ko logu

[lacomputer]

Prosím o kontrolu logu z MWAV..OS WIN 7 64bit má být v C:WINDOWS složka rundl132.dll a složka rundll16.exe?
Děkuji všem za ochotu a Váš čas...
Petr
Objekt "dyfuca.internet optimizer Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "smitfraud Browser Hijacker" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "Possible Fujacks-type Worm" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "Possible Fujacks-type Worm" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" odkazuje na neplatný objekt "C:\Windows\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe". Provedené akce: Nic nebylo provedeno.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" odkazuje na neplatný objekt "C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll". Provedené akce: Nic nebylo provedeno.

Děkuji všem za ochotu a Váš čas...
Petr
Zde je výpis z OTL
OTL logfile created on: 8.8.2010 14:46:01 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = B:\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 85,95 Gb Total Space | 58,20 Gb Free Space | 67,71% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: 1EXE-PC
Current User Name: 1EXE
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.08.08 14:44:42 | 000,574,976 | ---- | M] (OldTimer Tools) -- B:\Downloads\OTL.exe
PRC - [2010.07.26 12:03:07 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2010.03.01 14:15:28 | 000,451,224 | ---- | M] () -- C:\Users\1EXE\AppData\Local\Seznam.cz\postak.exe
PRC - [2008.08.19 09:47:38 | 001,795,656 | ---- | M] (FLASHGET) -- C:\Program Files (x86)\FlashGet Network\FlashGet universal\flashget.exe


========== Modules (SafeList) ==========

MOD - [2010.08.08 14:44:42 | 000,574,976 | ---- | M] (OldTimer Tools) -- B:\Downloads\OTL.exe
MOD - [2009.07.14 03:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
MOD - [2009.07.14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010.03.25 23:48:42 | 000,017,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.07.14 03:41:56 | 000,195,072 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\umrdp.dll -- (UmRdpService)
SRV:64bit: - [2009.07.14 03:41:53 | 001,361,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\PeerDistSvc.dll -- (PeerDistSvc)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:24 | 000,689,152 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cscsvc.dll -- (CscService)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2010.03.18 14:27:14 | 000,138,576 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_64)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2007.08.24 07:59:20 | 000,068,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2004.12.13 05:34:32 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2010.03.06 19:51:06 | 000,698,376 | ---- | M] (DiBcom SA) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mod7700.sys -- (mod7700)
DRV:64bit: - [2010.03.06 19:51:06 | 000,024,200 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\modrc.sys -- (MODRC)
DRV:64bit: - [2009.10.22 13:54:24 | 000,040,464 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\46792582.sys -- (46792582)
DRV:64bit: - [2009.10.09 23:30:56 | 000,352,784 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\4679258.sys -- (setup_9.0.0.722_05.08.2010_15-32drv)
DRV:64bit: - [2009.09.25 17:59:46 | 000,157,712 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\46792581.sys -- (46792581)
DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,200,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmbus.sys -- (vmbus)
DRV:64bit: - [2009.07.14 03:45:55 | 000,046,672 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmstorfl.sys -- (storflt)
DRV:64bit: - [2009.07.14 03:45:55 | 000,034,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsc.sys -- (storvsc)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2009.07.14 01:42:58 | 000,006,656 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vms3cap.sys -- (s3cap)
DRV:64bit: - [2009.07.14 01:42:44 | 000,021,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VMBusHID.sys -- (VMBusHID)
DRV:64bit: - [2009.07.14 01:24:27 | 000,514,048 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\csc.sys -- (CSC)
DRV:64bit: - [2009.07.08 01:45:50 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.01.07 17:20:16 | 000,040,992 | ---- | M] (NVIDIA Corp.) [Kernel | Auto | Running] -- C:\Windows\nvflsh64.sys -- (NVR0FLASHDev)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.cz/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = cs
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 83 5F 56 2E BD CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://seznam.cz/"
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:3.3.3
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.12.0.36949
FF - prefs.js..extensions.enabledItems: xmlfiller@software602.cz:3.1.6
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.29

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.07.26 12:03:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.26 12:03:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b2\extensions\\Components: B:\Program Files (x86)\Mozilla Firefox 4.0 Beta 2\components [2010.08.08 10:30:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b2\extensions\\Plugins: B:\Program Files (x86)\Mozilla Firefox 4.0 Beta 2\plugins

