VIRY.CZ

Čau,
při autosurfu jsem si asi natáhl nějaký šmejd.
V běžících procesech mám "csrss.exe" a u něj žadný informace kdo nebo co ho spustilo. Našel jsem, že by to on měl být ta havěť, tak jsem vyzkoušel několik způsobů odstranění, ale nedaří se. Když jsem ho dal vyhledat, tak je ve windows/system32, což by mělo být správně, ale našel jsem ho ještě v nedávno vytvořené složce, která má umístění windows/winsxs, která má otazníkovou velikost a je v něm hodně adresářů i souborů. csrss by měl právě shromažďovat růyný data z hdd a třeba to ukládá zrovna sem. Nechci to rovnou mazat, když to nevím určitě.

log z RSIT :

Logfile of random's system information tool 1.08 (written by random/random)
Run by Barmar at 2010-08-24 10:37:42
Microsoft Windows 7 Professional
System drive C: has 18 GB (45%) free of 39 GB
Total RAM: 1023 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:38:07, on 24.8.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinctray.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\Barmar\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\BOINC\boinc.exe
C:\Windows\system32\conhost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Miranda pack by sssugi 2.4.1m\miranda32.exe
E:\download\RSIT.exe
C:\Program Files\trend micro\Barmar.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60347
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crawler.com/homepage.aspx?tbid=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TNOD UP] "C:\Program Files\TNod User & Password Finder\TNODUP.exe" /i
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [boincmgr] "C:\Program Files\BOINC\boincmgr.exe" /a /s
O4 - HKLM\..\Run: [boinctray] "C:\Program Files\BOINC\boinctray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Barmar\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 6517 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2232105079-3074953530-982546561-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2232105079-3074953530-982546561-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-06-19 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-06-08 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-06-19 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-06-19 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-02-10 61440]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-04-07 2145000]
"TNOD UP"=C:\Program Files\TNod User & Password Finder\TNODUP.exe [2010-04-02 1811968]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]
"boincmgr"=C:\Program Files\BOINC\boincmgr.exe [2010-07-01 4862720]
"boinctray"=C:\Program Files\BOINC\boinctray.exe [2010-07-01 58112]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-08-10 421888]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2010-08-23 2176512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Barmar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-08 136176]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-08-23 3037696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2010-06-19 640440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2010-06-19 38840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
C:\Program Files\Cyberlink\Shared files\brs.exe [2010-04-02 75048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2010-08-10 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl10]
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe [2010-02-03 87336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"

======List of files/folders created in the last 1 months======

2010-08-24 10:37:45 ----D---- C:\Program Files\trend micro
2010-08-24 10:37:41 ----D---- C:\rsit
2010-08-23 17:35:49 ----D---- C:\Program Files\Emsisoft HiJackFree
2010-08-23 17:27:24 ----D---- C:\Program Files\RegGenie
2010-08-23 15:09:48 ----A---- C:\Windows\system32\drivers\sp_rsdrv2.sys
2010-08-23 15:09:47 ----D---- C:\Users\Barmar\AppData\Roaming\Spyware Terminator
2010-08-23 15:09:41 ----D---- C:\ProgramData\Spyware Terminator
2010-08-23 15:09:39 ----D---- C:\Program Files\Spyware Terminator
2010-08-23 14:56:13 ----AD---- C:\Windows\VDLL.DLL
2010-08-23 14:56:13 ----AD---- C:\Windows\system32\runouce.exe
2010-08-23 14:56:13 ----AD---- C:\Windows\rundll16.exe
2010-08-23 14:56:13 ----AD---- C:\Windows\RUNDL132.EXE
2010-08-23 14:56:13 ----AD---- C:\Windows\logo1_.exe
2010-08-23 14:56:13 ----AD---- C:\Windows\logo_1.exe
2010-08-23 14:51:52 ----A---- C:\Windows\system32\msvcr80.dll
2010-08-23 14:51:51 ----A---- C:\Windows\system32\msvcp80.dll
2010-08-23 14:51:50 ----A---- C:\Windows\system32\eEmpty.exe
2010-08-23 14:51:43 ----D---- C:\Program Files\Common Files\MicroWorld
2010-08-23 14:51:37 ----D---- C:\ProgramData\MicroWorld
2010-08-23 14:21:52 ----SHD---- C:\$RECYCLE.BIN
2010-08-23 14:21:37 ----A---- C:\ComboFix.txt
2010-08-23 14:02:43 ----A---- C:\Windows\PEV.exe
2010-08-23 14:02:43 ----A---- C:\Windows\NIRCMD.exe
2010-08-23 14:02:43 ----A---- C:\Windows\MBR.exe
2010-08-23 14:02:42 ----A---- C:\Windows\zip.exe
2010-08-23 14:02:42 ----A---- C:\Windows\SWSC.exe
2010-08-23 14:02:42 ----A---- C:\Windows\SWREG.exe
2010-08-23 14:02:42 ----A---- C:\Windows\sed.exe
2010-08-23 14:02:42 ----A---- C:\Windows\grep.exe
2010-08-23 14:02:30 ----D---- C:\Windows\ERDNT
2010-08-23 14:00:12 ----D---- C:\Qoobox
2010-08-23 13:59:49 ----A---- C:\Windows\SWXCACLS.exe
2010-08-20 11:08:59 ----D---- C:\Program Files\QuickTime
2010-08-16 17:20:07 ----D---- C:\Users\Barmar\AppData\Roaming\WebSurf.ru
2010-08-16 09:54:32 ----D---- C:\Users\Barmar\AppData\Roaming\WebMoney
2010-08-16 09:37:15 ----D---- C:\Program Files\WebMoney
2010-08-15 15:09:12 ----D---- C:\Program Files\BOINC
2010-08-15 14:57:31 ----D---- C:\ProgramData\BOINC
2010-08-14 22:47:17 ----RA---- C:\Windows\system32\AdobePDFUI.dll
2010-08-13 11:38:42 ----D---- C:\ProgramData\Google
2010-08-11 20:50:48 ----D---- C:\Program Files\WinRAR
2010-08-11 12:12:38 ----A---- C:\Windows\system32\AdobePDF.dll
2010-08-11 11:09:53 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-11 11:09:52 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-11 11:09:17 ----A---- C:\Windows\system32\mshtml.dll
2010-08-11 11:09:12 ----A---- C:\Windows\system32\ieframe.dll
2010-08-11 11:09:10 ----A---- C:\Windows\system32\urlmon.dll
2010-08-11 11:09:09 ----A---- C:\Windows\system32\wininet.dll
2010-08-11 11:09:09 ----A---- C:\Windows\system32\iepeers.dll
2010-08-11 11:09:08 ----A---- C:\Windows\system32\mstime.dll
2010-08-11 11:09:08 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-11 11:09:08 ----A---- C:\Windows\system32\ieui.dll
2010-08-11 11:09:08 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-11 11:09:07 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-11 11:09:07 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-11 11:09:05 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-08-11 11:09:05 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-11 11:09:05 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-11 11:08:51 ----A---- C:\Windows\system32\rtutils.dll
2010-08-11 11:08:50 ----A---- C:\Windows\system32\iccvid.dll
2010-08-11 11:08:49 ----A---- C:\Windows\system32\ir32_32.dll
2010-08-11 11:08:48 ----A---- C:\Windows\system32\win32k.sys
2010-08-11 11:08:46 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-11 11:08:44 ----A---- C:\Windows\system32\schannel.dll
2010-08-11 11:08:40 ----A---- C:\Windows\system32\msxml3.dll
2010-08-06 06:37:48 ----D---- C:\Windows\lhsp
2010-08-06 06:37:22 ----D---- C:\Windows\msagent
2010-08-06 06:36:59 ----D---- C:\Program Files\Magnus
2010-08-03 09:36:47 ----A---- C:\Windows\system32\shell32.dll
2010-08-02 12:12:57 ----D---- C:\Program Files\iPod
2010-07-27 20:34:33 ----D---- C:\Windows\system32\appmgmt

======List of files/folders modified in the last 1 months======

2010-08-24 10:38:02 ----D---- C:\Windows\Prefetch
2010-08-24 10:37:52 ----D---- C:\Windows\Temp
2010-08-24 10:37:45 ----D---- C:\Program Files
2010-08-24 07:45:58 ----AD---- C:\ProgramData\Temp
2010-08-24 07:21:26 ----SHD---- C:\System Volume Information
2010-08-24 07:19:26 ----D---- C:\Windows\system32\config
2010-08-23 17:43:22 ----D---- C:\Windows
2010-08-23 17:41:42 ----D---- C:\Windows\Minidump
2010-08-23 17:28:19 ----D---- C:\Windows\system32\Tasks
2010-08-23 17:28:02 ----RSD---- C:\Windows\Fonts
2010-08-23 15:09:51 ----D---- C:\Windows\system32\drivers
2010-08-23 15:09:41 ----D---- C:\ProgramData
2010-08-23 14:56:13 ----D---- C:\Windows\System32
2010-08-23 14:51:43 ----D---- C:\Program Files\Common Files
2010-08-23 14:17:33 ----A---- C:\Windows\system.ini
2010-08-23 14:17:20 ----D---- C:\Windows\system32\drivers\etc
2010-08-23 14:11:26 ----D---- C:\Windows\AppPatch
2010-08-23 14:04:44 ----D---- C:\Windows\system32\catroot2
2010-08-23 11:25:32 ----D---- C:\Program Files\Windows Media Player
2010-08-23 11:25:29 ----D---- C:\Program Files\iTunes
2010-08-22 22:44:58 ----D---- C:\Program Files\JDownloader
2010-08-22 14:40:49 ----D---- C:\Users\Barmar\AppData\Roaming\uTorrent
2010-08-22 13:43:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-22 13:43:24 ----D---- C:\Windows\inf
2010-08-20 11:11:30 ----SHD---- C:\Windows\Installer
2010-08-20 11:11:29 ----D---- C:\Config.Msi
2010-08-15 15:10:15 ----D---- C:\Windows\Downloaded Installations
2010-08-13 19:40:42 ----D---- C:\Windows\Logs
2010-08-12 08:49:27 ----D---- C:\Windows\Microsoft.NET
2010-08-11 20:59:14 ----D---- C:\Users\Barmar\AppData\Roaming\WinRAR
2010-08-11 20:57:59 ----RSD---- C:\Windows\assembly
2010-08-11 12:13:35 ----D---- C:\Program Files\Common Files\Adobe
2010-08-11 12:13:11 ----D---- C:\Windows\system32\DriverStore
2010-08-11 11:21:11 ----D---- C:\Windows\winsxs
2010-08-11 11:19:21 ----D---- C:\Windows\system32\migration
2010-08-11 11:19:21 ----D---- C:\Program Files\Internet Explorer
2010-08-11 11:08:54 ----D---- C:\Windows\system32\catroot
2010-08-06 06:37:46 ----D---- C:\Windows\Help
2010-08-06 06:37:40 ----D---- C:\Windows\Speech
2010-08-03 20:09:31 ----A---- C:\Windows\system32\MRT.exe
2010-08-02 12:12:55 ----D---- C:\Program Files\Common Files\Apple
2010-07-30 15:12:06 ----D---- C:\Users\Barmar\AppData\Roaming\CyberLink
2010-07-27 20:34:27 ----D---- C:\ProgramData\ABBYY
2010-07-26 10:32:41 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2010-08-23 142592]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/06/11 16:24:35]; \??\C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-04-02 87536]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-04-07 134488]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 41312]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-07-14 117248]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-02-11 4450816]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-04-07 32584]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm60x32.sys [2009-07-14 429056]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2009-07-14 43008]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 ALCXSENS;Service for WDM 3D Audio Driver; C:\Windows\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AMDMSRIO;AMDMSRIO; \??\C:\Users\Barmar\AppData\Local\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 catchme;catchme; \??\C:\Users\Barmar\AppData\Local\Temp\catchme.sys []
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2009-07-14 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-16 41472]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S4 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-06-17 691696]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2010-02-11 733184]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-08-23 488960]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-04-07 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-12 651720]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-12-22 136120]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]

-----------------EOF-----------------

Hezké odpoledne
Poprosím Vás o tento log
C:\ComboFix.txt

combofix :

ComboFix 10-08-22.05 - Barmar 23.08.2010 14:05:18.1.1 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.1023.301 [GMT 2:00]
Spuštěný z: c:\users\Barmar\Desktop\ComboFix.exe
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Barmar\AppData\Roaming\download2
c:\users\Barmar\AppData\Roaming\download2\svcnost.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-23 do 2010-08-23 )))))))))))))))))))))))))))))))
.

