:39:47 ----D---- C:\Windows\system32\drivers\etc
2010-12-13 20:37:35 ----D---- C:\Windows\system32\catroot2
2010-12-13 20:35:03 ----D---- C:\Windows\Tasks
2010-12-13 20:34:36 ----SHD---- C:\Windows\Installer
2010-12-13 19:15:43 ----D---- C:\Program Files\Mozilla Firefox
2010-12-12 22:12:32 ----D---- C:\Windows\AppPatch
2010-12-12 22:12:31 ----D---- C:\Program Files\Common Files
2010-12-12 21:54:18 ----D---- C:\Windows\Setup
2010-12-12 21:52:44 ----D---- C:\Windows\system32\Tasks
2010-12-12 20:31:47 ----D---- C:\Windows\system32\wfp
2010-12-12 20:31:47 ----D---- C:\Windows\system32\DriverStore
2010-12-12 20:31:43 ----D---- C:\Windows\system32\CodeIntegrity
2010-12-12 20:31:43 ----D---- C:\Users\Saga\AppData\Roaming\BitTorrent
2010-12-12 20:31:31 ----D---- C:\Windows\system32\wbem
2010-12-12 20:31:31 ----D---- C:\Windows\registration
2010-12-12 20:31:29 ----D---- C:\Windows\winsxs
2010-12-12 20:31:27 ----SD---- C:\Windows\system32\Microsoft
2010-12-12 20:31:24 ----D---- C:\Windows\system32\catroot
2010-12-12 20:31:09 ----SD---- C:\ProgramData\Microsoft
2010-12-12 20:29:09 ----D---- C:\Windows\system32\LogFiles
2010-12-12 17:40:08 ----D---- C:\ProgramData\Microsoft Help
2010-12-11 12:22:04 ----D---- C:\Windows\Help
2010-12-11 11:40:44 ----D---- C:\Windows\system32\NDF
2010-12-11 10:15:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-11 10:15:07 ----D---- C:\Users\Saga\AppData\Roaming\COWON
2010-12-11 08:58:17 ----D---- C:\ProgramData\Alwil Software
2010-12-10 21:01:33 ----D---- C:\Windows\system32\sysprep
2010-12-10 20:56:07 ----D---- C:\Users\Saga\AppData\Roaming\Skype
2010-12-10 18:49:15 ----D---- C:\Users\Saga\AppData\Roaming\skypePM
2010-12-04 19:20:09 ----D---- C:\Program Files\Microsoft Office
2010-12-04 19:17:37 ----RSD---- C:\Windows\assembly
2010-12-04 19:17:36 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-04 19:17:27 ----D---- C:\Windows\ShellNew
2010-12-04 19:16:26 ----D---- C:\Windows\system32\appmgmt
2010-12-04 19:10:23 ----D---- C:\Program Files\MSBuild
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Works
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio
2010-12-04 19:09:44 ----SD---- C:\Users\Saga\AppData\Roaming\Microsoft
2010-12-04 19:09:31 ----D---- C:\ProgramData\Adobe
2010-12-04 08:29:53 ----D---- C:\Windows\system
2010-11-20 22:59:38 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 07409422;07409422 Boot Guard Driver; C:\Windows\system32\DRIVERS\07409422.sys [2009-10-22 37392]
R0 97571542;97571542 Boot Guard Driver; C:\Windows\system32\DRIVERS\97571542.sys [2009-10-22 37392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 07409421;07409421; C:\Windows\system32\DRIVERS\07409421.sys [2009-09-25 128016]
R1 97571541;97571541; C:\Windows\system32\DRIVERS\97571541.sys [2009-09-25 128016]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 setup_9.0.0.722_03.09.2010_20-26drv;setup_9.0.0.722_03.09.2010_20-26drv; C:\Windows\system32\DRIVERS\9757154.sys [2009-10-09 311312]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-06-25 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-25 155136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2009-01-20 18424]
R3 BCM43XX;Ovládač karty Dell bezdrôtovej WLAN; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-01-20 1207288]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 catchme;catchme; \??\C:\Users\Saga\AppData\Local\Temp\catchme.sys []
S3 kxrdypow;kxrdypow; \??\C:\Users\Saga\AppData\Local\Temp\kxrdypow.sys []
S3 mbr;mbr; \??\C:\Users\Saga\AppData\Local\Temp\mbr.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2009-01-20 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