[2010.03.06 14:55:27 | 000,000,000 | ---D | M] -- C:\Users\1EXE\AppData\Roaming\Mozilla\Extensions
[2010.08.08 14:15:21 | 000,000,000 | ---D | M] -- C:\Users\1EXE\AppData\Roaming\Mozilla\Firefox\Profiles\mttg0vx2.default\extensions
[2010.08.02 18:47:39 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\1EXE\AppData\Roaming\Mozilla\Firefox\Profiles\mttg0vx2.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010.03.06 21:26:34 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\1EXE\AppData\Roaming\Mozilla\Firefox\Profiles\mttg0vx2.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010.07.22 21:49:03 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\1EXE\AppData\Roaming\Mozilla\Firefox\Profiles\mttg0vx2.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010.06.19 21:23:32 | 000,000,000 | ---D | M] -- C:\Users\1EXE\AppData\Roaming\Mozilla\Firefox\Profiles\mttg0vx2.default\extensions\piclens@cooliris.com
[2010.08.08 14:15:21 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010.03.29 13:24:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions\xmlfiller@software602.cz
[2009.12.17 15:39:34 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\plugins\npfiller.dll
[2010.01.16 02:50:40 | 000,000,638 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.01.16 02:50:40 | 000,001,687 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.01.16 02:50:40 | 000,001,367 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.01.16 02:50:40 | 000,000,654 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.01.16 02:50:40 | 000,001,179 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (FG2CatchUrl) - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (FlashGet)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [FlashGet] C:\Program Files (x86)\FlashGet Network\FlashGet universal\FlashGet.exe (FLASHGET)
O4 - HKCU..\Run: [FlashGet] C:\Program Files (x86)\FlashGet Network\FlashGet universal\FlashGet.exe (FLASHGET)
O4 - HKCU..\Run: [Seznam Postak] C:\Users\1EXE\AppData\Local\Seznam.cz\postak.exe ()
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\SysWow64\grpconv.exe (Microsoft Corporation)
O4 - Startup: C:\Users\1EXE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_05.08.2010_15-32.lnk = B:\Program Files (x86)\Virus Removal Tool\setup_9.0.0.722_05.08.2010_15-32\startup.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 1
O8:64bit: - Extra context menu item: &Download All by FlashGet - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm ()
O8:64bit: - Extra context menu item: &Download by FlashGet - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm ()
O8:64bit: - Extra context menu item: &Stáhnout s FlashGetem - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm ()
O8:64bit: - Extra context menu item: &Stáhnout vše s FlashGetem - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm ()
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm ()
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm ()
O8 - Extra context menu item: &Stáhnout s FlashGetem - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm ()
O8 - Extra context menu item: &Stáhnout vše s FlashGetem - C:\Program Files (x86)\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm ()
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ftp - No CLSID value found
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http - No CLSID value found
O18:64bit: - Protocol\Handler\https - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18 - Protocol\Handler\ftp - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http - No CLSID value found
O18 - Protocol\Handler\https - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{15b8520f-2c05-11df-ba27-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{15b8520f-2c05-11df-ba27-806e6f6e6963}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{6f0b20e0-97d6-11df-8542-00269e0c3882}\Shell - "" = AutoRun
O33 - MountPoints2\{6f0b20e0-97d6-11df-8542-00269e0c3882}\Shell\AutoRun\command - "" = E:\Axesstel_Setup.exe -- File not found
O33 - MountPoints2\E\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 7 Days ==========

[2010.08.08 14:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2010.08.08 14:26:12 | 000,352,784 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\4679258.sys
[2010.08.08 14:26:12 | 000,157,712 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\46792581.sys
[2010.08.08 14:26:12 | 000,040,464 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\46792582.sys
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\zts2.exe
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\vcmgcd32.dll
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\systems.txt
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\rundll16.exe
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\rundl132.dll
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\logo1_.exe
[2010.08.08 14:02:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\iifgfgf.dll
[2010.08.08 13:07:03 | 000,000,000 | ---D | C] -- C:\Users\1EXE\Pictures
[2010.08.08 13:07:03 | 000,000,000 | ---D | C] -- C:\Users\1EXE\Contacts
[2010.08.07 14:22:04 | 000,000,000 | ---D | C] -- C:\Windows\Sun

