Prosím o kontrolu logu. Děkuji.

[Joker93]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Owner at 2010-08-14 14:09:19
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 97 GB (64%) free of 153 GB
Total RAM: 511 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:10:48, on 14.8.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Plocha\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Hlavní panel ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4561CD95-3FCE-4EA2-AA6D-F7AB45F50C22}: NameServer = 192.168.1.254,10.110.22.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 5629 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-07-21 1619296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-06 61440]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-10-24 90112]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-07-17 2065760]
"Easy-PrintToolBox"=C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [2004-01-14 409600]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
Hlavní panel ATI CATALYST.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2010-07-17 12536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\AVG\AVG9\avgemc.exe"="C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe"="C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\Air Conflicts\ac.exe"="C:\Program Files\Air Conflicts\ac.exe:*:Disabled:ac"
"C:\Program Files\3D Live Pool\3D Live Pool\3D Live Pool.exe"="C:\Program Files\3D Live Pool\3D Live Pool\3D Live Pool.exe:*:Disabled:3D Live Pool"
"C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe"="C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe:*:Enabled:vietcong"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-08-14 13:59:36 ----D---- C:\Program Files\trend micro
2010-08-14 13:59:35 ----D---- C:\rsit
2010-08-12 19:54:15 ----D---- C:\Program Files\Cenega Czech
2010-07-26 09:41:17 ----A---- C:\WINDOWS\system32\drivers\sptd.sys
2010-07-26 09:41:09 ----D---- C:\Program Files\DAEMON Tools Lite
2010-07-26 09:39:14 ----D---- C:\Documents and Settings\Owner\Data aplikací\DAEMON Tools Lite
2010-07-26 09:39:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2010-07-25 20:14:50 ----A---- C:\WINDOWS\unvise32.exe
2010-07-21 20:17:48 ----D---- C:\Program Files\AC3Filter
2010-07-21 20:14:00 ----D---- C:\Documents and Settings\Owner\Data aplikací\GRETECH
2010-07-21 20:08:11 ----D---- C:\Program Files\GRETECH
2010-07-18 22:23:08 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2010-07-18 22:23:08 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2010-07-18 16:03:34 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2010-07-18 16:03:34 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2010-07-18 16:03:33 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2010-07-18 16:03:33 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2010-07-18 16:03:32 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2010-07-18 16:03:32 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2010-07-18 16:03:31 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2010-07-18 16:03:31 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2010-07-18 16:03:30 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-07-18 16:03:30 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-07-18 16:03:29 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-07-18 16:03:29 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-07-18 16:03:28 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-07-18 16:03:27 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-07-18 16:03:26 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-07-18 16:03:25 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-07-18 16:03:24 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-07-18 16:03:24 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-07-18 16:03:23 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-07-18 16:03:22 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-07-18 16:03:22 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-07-18 16:03:21 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-07-18 16:03:20 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-07-18 16:03:20 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-07-18 16:03:20 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-07-18 16:03:19 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-07-18 16:03:18 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-07-18 16:03:18 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-07-18 16:03:17 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-07-18 16:03:16 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-07-18 16:03:16 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-07-18 16:03:15 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-07-18 16:03:15 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-07-18 16:03:14 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-07-18 16:03:14 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-07-18 16:03:14 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-07-18 16:03:13 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-07-18 16:03:13 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-07-18 16:03:12 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-07-18 16:03:11 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-07-18 16:03:11 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-07-18 16:03:11 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-07-18 16:03:10 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-07-18 16:03:09 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-07-18 16:03:09 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-07-18 16:03:09 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-07-18 16:03:08 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-07-18 16:03:07 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-07-18 16:03:06 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-07-18 16:03:05 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-07-18 16:03:05 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-07-18 16:03:04 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-07-18 16:03:04 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-07-18 16:03:02 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-07-18 16:03:02 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-07-18 16:03:02 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-07-18 16:03:01 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-07-18 16:03:00 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-07-18 16:03:00 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-07-18 16:02:59 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-07-18 16:02:58 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-07-18 16:02:58 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-07-18 16:02:58 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2010-07-18 16:02:58 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2010-07-18 16:02:57 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2010-07-18 16:02:56 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-07-18 16:02:56 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-07-18 16:02:54 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-07-18 16:02:54 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-07-18 16:02:52 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-07-18 16:02:51 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-07-18 16:02:50 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-07-18 16:02:50 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2010-07-18 16:02:49 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-07-18 16:02:49 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-07-18 16:02:49 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-07-18 16:02:48 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-07-18 16:02:48 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-07-18 16:02:48 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-07-18 16:02:47 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-07-18 16:02:47 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-07-18 16:02:43 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-07-18 16:02:42 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-07-18 16:02:42 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-07-18 16:02:42 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-07-18 16:02:41 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-07-18 16:02:41 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-07-18 16:02:40 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2010-07-18 16:02:40 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2010-07-18 16:02:39 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-07-18 16:02:37 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-07-18 15:58:32 ----D---- C:\WINDOWS\Logs
2010-07-18 15:58:29 ----HD---- C:\WINDOWS\msdownld.tmp
2010-07-18 13:55:16 ----D---- C:\Program Files\7-Zip
2010-07-17 10:50:15 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2010-07-17 00:39:08 ----D---- C:\Program Files\3D Live Pool
2010-07-16 22:13:38 ----D---- C:\Documents and Settings\Owner\Data aplikací\TeamViewer
2010-07-16 22:13:20 ----D---- C:\Program Files\TeamViewer
2010-07-16 10:45:11 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2010-07-16 10:19:06 ----D---- C:\WINDOWS\system32\CatRoot_bak
2010-07-15 23:54:48 ----D---- C:\Documents and Settings\Owner\Data aplikací\Ahead
2010-07-15 19:46:46 ----D---- C:\Documents and Settings\Owner\Data aplikací\TrueCrypt
2010-07-15 19:45:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\TrueCrypt
2010-07-15 19:45:37 ----A---- C:\WINDOWS\system32\drivers\truecrypt.sys
2010-07-15 19:45:33 ----D---- C:\Program Files\TrueCrypt
2010-07-15 19:06:49 ----A---- C:\WINDOWS\PhotoSnapViewer.INI
2010-07-15 16:04:35 ----D---- C:\Documents and Settings\Owner\Data aplikací\gtk-2.0
2010-07-15 16:02:32 ----D---- C:\Program Files\GIMP-2.0
2010-07-15 15:44:56 ----D---- C:\Documents and Settings\Owner\Data aplikací\AnvSoft
2010-07-15 15:44:53 ----D---- C:\Program Files\AnvSoft
2010-07-15 10:45:47 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-07-15 10:45:37 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

