VIRY.CZ

PC sa mi zda trosku spomaleny a pri zapnuti viacerych aplikacii nestiha . Dakujem velmi pekne.

Logfile of random's system information tool 1.07 (written by random/random)
Run by user at 2010-06-09 12:35:16
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 24 GB (32%) free of 76 GB
Total RAM: 2814 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:35:48, on 9. 6. 2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\HControlUser.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\OBERON\SHARE\SYSTEM\OBERON Center.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Auto Keylogger\klkernel.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Opera\opera.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\user\Desktop\RSIT.exe
C:\Program Files\trend micro\user.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2086743
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O3 - Toolbar: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\ASUSTek\ASUSDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HControlUser] "C:\Program Files\ATK Hotkey\HcontrolUser.exe"
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OBERON Center] C:\OBERON\Share\System\OBERON Center.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WndMsg] C:\Program Files\Auto Keylogger\klkernel.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\RunServices: [WndMsg] C:\Program Files\Auto Keylogger\klkernel.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7282 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2008-06-11 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHP1.dll [2010-06-08 2515552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{dd02a4eb-4afd-4d60-99d8-e67f964ca813} - PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHP1.dll [2010-06-08 2515552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut"=C:\Program Files\ASUSTek\ASUSDVD\Language\Language.exe [2008-12-19 62760]
"HControlUser"=C:\Program Files\ATK Hotkey\HcontrolUser.exe [2008-01-12 98304]
"ATKOSD2"=C:\Program Files\ATKOSD2\ATKOSD2.exe [2008-01-24 7766016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-07-25 13548064]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-07-25 92704]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-08-12 6265376]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-08-17 102400]
"ASUS Screen Saver Protector"=C:\Windows\AsScrPro.exe [2009-02-24 3054136]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-12 39792]
"OBERON Center"=C:\OBERON\Share\System\OBERON Center.exe [2009-07-19 344064]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-14 644696]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2007-04-03 1603152]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"WndMsg"=C:\Program Files\Auto Keylogger\klkernel.exe [2003-12-09 202627]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"P2Go_Menu"=C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-06-14 210216]
"CLMLServer"=C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [2008-07-19 104936]
"ASUS Camera ScreenSaver"=C:\Windows\AsScrProlog.exe [2009-02-24 47672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"Skytel"=C:\Windows\Skytel.exe [2008-08-12 1833504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-07-16 25604904]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe [2008-12-12 87336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Agent zálohovania.lnk]
C:\OBERON\Backup\backup.exe [2006-09-29 86016]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"DisableStatusMessages"=0
"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26ac80fa-03fe-11df-9f1b-0023545e9ebd}]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc30b86-2ac0-11de-99c2-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc30b88-2ac0-11de-99c2-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5044a749-2de9-11de-a3c5-806e6f6e6963}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{616a719b-8f9e-11de-9005-0023545e9ebd}]
shell\AutoRun\command - F:\c2e.exe
shell\open\command - F:\c2e.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7434f8d4-31f1-11df-a6c6-0023545e9ebd}]
shell\AutoRun\command - H:\NAUMI///radil.exe
shell\open\command - H:\NAUMI///radil.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e37233c-27a2-11df-87cd-0023545e9ebd}]
shell\AutoRun\command - H:\fk.exe
shell\open\command - H:\fk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a59b625f-2ab0-11de-bfdd-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a59b6284-2ab0-11de-bfdd-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca9a54cb-3097-11de-9ac2-0023545e9ebd}]
shell\AutoRun\command - hyetn1i.exe
shell\open\command - hyetn1i.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e33f3875-735f-11de-b077-0023545e9ebd}]
shell\AutoRun\command - H:\p3vwxx.exe
shell\open\command - H:\p3vwxx.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa61381a-3a55-11de-a2fe-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-06-05 22:20:10 ----D---- C:\Program Files\QS
2010-06-05 22:20:07 ----D---- C:\Users\user\AppData\Roaming\TeamViewer
2010-05-26 09:53:21 ----A---- C:\Windows\system32\tzres.dll
2010-05-12 09:34:55 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 months======