========== Files - Modified Within 7 Days ==========

[2010.08.08 14:49:13 | 004,194,304 | ---- | M] () -- C:\Users\1EXE\ntuser.dat
[2010.08.08 14:27:17 | 000,001,581 | ---- | M] () -- C:\Users\1EXE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_05.08.2010_15-32.lnk
[2010.08.08 14:04:47 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.08 14:04:47 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.08 13:51:47 | 000,000,026 | ---- | M] () -- C:\Windows\Lic.xxx
[2010.08.08 13:50:13 | 000,044,517 | ---- | M] () -- C:\Users\1EXE\Documents\pinfect.zip
[2010.08.08 13:20:59 | 000,000,462 | ---- | M] () -- C:\Users\1EXE\Desktop\EXTERNI (F).lnk
[2010.08.08 13:10:46 | 001,470,062 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.08.08 13:10:46 | 000,631,292 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2010.08.08 13:10:46 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.08.08 13:10:46 | 000,121,914 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2010.08.08 13:10:46 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.08.08 13:06:50 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.08 13:06:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.08 13:06:31 | 3018,657,792 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.08 11:01:30 | 000,524,288 | -HS- | M] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000002.regtrans-ms
[2010.08.08 11:01:30 | 000,524,288 | -HS- | M] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000001.regtrans-ms
[2010.08.08 11:01:30 | 000,065,536 | -HS- | M] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TM.blf
[2010.08.08 11:01:26 | 003,559,914 | -H-- | M] () -- C:\Users\1EXE\AppData\Local\IconCache.db
[2010.08.08 10:21:37 | 000,000,348 | ---- | M] () -- C:\Users\1EXE\Desktop\DVD.lnk
[2010.08.08 10:21:30 | 000,000,473 | ---- | M] () -- C:\Users\1EXE\Desktop\DATA (B).lnk
[2010.08.08 10:21:26 | 000,000,473 | ---- | M] () -- C:\Users\1EXE\Desktop\WIN 7 (C).lnk
[2010.08.07 10:36:41 | 000,007,597 | ---- | M] () -- C:\Users\1EXE\AppData\Local\resmon.resmoncfg
[2010.08.04 09:44:51 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI

========== Files Created - No Company Name ==========

[2010.08.08 14:27:17 | 000,001,581 | ---- | C] () -- C:\Users\1EXE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_05.08.2010_15-32.lnk
[2010.08.08 13:51:47 | 000,000,026 | ---- | C] () -- C:\Windows\Lic.xxx
[2010.08.08 13:50:13 | 000,044,517 | ---- | C] () -- C:\Users\1EXE\Documents\pinfect.zip
[2010.08.08 13:20:59 | 000,000,462 | ---- | C] () -- C:\Users\1EXE\Desktop\EXTERNI (F).lnk
[2010.08.08 10:21:37 | 000,000,348 | ---- | C] () -- C:\Users\1EXE\Desktop\DVD.lnk
[2010.08.08 10:21:30 | 000,000,473 | ---- | C] () -- C:\Users\1EXE\Desktop\DATA (B).lnk
[2010.08.08 10:21:26 | 000,000,473 | ---- | C] () -- C:\Users\1EXE\Desktop\WIN 7 (C).lnk
[2010.08.08 09:49:40 | 000,524,288 | -HS- | C] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000002.regtrans-ms
[2010.08.08 09:49:40 | 000,524,288 | -HS- | C] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000001.regtrans-ms
[2010.08.08 09:49:40 | 000,065,536 | -HS- | C] () -- C:\Users\1EXE\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TM.blf
[2010.05.01 08:55:08 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.04.18 16:31:41 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010.03.28 20:19:11 | 000,000,060 | ---- | C] () -- C:\Windows\Wininit.ini
[2010.03.20 22:39:47 | 000,000,190 | ---- | C] () -- C:\Windows\ADStahovac.INI
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2007.09.06 02:01:22 | 000,012,288 | ---- | C] () -- C:\Windows\SysWow64\DivXWMPExtType.dll
[2007.08.23 18:55:34 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2007.08.23 18:50:04 | 000,000,416 | ---- | C] () -- C:\Windows\SysWow64\dtu100.dll.manifest
[2007.08.23 18:50:04 | 000,000,416 | ---- | C] () -- C:\Windows\SysWow64\dpl100.dll.manifest

========== Alternate Data Streams ==========

@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:679ABA25
< End of report >


Log z OTL v příloze...

[earl]

Zdravim,

ty dva soubory patri MWAVu...

Stahnete OTL

spustte, oznacte "Pro vsechny uzivatele,30 dnů zmente na 7,kliknete na Prohledat,

po skonceni skenu sem vlozte obsah logu z OTL.txt.

[earl]

Priste prosim needituj,a dej Odpovedet.

Log je ok.

Stahnete DDS a ulozte ho na plochu.

Zavrete vsechna spustena okna a spustte program, potvrdte licencni podminky a postupujte podle pokynu. Zacne scanovani.

Az skonci, tak by mel vytvorit 2 logy proto se vam 2krat otevre notepad. Jeden log bude mit nazev DDS.txt a druhy attach.txt.