======List of files/folders modified in the last 1 months======

2010-08-14 14:05:03 ----D---- C:\WINDOWS\Temp
2010-08-14 14:04:51 ----D---- C:\WINDOWS
2010-08-14 14:03:36 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-14 13:59:36 ----RD---- C:\Program Files
2010-08-14 13:41:16 ----D---- C:\Documents and Settings\Owner\Data aplikací\ICQ
2010-08-14 10:00:28 ----D---- C:\WINDOWS\Prefetch
2010-08-14 09:58:26 ----D---- C:\WINDOWS\system32\drivers\Avg
2010-08-13 10:12:21 ----SHD---- C:\WINDOWS\Installer
2010-08-12 17:24:57 ----A---- C:\WINDOWS\NeroDigital.ini
2010-08-12 12:26:02 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-11 22:01:58 ----D---- C:\Program Files\ICQ7.0
2010-07-28 19:52:13 ----D---- C:\WINDOWS\system32
2010-07-27 13:16:45 ----D---- C:\WINDOWS\system32\drivers
2010-07-26 10:02:14 ----HD---- C:\WINDOWS\inf
2010-07-21 22:56:37 ----SD---- C:\WINDOWS\Tasks
2010-07-21 11:53:34 ----D---- C:\WINDOWS\Help
2010-07-19 21:58:11 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-07-18 16:03:36 ----D---- C:\WINDOWS\system32\DirectX
2010-07-16 22:49:05 ----D---- C:\Documents and Settings\Owner\Data aplikací\Vso
2010-07-16 14:39:37 ----D---- C:\Documents and Settings\Owner\Data aplikací\Adobe
2010-07-16 10:54:44 ----D---- C:\WINDOWS\system32\CatRoot
2010-07-16 10:47:00 ----SHD---- C:\Config.Msi
2010-07-16 10:45:15 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-16 10:19:05 ----D---- C:\WINDOWS\Debug
2010-07-16 00:18:56 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-15 14:27:09 ----D---- C:\WINDOWS\system32\wbem
2010-07-15 14:27:09 ----D---- C:\WINDOWS\AppPatch
2010-07-15 09:48:05 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 prohlp02;StarForce Protection Helper Driver v2; C:\WINDOWS\System32\drivers\prohlp02.sys [2004-05-13 111808]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\WINDOWS\System32\drivers\prosync1.sys [2003-09-06 6944]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-01-14 47616]
R0 sfhlp01;StarForce Protection Helper Driver; C:\WINDOWS\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2004-10-28 6656]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2004-12-03 20544]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-07-26 691696]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2010-07-17 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2010-07-13 29584]
R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2010-07-17 243024]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-05-13 79488]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2010-07-15 223440]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-10-26 3786944]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2006-03-02 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-07-13 47360]
S3 a184fj4x;a184fj4x; C:\WINDOWS\system32\drivers\a184fj4x.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-03-02 26496]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 avg9emc;AVG Free E-mail Scanner; C:\Program Files\AVG\AVG9\avgemc.exe [2010-07-21 921952]
R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-10-22 69632]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-03-02 14336]