Pořád to tam je

spusťte přejmenované HJT C:\Program Files\trend micro\Saga.exe , má tuto ikonku

- Klikněte na "Do a system scan only"
- U řádku
O4 - HKUS\S-1-5-18\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'Default user')
- Dejte fajfku do čtverečku a zmáčkněte Fix checked
- restartujte pc


Spustte OTL
-do bílého okna dole skopírujte tento skript:
-klikněte na tlačítko opravit.
-Následně se pc restartuje.
- Log vložte zde



A hned vložte nový log ze Rsitu, mám pocit že se tam něco schovává

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
========== FILES ==========
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
File\Folder C:\WINDOWS\*.tmp not found.
C:\Users\Saga\AppData\Local\Temp\AdobeARM.log moved successfully.
C:\Users\Saga\AppData\Local\Temp\AdobeARM_NotLocked.log moved successfully.
C:\Users\Saga\AppData\Local\Temp\ArmUI.ini moved successfully.
C:\Users\Saga\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Saga\AppData\Local\Temp\jusched.log moved successfully.
C:\Users\Saga\AppData\Local\Temp\wmplog00.sqm moved successfully.
C:\Users\Saga\AppData\Local\Temp\wmplog01.sqm moved successfully.
C:\Users\Saga\AppData\Local\Temp\wmsetup.log moved successfully.
File move failed. C:\Users\Saga\AppData\Local\Temp\~PI6806.tmp scheduled to be moved on reboot.
File move failed. C:\Users\Saga\AppData\Local\Temp\~PI68E1.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\TEMP\Rjv.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys\ deleted successfully.
========== SERVICES/DRIVERS ==========
Error: No service named kxrdypow was found to stop!
Service\Driver key kxrdypow not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Saga
->Temp folder emptied: 16187392 bytes
->Temporary Internet Files folder emptied: 1493804 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 46979410 bytes
->Flash cache emptied: 2311 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19438 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 62,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Saga
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12162010_225523

Files\Folders moved on Reboot...
File\Folder C:\Users\Saga\AppData\Local\Temp\~PI6806.tmp not found!
File\Folder C:\Users\Saga\AppData\Local\Temp\~PI68E1.tmp not found!
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Logfile of random's system information tool 1.08 (written by random/random)
Run by Saga at 2010-12-16 22:59:50
Microsoft Windows 7 Professional
System drive C: has 11 GB (10%) free of 110 GB
Total RAM: 2046 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:00:00, on 16. 12. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\notepad.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Saga\Desktop\RSIT.exe
C:\Program Files\trend micro\Saga.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [JP595IR86O] C:\Windows\TEMP\Rjv.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 4584 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2009-01-20 3563520]
"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-11-29 963976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-13 22:44:25 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_22.44.25_log.txt
2010-12-13 21:08:46 ----D---- C:\ProgramData\Kaspersky Lab
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409422.sys
2010-12-13 21:07:45 ----A---- C:\Windows\system32\drivers\07409421.sys
2010-12-13 21:07:44 ----A---- C:\Windows\system32\drivers\0740942.sys
2010-12-13 20:50:08 ----A---- C:\TDSSKiller.2.4.11.0_13.12.2010_20.50.08_log.txt
2010-12-12 22:01:02 ----A---- C:\Windows\zip.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWSC.exe
2010-12-12 22:01:02 ----A---- C:\Windows\SWREG.exe
2010-12-12 22:01:02 ----A---- C:\Windows\sed.exe
2010-12-12 22:01:02 ----A---- C:\Windows\PEV.exe
2010-12-12 22:01:02 ----A---- C:\Windows\NIRCMD.exe
2010-12-12 22:01:02 ----A---- C:\Windows\MBR.exe
2010-12-12 22:01:02 ----A---- C:\Windows\grep.exe
2010-12-12 22:00:44 ----D---- C:\Windows\ERDNT
2010-12-12 22:00:43 ----SD---- C:\beruška.com
2010-12-12 22:00:12 ----D---- C:\Qoobox
2010-12-12 21:59:49 ----A---- C:\Windows\SWXCACLS.exe
2010-12-12 21:59:43 ----RD---- C:\32788R22FWJFW
2010-12-12 11:54:53 ----D---- C:\Users\Saga\AppData\Roaming\Malwarebytes
2010-12-12 11:54:44 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-12-12 11:54:43 ----D---- C:\ProgramData\Malwarebytes
2010-12-12 11:54:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-12-12 11:54:39 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-12-12 11:21:58 ----A---- C:\Program Files\lvzqx.txt
2010-12-12 09:49:39 ----D---- C:\_OTL
2010-12-11 22:41:05 ----D---- C:\Program Files\trend micro
2010-12-11 22:41:04 ----D---- C:\rsit
2010-12-11 21:13:53 ----D---- C:\Program Files\Sophos
2010-12-11 12:29:28 ----D---- C:\Program Files\WIDCOMM
2010-12-11 12:24:20 ----D---- C:\Users\Saga\AppData\Roaming\Dell
2010-12-11 12:24:02 ----D---- C:\Program Files\Cisco
2010-12-11 12:22:05 ----A---- C:\Windows\system32\BCMLogon.dll
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.exe
2010-12-11 12:22:03 ----A---- C:\Windows\system32\vcredist_x86.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\Uninst_EAPModules.bat
2010-12-11 12:22:03 ----A---- C:\Windows\system32\drivers\bcm42rly.sys
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlu00.exe
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmwlrmt.dll
2010-12-11 12:22:02 ----A---- C:\Windows\system32\bcmttls.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\wltrynt.dll
2010-12-11 12:22:01 ----A---- C:\Windows\system32\WLTRAY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\WLTRYSVC.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\BCMWLTRY.EXE
2010-12-11 12:22:00 ----A---- C:\Windows\system32\bcmwlapi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\drivers\BCMWL6.SYS
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmwlcoi.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvui.dll
2010-12-11 12:21:59 ----A---- C:\Windows\system32\bcmihvsrv.dll
2010-12-11 12:21:58 ----D---- C:\Program Files\Dell
2010-12-11 12:21:37 ----D---- C:\Users\Saga\AppData\Roaming\InstallShield
2010-12-11 11:44:29 ----A---- C:\Windows\ntbtlog.txt
2010-12-11 09:01:03 ----D---- C:\Windows\Minidump
2010-12-11 08:58:40 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-12-11 08:58:39 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-12-11 08:58:38 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-12-11 08:58:36 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-12-11 08:58:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-12-11 08:58:20 ----A---- C:\Windows\system32\aswBoot.exe
2010-12-04 08:31:10 ----A---- C:\Windows\ODBC.INI