2010-06-09 12:35:48 ----D---- C:\Program Files\trend micro
2010-06-09 12:35:28 ----D---- C:\Windows\Prefetch
2010-06-09 12:35:19 ----D---- C:\Windows\temp
2010-06-09 12:35:00 ----D---- C:\Users\user\AppData\Roaming\Skype
2010-06-09 12:32:59 ----D---- C:\OBERON
2010-06-09 11:43:13 ----D---- C:\Windows\System32
2010-06-09 11:43:13 ----D---- C:\Windows\inf
2010-06-09 11:43:13 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-06-09 07:36:30 ----SHD---- C:\System Volume Information
2010-06-08 11:45:48 ----D---- C:\Program Files\PHPNukeEN
2010-06-08 08:48:16 ----D---- C:\Windows\system32\spool
2010-06-05 22:20:10 ----RD---- C:\Program Files
2010-06-05 22:05:53 ----D---- C:\Users\user\AppData\Roaming\dvdcss
2010-05-28 10:41:17 ----D---- C:\Windows\rescache
2010-05-28 10:30:39 ----D---- C:\Windows\winsxs
2010-05-28 10:30:38 ----D---- C:\Windows\system32\sk-SK
2010-05-26 09:52:39 ----D---- C:\Windows\system32\catroot2
2010-05-26 09:52:39 ----D---- C:\Windows\system32\catroot
2010-05-13 09:29:20 ----SHD---- C:\Windows\Installer
2010-05-13 09:27:04 ----D---- C:\Program Files\Windows Mail
2010-05-12 11:21:16 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-02-05 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-02-05 51376]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-04-06 908800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
R3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-08-12 2159384]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2008-06-03 15928]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-07-08 1050656]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2010-03-04 51232]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-25 7547552]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2008-07-22 15872]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2008-04-01 1807744]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-08-17 190512]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
S3 CRFILTER;USB Mass Storage Filter; C:\Windows\system32\DRIVERS\CRFILTER.sys [2008-04-07 6656]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2008-03-17 101632]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-10-03 94208]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-25 196608]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]

-----------------EOF-----------------

Zdravim a pekne odpoledne preji,

ze ty pritelkyne si neumi dat do kopy PC samy, resp. pozadat o pomoc samotne - jste jiz nekolikaty uzivatel co dava log za pritelkyni, ale v pohode, nic se nedeje - i ja to tak delam s moji Kouknem na to...

Doporucuji odinstalovat (pokud nepouzivate) toolbary (listy prohlizecu) v Přidat nebo odebrat programy

Tohle tam mate umyslne spustene C:\Program Files\Auto Keylogger\klkernel.exe

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

• Stahne a ulozte na plochu UsbFix
• Spustte a kliknete na Deletion
• Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

Stahnete OTL (viz muj podpis) a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Zaskrtnete okenko Pro vsechny uzivatele
• Zaskrtnete okenko Kontrola na havet "LOP"
• Zaskrtnete okenko Kontrola na havet "Purity"
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  netsvcs
  drivers32
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
  c:\windows\*.* /U
  %SYSTEMDRIVE%\*.exe
  %ALLUSERSPROFILE%\Application Data\*.
  %ALLUSERSPROFILE%\Application Data\*.exe /s
  %APPDATA%\*.
  %APPDATA%\*.exe /s
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  nvraid.sys
  ndis.sys
  winlogon.exe
  explorer.exe
  userinit.exe
  lsass.exe
  svchost.exe
  smss.exe
  hal.dll
  ws2_32.dll
  tcpip.sys
  cryptsvc.dll
  Changer.sys
  JakNDis.sys
  isapnp.sys
  cdrom.sys
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.dll /lockedfiles
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
  %systemroot%\system32\drivers\*.sys /3
  %systemroot%\system32\*.* /3
  CREATERESTOREPOINT 

• Kliknete na tlacitko Prohledat
• Po dokonceni skenu (cca 5min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

Keyloger mame umyselne koli detom. vkladam logy.