2010-08-23 12:17 . 2010-08-23 12:17 -------- d-----w- c:\users\Barmar\AppData\Local\temp
2010-08-23 12:17 . 2010-08-23 12:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-20 09:08 . 2010-08-20 09:10 -------- d-----w- c:\program files\QuickTime
2010-08-16 07:54 . 2010-08-16 16:55 -------- d-----w- c:\users\Barmar\AppData\Roaming\WebMoney
2010-08-16 07:37 . 2010-08-16 07:37 -------- d-----w- c:\program files\WebMoney
2010-08-15 13:11 . 2010-08-15 13:11 284646 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{212D202D-487D-49C4-8A76-4D3BB91B8471}\BOINCMGRLink_B65C4A4D2B2A46CCA2D918164C6297B8.exe
2010-08-15 13:11 . 2010-08-15 13:11 284646 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{212D202D-487D-49C4-8A76-4D3BB91B8471}\ARPPRODUCTICON.exe
2010-08-15 13:11 . 2010-08-15 13:08 113 ----a-w- c:\programdata\BOINC\slots\0\einstein_S5GC1_3.02_windows_intelx86__S5GCESSE2.exe
2010-08-15 13:10 . 2010-08-15 13:02 12709791 ----a-w- c:\programdata\BOINC\projects\einstein.phys.uwm.edu\einstein_S5R6_3.01_graphics_windows_intelx86.exe
2010-08-15 13:10 . 2010-08-15 13:03 16241549 ----a-w- c:\programdata\BOINC\projects\einstein.phys.uwm.edu\einstein_S5GC1_3.02_windows_intelx86__S5GCESSE2.exe
2010-08-15 13:09 . 2010-08-15 13:11 -------- d-----w- c:\program files\BOINC
2010-08-15 12:57 . 2010-08-23 11:55 -------- d-----w- c:\programdata\BOINC
2010-08-14 20:47 . 2009-08-19 21:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2010-08-13 09:38 . 2010-07-23 15:22 43008 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-08-13 09:38 . 2010-07-23 15:22 338944 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-08-13 09:38 . 2010-07-23 15:22 1496064 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-08-13 09:38 . 2010-07-23 15:22 346112 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-08-11 10:12 . 2009-08-19 21:50 46928 ----a-w- c:\windows\system32\AdobePDF.dll
2010-08-11 09:08 . 2010-06-19 06:23 37376 ----a-w- c:\windows\system32\rtutils.dll
2010-08-11 09:08 . 2010-07-29 06:30 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-08-11 09:08 . 2010-07-29 06:30 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-08-11 09:08 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-08-11 09:08 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-11 09:08 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll
2010-08-11 09:08 . 2010-06-08 06:02 1233920 ----a-w- c:\windows\system32\msxml3.dll
2010-08-06 04:38 . 2010-08-06 04:38 45056 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{ED64E405-5D77-4108-8CBF-42A747D2FFBB}\NewShortcut6_B794D369B2624859AEF7E3A2CABB3DFF.exe
2010-08-06 04:38 . 2010-08-06 04:38 45056 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{ED64E405-5D77-4108-8CBF-42A747D2FFBB}\EC11_F308E9E4D2CC484A9EDC18D90DFD4B61.exe
2010-08-06 04:38 . 2010-08-06 04:38 45056 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{ED64E405-5D77-4108-8CBF-42A747D2FFBB}\EC1_5BBC82EB80A4441584D82AFE3E9A466F.exe
2010-08-06 04:38 . 2010-08-06 04:38 45056 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{ED64E405-5D77-4108-8CBF-42A747D2FFBB}\EC111_AA3A22F8E7544F6FAD918B9B63C337A0.exe
2010-08-06 04:38 . 2010-08-06 04:38 45056 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{ED64E405-5D77-4108-8CBF-42A747D2FFBB}\ARPPRODUCTICON.exe
2010-08-06 04:37 . 2010-08-06 04:37 -------- d-----w- c:\windows\lhsp
2010-08-06 04:37 . 2010-08-06 04:38 -------- d-----w- c:\windows\msagent
2010-08-06 04:36 . 2010-08-06 04:36 -------- d-----w- c:\program files\Magnus
2010-08-02 10:12 . 2010-08-02 10:12 -------- d-----w- c:\program files\iPod
2010-08-02 09:57 . 2010-08-02 09:57 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-02 09:51 . 2010-08-14 20:20 -------- d-----w- c:\users\Barmar\AppData\Local\Last.fm