Zkopirujte sem pouze ten DDS.txt.

V pripade nejasnosti navod zde

Stahnete GMER , rozbalte a spustte

probehne sken, po jehoz ukonceni na vas vyskoci vysledky

pote kliknete na Save a ulozite tak log, jehoz obsah sem vlozte

pote dle tohoto navodu

absolvujte druhy sken a opet obsah logu sem.

[lacomputer]

Omlouvám se,za editaci...
log z dds je zde,bohužel gmer nelze nainstalovat - píše C:\system32\config\system: System nemůže nalést uvedený soubor.(gmer stažen ze dvou zdrojů,vždy dotaženo 100% - uloženo ok..Spouštím jako správce..)
dds log:
DDS (Ver_10-03-17.01) - NTFSX64
Run by 1EXE at 15:58:51,72 on ne 08.08.2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_16
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3838.2581 [GMT 2:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
B:\Downloads\dds.scr
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://seznam.cz/
mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyOverride = local
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FG2CatchUrl: {1f364306-aa45-47b5-9f9d-39a8b94e7ef1} - c:\program files (x86)\flashget network\flashget universal\comdlls\bhoCATCH.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
EB: Ukazatel S-Rank: {ea837f48-5ad1-443e-ae34-ffe03cbf3099} - c:\users\1exe\appdata\local\seznam.cz\core.2.dll
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: DisableStatusMessages = 1 (0x1)
IE: &Download All by FlashGet - c:\program files (x86)\flashget network\flashget universal\comdlls\Bhoall.htm
IE: &Download by FlashGet - c:\program files (x86)\flashget network\flashget universal\comdlls\Bholink.htm
IE: &Stáhnout s FlashGetem - c:\program files (x86)\flashget network\flashget universal\comdlls\Bholink.htm
IE: &Stáhnout vše s FlashGetem - c:\program files (x86)\flashget network\flashget universal\comdlls\Bhoall.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~2\office12\REFIEBAR.DLL
Trusted Zone: kuaiche.com\software
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files (x86)\microsoft office\office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll
EB-X64: {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - No File
mRun-x64: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

================= FIREFOX ===================

FF - ProfilePath - c:\users\1exe\appdata\roaming\mozilla\firefox\profiles\mttg0vx2.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - component: c:\users\1exe\appdata\roaming\mozilla\firefox\profiles\mttg0vx2.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\np_gp.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npfiller.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npnul32.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\NPOFF12.DLL
FF - plugin: c:\users\1exe\appdata\roaming\mozilla\firefox\profiles\mttg0vx2.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - plugin: c:\windows\syswow64\macromed\flash\NPSWF32.dll

============= SERVICES / DRIVERS ===============

R0 46792582;46792582 Boot Guard Driver;c:\windows\system32\drivers\46792582.sys [2010-8-8 40464]
R1 46792581;46792581;c:\windows\system32\drivers\46792581.sys [2010-8-8 157712]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 173984]
R1 setup_9.0.0.722_05.08.2010_15-32drv;setup_9.0.0.722_05.08.2010_15-32drv;c:\windows\system32\drivers\4679258.sys [2010-8-8 352784]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 59904]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-12-2 40832]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 MODRC;PCTV Infrared Receiver;c:\windows\system32\drivers\modrc.sys [2007-10-19 24200]

=============== Created Last 30 ================

2010-08-08 12:27:18 0 d-----w- c:\programdata\Kaspersky Lab
2010-08-08 12:26:12 40464 ----a-w- c:\windows\system32\drivers\46792582.sys
2010-08-08 12:26:12 352784 ----a-w- c:\windows\system32\drivers\4679258.sys
2010-08-08 12:26:12 157712 ----a-w- c:\windows\system32\drivers\46792581.sys
2010-08-08 12:02:42 0 d---a-w- c:\windows\zts2.exe
2010-08-08 12:02:42 0 d---a-w- c:\windows\syswow64\vcmgcd32.dll
2010-08-08 12:02:42 0 d---a-w- c:\windows\syswow64\iifgfgf.dll
2010-08-08 12:02:42 0 d---a-w- c:\windows\rundll16.exe
2010-08-08 12:02:42 0 d---a-w- c:\windows\rundl132.dll
2010-08-08 12:02:42 0 d---a-w- c:\windows\logo1_.exe
2010-08-08 11:51:47 26 ----a-w- c:\windows\Lic.xxx
2010-08-08 07:58:40 12867584 ----a-w- c:\windows\syswow64\shell32.dll
2010-08-08 07:49:40 65536 --sha-w- c:\users\1exe\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TM.blf
2010-08-08 07:49:40 524288 --sha-w- c:\users\1exe\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000002.regtrans-ms
2010-08-08 07:49:40 524288 --sha-w- c:\users\1exe\ntuser.dat{71b738d9-a2b7-11df-bbaa-00269e0c3882}.TMContainer00000000000000000001.regtrans-ms
2010-07-20 20:13:30 75776 ----a-w- c:\windows\cadkasdeinst01e.exe
2010-07-17 11:10:17 982600 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-07-17 11:10:16 144384 ----a-w- c:\windows\system32\cdd.dll
2010-07-15 13:45:12 0 d-----w- c:\program files\DFX
2010-07-15 13:45:12 0 d-----w- c:\program files\common files\DFX
2010-07-15 13:44:35 0 d-----w- c:\programdata\DFX