############################## | UsbFix 7.008 | [Deletion]

User: user (Administrator) # USER-PC [ASUSTeK Computer Inc. F5GL]
Updated 10/06/10 by El Desaparecido / C_XX
Started at 07:06:00 | 11/06/2010
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Genuine Intel(R) CPU T1600 @ 1.66GHz
CPU 2: Genuine Intel(R) CPU T1600 @ 1.66GHz
Microsoft® Windows Vista™ Home Basic (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18928

Windows Firewall: Enabled

RAM -> 2814 Mb
C:\ (%systemdrive%) -> Fixed drive # 75 Gb (23 Mb free - 31%) [VistaOS] # NTFS
D:\ -> Fixed drive # 65 Gb (41 Mb free - 63%) [DATA] # NTFS
E:\ -> CD-ROM

################## | Files # Infected Folders |

Deleted ! C:\Users\user\dopdf.exe
Deleted ! C:\Users\user\PokerStarsInstall.exe
Deleted ! C:\Users\user\wlsetup-custom.exe
Deleted ! C:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-1000
Deleted ! D:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-1000
Deleted ! D:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-500

################## | Registry |

Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
Deleted ! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig
Deleted ! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableSR

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\F
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\H
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{26ac80fa-03fe-11df-9f1b-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{3cc30b86-2ac0-11de-99c2-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{5044a749-2de9-11de-a3c5-806e6f6e6963}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{7434f8d4-31f1-11df-a6c6-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{7e37233c-27a2-11df-87cd-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{a59b625f-2ab0-11de-bfdd-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{ca9a54cb-3097-11de-9ac2-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{fa61381a-3a55-11de-a2fe-0023545e9ebd}

################## | Listing |

[11/06/2010 - 07:07:59 | SHD ] C:\$RECYCLE.BIN
[15/11/2009 - 20:56:46 | D ] C:\32788R22FWJFW
[04/04/2007 - 21:50:44 | A | 19] C:\AK21.txt
[06/10/2008 - 05:46:41 | A | 21] C:\app3.LOG
[24/02/2009 - 05:52:17 | D ] C:\ASUS.SYS
[18/09/2006 - 23:43:36 | A | 24] C:\autoexec.bat
[12/04/2010 - 16:52:19 | SHD ] C:\Boot
[11/04/2009 - 08:36:36 | RASH | 333257] C:\bootmgr
[17/04/2008 - 08:20:25 | RAS | 8192] C:\BOOTSECT.BAK
[15/11/2009 - 20:56:45 | A | 1150] C:\Bug.txt
[04/03/2010 - 12:00:38 | A | 2] C:\CheckerLog.log
[15/11/2009 - 07:40:29 | D ] C:\ComboFix
[18/09/2006 - 23:43:37 | A | 10] C:\config.sys
[24/02/2009 - 06:05:19 | A | 19497] C:\devlist.txt
[02/11/2006 - 14:59:44 | SHD ] C:\Documents and Settings
[17/01/2009 - 04:19:43 | A | 61] C:\DVD.LOG
[08/09/2008 - 04:34:43 | RAH | 1048576] C:\F5GL.BIN
[09/09/2008 - 10:47:57 | A | 13] C:\F5GL_VISTA.10
[24/02/2009 - 06:05:14 | A | 9] C:\Finish.log
[11/06/2010 - 06:51:38 | ASH | 2951946240] C:\hiberfil.sys
[24/02/2009 - 05:07:54 | A | 481] C:\igoogle_log.txt
[04/03/2010 - 17:11:27 | D ] C:\instal
[01/10/2009 - 11:38:04 | D ] C:\lj1010seriesprintsys
[08/08/2008 - 09:22:19 | A | 30] C:\NERO.LOG
[07/01/2009 - 11:16:08 | A | 30] C:\NIS2009.TXT
[11/06/2010 - 06:53:04 | D ] C:\OBERON
[16/03/2007 - 01:18:45 | A | 25] C:\OFFICE2007_L.TXT
[11/06/2010 - 06:51:36 | ASH | 3265728512] C:\pagefile.sys
[23/02/2009 - 15:01:56 | A | 105] C:\Pass.txt
[30/12/2008 - 03:35:33 | A | 3054] C:\Patch.LOG
[21/01/2008 - 04:43:50 | D ] C:\PerfLogs
[11/06/2010 - 06:54:44 | RD ] C:\Program Files
[11/06/2010 - 07:00:45 | HD ] C:\ProgramData
[15/11/2009 - 07:17:39 | D ] C:\Qoobox
[29/04/2008 - 16:30:34 | A | 20] C:\READER_K.TXT
[09/09/2008 - 10:47:57 | A | 6] C:\RECOVERY.DAT
[24/02/2009 - 05:40:54 | A | 780] C:\RHDSetup.log
[14/11/2009 - 11:39:17 | D ] C:\rsit
[24/02/2009 - 05:54:50 | A | 163] C:\setup.log
[16/05/2006 - 02:22:24 | A | 5] C:\store.log
[24/02/2009 - 04:10:32 | A | 166] C:\SumHidd.txt
[24/02/2009 - 04:09:49 | A | 98] C:\SumOS.txt
[11/06/2010 - 07:02:35 | SHD ] C:\System Volume Information
[11/06/2010 - 07:07:59 | D ] C:\UsbFix
[11/06/2010 - 07:08:02 | A | 4501] C:\UsbFix.txt
[16/04/2009 - 20:02:40 | RD ] C:\Users
[21/10/2008 - 05:19:48 | A | 21] C:\V553.txt
[11/06/2010 - 06:50:34 | D ] C:\Windows
[16/04/2009 - 15:52:05 | D ] C:\ZALOHY
[11/06/2010 - 07:07:59 | D ] D:\$RECYCLE.BIN
[20/08/2009 - 22:33:24 | D ] D:\3e5be2c22b72fb82f1830af91aab48
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1028.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1031.txt
[07/11/2007 - 08:00:40 | A | 10134] D:\eula.1033.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1036.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1040.txt
[07/11/2007 - 08:00:40 | A | 118] D:\eula.1041.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1042.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.2052.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.3082.txt
[29/01/2010 - 19:16:57 | D ] D:\Filmy
[07/11/2007 - 08:00:40 | A | 1110] D:\globdata.ini
[07/11/2007 - 08:00:40 | A | 843] D:\install.ini
[07/11/2007 - 08:03:18 | A | 76304] D:\install.res.1028.dll
[07/11/2007 - 08:03:18 | A | 96272] D:\install.res.1031.dll
[07/11/2007 - 08:03:18 | A | 91152] D:\install.res.1033.dll
[07/11/2007 - 08:03:18 | A | 97296] D:\install.res.1036.dll
[07/11/2007 - 08:03:18 | A | 95248] D:\install.res.1040.dll
[07/11/2007 - 08:03:18 | A | 81424] D:\install.res.1041.dll
[07/11/2007 - 08:03:18 | A | 79888] D:\install.res.1042.dll
[07/11/2007 - 08:03:18 | A | 75792] D:\install.res.2052.dll
[07/11/2007 - 08:03:18 | A | 96272] D:\install.res.3082.dll
[30/11/2009 - 13:26:11 | A | 2379099] D:\installer_zoner_photo_studio_11_0_1_9_English.exe
[18/07/2009 - 07:12:43 | SHD ] D:\System Volume Information
[07/11/2007 - 08:00:40 | A | 5686] D:\vcredist.bmp
[07/11/2007 - 08:09:22 | A | 1442522] D:\VC_RED.cab
[07/11/2007 - 08:12:28 | A | 232960] D:\VC_RED.MSI

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_USER-PC.zip
http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution.

################## | E.O.F |

Dobre rano,
mel jste tam zapojene flash disky pri aplikaci USBFixu Dle logu to vypada ze ne. Pokud tam nebyli, zapojte je a spustte USBFix znovu dle navodu vyse...

Pak Vas poprosim o log z OTL - navod opet vyse

na tomto NB ziaden flashdisk nepouzivame . Dakujem

Co potom tedy jsou disky F,H,I virtualni mechaniky napr.Deamonu

Vlozte log z OTL - navod vizte vyse

Co se deje, ze se tu nic nedeje