======List of files/folders modified in the last 1 months======

2010-12-16 22:59:16 ----D---- C:\Windows\Temp
2010-12-16 22:57:46 ----D---- C:\Windows\system32\config
2010-12-16 22:55:53 ----D---- C:\Windows\system32\drivers\etc
2010-12-16 22:54:50 ----D---- C:\Windows\System32
2010-12-16 22:54:50 ----D---- C:\Windows\inf
2010-12-16 22:54:50 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-16 22:46:36 ----D---- C:\Windows\system32\drivers
2010-12-16 22:44:14 ----D---- C:\Windows
2010-12-16 21:26:33 ----D---- C:\Users\Saga\AppData\Roaming\vlc
2010-12-14 19:29:43 ----RD---- C:\Program Files
2010-12-14 07:58:28 ----SHD---- C:\System Volume Information
2010-12-13 21:08:46 ----HD---- C:\ProgramData
2010-12-13 20:37:35 ----D---- C:\Windows\system32\catroot2
2010-12-13 20:35:03 ----D---- C:\Windows\Tasks
2010-12-13 20:34:36 ----SHD---- C:\Windows\Installer
2010-12-13 19:15:43 ----D---- C:\Program Files\Mozilla Firefox
2010-12-12 22:12:32 ----D---- C:\Windows\AppPatch
2010-12-12 22:12:31 ----D---- C:\Program Files\Common Files
2010-12-12 21:54:18 ----D---- C:\Windows\Setup
2010-12-12 21:52:44 ----D---- C:\Windows\system32\Tasks
2010-12-12 20:31:47 ----D---- C:\Windows\system32\wfp
2010-12-12 20:31:47 ----D---- C:\Windows\system32\DriverStore
2010-12-12 20:31:43 ----D---- C:\Windows\system32\CodeIntegrity
2010-12-12 20:31:43 ----D---- C:\Users\Saga\AppData\Roaming\BitTorrent
2010-12-12 20:31:31 ----D---- C:\Windows\system32\wbem
2010-12-12 20:31:31 ----D---- C:\Windows\registration
2010-12-12 20:31:29 ----D---- C:\Windows\winsxs
2010-12-12 20:31:27 ----SD---- C:\Windows\system32\Microsoft
2010-12-12 20:31:24 ----D---- C:\Windows\system32\catroot
2010-12-12 20:31:09 ----SD---- C:\ProgramData\Microsoft
2010-12-12 20:29:09 ----D---- C:\Windows\system32\LogFiles
2010-12-12 17:40:08 ----D---- C:\ProgramData\Microsoft Help
2010-12-11 12:22:04 ----D---- C:\Windows\Help
2010-12-11 11:40:44 ----D---- C:\Windows\system32\NDF
2010-12-11 10:15:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-11 10:15:07 ----D---- C:\Users\Saga\AppData\Roaming\COWON
2010-12-11 08:58:17 ----D---- C:\ProgramData\Alwil Software
2010-12-10 21:01:33 ----D---- C:\Windows\system32\sysprep
2010-12-10 20:56:07 ----D---- C:\Users\Saga\AppData\Roaming\Skype
2010-12-10 18:49:15 ----D---- C:\Users\Saga\AppData\Roaming\skypePM
2010-12-04 19:20:09 ----D---- C:\Program Files\Microsoft Office
2010-12-04 19:17:37 ----RSD---- C:\Windows\assembly
2010-12-04 19:17:36 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-04 19:17:27 ----D---- C:\Windows\ShellNew
2010-12-04 19:16:26 ----D---- C:\Windows\system32\appmgmt
2010-12-04 19:10:23 ----D---- C:\Program Files\MSBuild
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Works
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-12-04 19:10:23 ----D---- C:\Program Files\Microsoft Visual Studio
2010-12-04 19:09:44 ----SD---- C:\Users\Saga\AppData\Roaming\Microsoft
2010-12-04 19:09:31 ----D---- C:\ProgramData\Adobe
2010-12-04 08:29:53 ----D---- C:\Windows\system
2010-11-20 22:59:38 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 07409422;07409422 Boot Guard Driver; C:\Windows\system32\DRIVERS\07409422.sys [2009-10-22 37392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 07409421;07409421; C:\Windows\system32\DRIVERS\07409421.sys [2009-09-25 128016]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-06-25 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-25 155136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2009-01-20 18424]
R3 BCM43XX;Ovládač karty Dell bezdrôtovej WLAN; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-01-20 1207288]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 catchme;catchme; \??\C:\Users\Saga\AppData\Local\Temp\catchme.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2009-01-20 24064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

Pořád je to tam , musíme to pohledat v registrech. Budete mít se mnou ještě trpělivost? Tohle je nějak moc odolná potvora a navíc dobře ukrytá.





Stáhněte SystemLook
http://jpshortstuff.247fixes.com/SystemLook.exe

- uložte ho na plochu a spustte.
- do okénka zkopírujte - klikněte na Look, proběhne sken, na konci se zobrazí log, jehož obsah zkopírujete sem