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 09:25 . 2010-06-24 21:11 -------- d-----w- c:\program files\iTunes
2010-08-22 21:16 . 2010-06-08 10:37 1 ----a-w- c:\users\Barmar\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-22 20:44 . 2010-06-08 10:08 -------- d-----w- c:\program files\JDownloader
2010-08-22 12:40 . 2010-06-08 17:16 -------- d-----w- c:\users\Barmar\AppData\Roaming\uTorrent
2010-08-22 11:43 . 2009-07-14 08:44 622422 ----a-w- c:\windows\system32\perfh005.dat
2010-08-22 11:43 . 2009-07-14 08:44 118604 ----a-w- c:\windows\system32\perfc005.dat
2010-08-16 15:29 . 2010-08-16 15:20 -------- d-----w- c:\users\Barmar\AppData\Roaming\WebSurf.ru
2010-08-11 10:13 . 2010-06-08 08:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-06 06:22 . 2010-06-08 07:29 66976 ----a-w- c:\users\Barmar\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-02 10:12 . 2010-06-08 18:34 -------- d-----w- c:\program files\Common Files\Apple
2010-07-30 13:12 . 2010-06-12 15:27 -------- d-----w- c:\users\Barmar\AppData\Roaming\CyberLink
2010-07-27 18:34 . 2010-07-11 14:12 -------- d-----w- c:\programdata\ABBYY
2010-07-23 08:21 . 2010-07-23 08:21 -------- d-----w- c:\program files\Plus500
2010-07-22 20:11 . 2010-06-08 20:17 -------- d-----w- c:\program files\The KMPlayer
2010-07-16 07:23 . 2010-06-11 13:45 -------- d-----w- c:\program files\Miranda IM baru
2010-07-16 07:22 . 2010-07-13 14:34 -------- d-----w- c:\program files\Miranda IM
2010-07-13 14:35 . 2010-07-13 14:35 -------- d-----w- c:\users\Barmar\AppData\Roaming\Miranda
2010-07-12 06:37 . 2010-07-12 06:21 -------- d-----w- c:\programdata\FLEXnet
2010-07-12 06:18 . 2010-07-12 06:18 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-07-12 05:54 . 2010-07-12 05:54 -------- d-----w- c:\users\Barmar\AppData\Roaming\ABBYY
2010-07-07 11:58 . 2010-07-07 11:58 -------- d-----w- c:\program files\DesetiPrsty
2010-07-06 15:28 . 2010-08-16 15:20 740864 ----a-w- c:\users\Barmar\AppData\Roaming\WebSurf.ru\WebSurf.exe
2010-07-01 11:26 . 2010-07-01 11:26 828160 ----a-w- c:\windows\boinc.scr
2010-06-30 18:58 . 2010-06-08 11:03 -------- d-----w- c:\users\Barmar\AppData\Roaming\BSplayer PRO
2010-06-30 06:25 . 2010-08-11 09:09 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-28 07:56 . 2010-06-28 07:56 -------- d-----w- c:\program files\rajce
2010-06-22 02:47 . 2010-08-11 09:09 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 09:09 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 09:09 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 09:09 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 09:09 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-17 16:57 . 2010-06-17 16:57 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-14 10:08 . 2010-06-18 20:41 103424 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2010-06-14 10:08 . 2010-06-18 20:41 545280 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2010-06-14 10:08 . 2010-06-18 20:41 4687360 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\libs\cooliris192.dll
2010-06-14 10:08 . 2010-06-18 20:41 152064 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2010-06-14 10:08 . 2010-06-18 20:41 425984 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2010-06-14 10:08 . 2010-06-18 20:41 4687872 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\libs\cooliris190.dll
2010-06-14 10:08 . 2010-06-18 20:41 57856 ----a-w- c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2010-06-13 15:36 . 2010-06-10 13:48 242392 ----a-w- c:\windows\hpoins19.dat
2010-06-13 12:31 . 2010-06-11 14:21 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-06-13 12:31 . 2010-06-08 12:54 505128 ----a-w- c:\windows\system32\msvcp71.dll
2010-06-13 12:31 . 2010-06-11 14:28 53319 ----a-w- c:\programdata\Temp\{8C20787A-7402-4FA7-BF25-6E5750930FDC}\PostBuild.exe
2010-06-11 14:41 . 2010-06-08 12:50 353576 ----a-w- c:\windows\system32\msvcr71.dll
2010-06-11 14:20 . 2010-06-11 14:21 53319 ----a-w- c:\programdata\Temp\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
2010-06-08 10:07 . 2010-06-08 10:08 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-06-08 07:25 . 2010-06-08 07:25 10134 ----a-r- c:\users\Barmar\AppData\Roaming\Microsoft\Installer\{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}\ARPPRODUCTICON.exe
2010-06-08 06:55 . 2010-06-08 06:55 0 ----a-w- c:\windows\ativpsrm.bin
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\UC.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\RAR.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\PKZIP.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\LHA.PIF
2010-06-03 05:55 . 2010-06-08 09:49 545 ----a-w- c:\windows\ARJ.PIF
2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr
2010-05-27 07:24 . 2010-06-09 06:01 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 06:01 293888 ----a-w- c:\windows\system32\atmfd.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Barmar\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-06-08 136176]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]
"TNOD UP"="c:\program files\TNod User & Password Finder\TNODUP.exe" [2010-04-01 1811968]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2010-07-01 4862720]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2010-07-01 58112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-06-19 10:36 640440 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2010-06-19 17:04 38840 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2010-04-02 07:11 75048 ------w- c:\program files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl10]
2010-02-02 22:08 87336 ------w- c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe

R3 AMDMSRIO;AMDMSRIO;c:\users\Barmar\AppData\Local\Temp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-06-17 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/06/11 16:24];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-04-02 07:11 87536]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-04-07 41312]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2232105079-3074953530-982546561-1001Core.job
- c:\users\Barmar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-08 08:09]

2010-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2232105079-3074953530-982546561-1001UA.job
- c:\users\Barmar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-08 08:09]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Převést cíl vazby do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést do Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Připojit cíl vazby k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Připojit k existujícímu PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
FF - ProfilePath - c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=cs&q=
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - component: c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\users\Barmar\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\users\Barmar\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\Barmar\AppData\Roaming\Mozilla\Firefox\Profiles\aifswfyi.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-08-23 14:21:35
ComboFix-quarantined-files.txt 2010-08-23 12:21

Před spuštěním: Volných bajtů: 15 230 619 648
Po spuštění: Volných bajtů: 19 659 878 400

- - End Of File - - CF57DDD228E5C9ABD5801F810BA5D443

Tu složku co se nově objevila jste mazal?

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

Ten adresar jsem nemazal.
Prave skenuji, dal jsem uplny sken, jak jste psal, mam 3logicke/2fyzicke disky, tak to bude asi chvili trvat...
Kazdopadne dekuji za snahu.

mbam :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4469

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

24.8.2010 18:51:33
mbam-log-2010-08-24 (18-51-33).txt

Typ skenu: Úplný sken (C:\|D:\|E:\|)
Skenované objekty: 419340
Uplynulý čas: 2 hodina(y), 4 minuta(y), 53 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\idln2 (Malware.Trace) -> No action taken.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\RegGenie\RegGenieOnUninstall.exe (Spyware.Passwords) -> No action taken.
E:\hokna\lockerz\LRC\LRC.exe (Trojan.Agent) -> No action taken.

V mbamu vše smažte.
Co počítač?

Smazano, pocitac funguje.
Proces csrss.exe je tu porad bez dalsich informaci o nem ve spravci informaci.
A jeho umisteni v adresari je porad. Mam adresar smazat nebo jaky navrhujete dalsi postup ?!

Dekuji.

Můžete mi napsat prosím přesnou cestu k souboru v tom adresáři?

C:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_58ba39fb456943bd

Ten soubor, přímo z této složky otestujte na www.virustotal.com

tak jsem dal rescan a nenaslo to nic ve vsech 42 antivirech, tak nevim, ale ta slozka je hodne divna...

Myslím že ta složka je v pořádku.


Tuto složku znáte?
c:\users\Barmar\AppData\Roaming\WebSurf.ru

Ano, znam, je to autosurf, pres ktery pravdepodobne chodi obcas nejaky spyware nebo malware. Samostatne by mel byt neskodny, toci se v nem stranky, ktere nekdy obsahuji havet.

Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?