==================== Find3M ====================

2010-08-08 13:43:27 631292 ----a-w- c:\windows\system32\perfh005.dat
2010-08-08 13:43:27 121914 ----a-w- c:\windows\system32\perfc005.dat
2010-06-01 17:37:48 270208 ------w- c:\windows\system32\MpSigStub.exe
2010-05-27 07:24:13 34304 ----a-w- c:\windows\syswow64\atmlib.dll
2010-05-27 06:34:09 46080 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 04:11:32 366080 ----a-w- c:\windows\system32\atmfd.dll
2010-05-27 03:49:37 293888 ----a-w- c:\windows\syswow64\atmfd.dll
2010-05-21 05:52:30 1192960 ----a-w- c:\windows\system32\wininet.dll
2010-05-21 05:18:06 977920 ----a-w- c:\windows\syswow64\wininet.dll
2010-05-21 05:14:50 48128 ----a-w- c:\windows\syswow64\jsproxy.dll
2009-07-26 18:40:52 36232 ----a-w- c:\windows\inf\perflib\0405\perfd.dat
2009-07-26 18:40:52 36232 ----a-w- c:\windows\inf\perflib\0405\perfc.dat
2009-07-26 18:40:52 292004 ----a-w- c:\windows\inf\perflib\0405\perfi.dat
2009-07-26 18:40:52 292004 ----a-w- c:\windows\inf\perflib\0405\perfh.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2010-04-23 05:47:17 245760 --sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2010-03-31 11:20:01 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-07-14 04:55:03 32768 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat
2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 15:59:30,94 ===============

[earl]

Viry nevidno.

Pro jistotu ohledne rootkitu jeste udelame toto:

Stahnete si na plochu a rozbalte RootRepeal

spustte RootRepeal.exe - klepnete na File a potom na Scan - po skenu kliknete na Save Report a log vlozte sem.

V pripade nejasnosti navod v mem podpisu.

[lacomputer]

RootRepeal je nefunkční pod win 7 64 bit? - nelze nainstalovat...

[earl]

Stahnete Rootkit Revealer

Rozbalte ZIP archiv a spustte aplikaci.

Kliknete na tlacitko Scan a po dokonceni scanu kliknete na File - Save a ulozeny log vlozte sem.

[lacomputer]

bohužel,ani RootkitRevealer nelze spustit...

[earl]

Ok.

Jak se chova pc ted?

[lacomputer]

NB je rychlejší,jen po startu dlouho trvá,než naběhne firefox,nebo jiná aplikace.Po cca 30sec již vše běhá rychle..Programy po startu mám vypnuté,až na antivir..
Jinak moc děkuji za rady a pomoc..

[earl]

Pouzijte T-Cleaner na vycisteni pc po utilitach pouzitych pri odvirovani.

Postupujte dle instrukci na obrazovce.Pri detekci antivirem se jedna o falesny poplach.
-----------------------------------------------------------------------------------------------------------------

Vycistete pc Ccleanerem.

Vzdy nejprve Analyzovat a pak Spustit Cleaner.2x po sobe.

Windows-odskrtnout historii a historii automatickeho vyplnovani formularu - prisel byste o historii navstivenych stranek a o ulozena hesla ve formularich

(je to sice z pohledu zabezpeceni spatne,ale aspon pak uzivatel nenadava,kam ze mu to zmizelo )

Aplikace-u prohlizecu internetu odskrtnout Historii internetu.

Registry-nechat vse zaskrtle,Hledej problemy,Opravit vybrane problemy

(nechat ho udelat zalohu-ta je ulozena v Dokumentech-DULEZITE).

Taktez 2x-3x po sobe.

A jinak neni zac.