-----------------EOF-----------------

[vyosek]

Zdravim, pekne odpoledne preji a vitam Vas u nas na foru

Jsou s PC nejake problemy nebo jde jen o preventivni kontrolu

[Joker93]

I vám pěkné odpoledne a děkuji za přivítání.

Včera jsem k PC připojil flashku, na které se vyskytl trojský kůň, kterého jsem pomocí AVG uložil do trezoru a následně odstranil. Chci se jen ujistit, jest-li v PC nic podobného nezůstalo.

Další problém je podezřele pomalý počítač. Ikdyž na něm nic nedělám, neustále na něčem pracuje což ho velmi zpomaluje.

[vyosek]

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

• C:\WINDOWS\unvise32.exe
• Kliknete na Prochazet
• Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
• Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
• Kliknete na Otestovat soubor
• Vysledek analyzy sem vlozte (jako odkaz)

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[Joker93]

Zde je výsledek analýzy Virus Totalu:

http://www.virustotal.com/file-scan/rep ... 1281796275

Tady je log MBAM:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4427

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14.8.2010 17:09:39
mbam-log-2010-08-14 (17-09-39).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 164051
Uplynulý čas: 25 minuta(y), 40 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[vyosek]

Soubor i log je cisty...

MBAM muzete odinstalovat nebo nechat na obcasny sken - v pripade nalezu velmi doporucuji dat sem log na posouzeni, at si neodstrelite neco legitimniho

Otevrete si poznamkovy blok

• Start->spustit->notepad
• Vlozte text nize

• Kód: Vybrat vše

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  NeroFilterCheck"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-

• Soubor ulozte jako oprava.reg
• Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
• 
• Zavrit notepad a spustit oprava.reg
• Pripadny dotaz na zmenu registru potvrdte
• Okno jen problikne a opravi regsitry - soubor muzete smazat

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Z logu je patrno, ze nemate aktualni verzi Windows - chybi Vam ServicePack 3 - doinstalujte jej

• Vice info mate zde http://www.viry.cz/forum/viewtopic.php?f=46&t=86100

Z logu je patrno, ze nemate aktualni verzi Internet Exploreru - aktualizujte jej

• Aktualizaci najdete zde (pod tlacitkem "Ke stazeni") http://www.microsoft.com/cze/windows/internet-explorer/
• Doporucuji vsak pouzivat alternativni prohlizece - vice zde http://www.viry.cz/forum/viewtopic.php?f=19&t=6116

Pouzivate AVG Internet Security nebo AVG Anti-Virus (bez firewallu)

[Joker93]

Používám AVG Anti-Virus Free (verzi 9.0.851)

[vyosek]

Fajn, takze jeste dopnim jednu vec

Nepouzivate firewall - doporucuji doinstalovat

• k cemu je dobry http://www.viry.cz/forum/viewtopic.php?f=41&t=20980
• prehled osobnich firewallu http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

Jinak je log OK

[Joker93]

Mockrát Vám děkuji. Opravdu mi spadl kámen ze srdce.

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy