kontrola loga..:

[klim11]

Zdravím....:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Libas at 2010-08-26 13:19:49
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 145 GB (62%) free of 234 GB
Total RAM: 1023 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:21:00, on 26.8.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Libas\Desktop\RSIT.exe
C:\Program Files\trend micro\Libas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cs.intl.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/ ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Acer TV Share Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 5643 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-06 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-02-06 151552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-02-07 464168]
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-02-15 151552]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
C:\Acer\Empowering Technology\SysMonitor.exe [2007-01-24 319488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2007-03-23 4423680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
C:\Windows\Skytel.exe [2007-03-16 1822720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PCM Media Sharing.lnk]
C:\PROGRA~1\ACERAR~1\ACERHO~2\Kernel\DMS\PCMMED~1.EXE [2007-04-04 200812]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Libas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2009-02-26 97680]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption"
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2010-08-26 13:19:50 ----D---- C:\Program Files\trend micro
2010-08-26 13:19:49 ----D---- C:\rsit
2010-08-26 12:39:18 ----ASH---- C:\hiberfil.sys
2010-08-26 12:34:07 ----D---- C:\Windows\temp
2010-08-26 00:50:09 ----SHD---- C:\$RECYCLE.BIN
2010-08-26 00:20:33 ----A---- C:\Windows\system32\drivers\aswSP.sys
2010-08-26 00:20:33 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2010-08-26 00:20:32 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2010-08-26 00:20:30 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2010-08-26 00:20:28 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2010-08-26 00:20:15 ----A---- C:\Windows\system32\aswBoot.exe
2010-08-26 00:20:06 ----D---- C:\ProgramData\Alwil Software
2010-08-26 00:20:06 ----D---- C:\Program Files\Alwil Software
2010-08-25 23:15:26 ----D---- C:\Program Files\Yamicsoft
2010-08-17 12:47:24 ----D---- C:\Program Files\FlatOut
2010-08-11 17:23:41 ----A---- C:\Windows\system32\mshtml.dll
2010-08-11 17:23:41 ----A---- C:\Windows\system32\iertutil.dll
2010-08-11 17:23:39 ----A---- C:\Windows\system32\ieframe.dll
2010-08-11 17:23:37 ----A---- C:\Windows\system32\urlmon.dll
2010-08-11 17:23:36 ----A---- C:\Windows\system32\wininet.dll
2010-08-11 17:23:36 ----A---- C:\Windows\system32\msfeeds.dll
2010-08-11 17:23:36 ----A---- C:\Windows\system32\ie4uinit.exe
2010-08-11 17:23:35 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-11 17:23:34 ----A---- C:\Windows\system32\occache.dll
2010-08-11 17:23:34 ----A---- C:\Windows\system32\mstime.dll
2010-08-11 17:23:34 ----A---- C:\Windows\system32\ieui.dll
2010-08-11 17:23:34 ----A---- C:\Windows\system32\iepeers.dll
2010-08-11 17:23:33 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-11 17:23:33 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-11 17:23:33 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-11 17:23:33 ----A---- C:\Windows\system32\ieUnatt.exe
2010-08-11 17:23:33 ----A---- C:\Windows\system32\iesysprep.dll
2010-08-11 17:23:33 ----A---- C:\Windows\system32\iesetup.dll
2010-08-11 17:23:33 ----A---- C:\Windows\system32\iernonce.dll
2010-08-11 17:23:29 ----A---- C:\Windows\system32\iccvid.dll
2010-08-11 17:23:26 ----A---- C:\Windows\system32\schannel.dll
2010-08-11 17:23:16 ----A---- C:\Windows\system32\win32k.sys
2010-08-11 17:23:12 ----A---- C:\Windows\system32\rtutils.dll
2010-08-11 17:22:23 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-11 17:22:21 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-11 17:22:03 ----A---- C:\Windows\system32\msxml3.dll
2010-08-11 17:21:55 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-11 17:21:54 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-11 17:21:47 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-04 00:24:03 ----D---- C:\totalcmd
2010-08-03 15:49:10 ----D---- C:\Program Files\Secunia
2010-08-03 14:34:17 ----A---- C:\Windows\system32\shell32.dll
2010-08-01 14:57:43 ----D---- C:\ProgramData\vsosdk
2010-07-30 15:40:46 ----D---- C:\Users\Libas\AppData\Roaming\Tific
2010-07-30 13:36:33 ----D---- C:\Program Files\Microsoft Visual Studio
2010-07-30 13:36:32 ----D---- C:\Program Files\Common Files\DESIGNER
2010-07-30 13:35:50 ----D---- C:\Windows\PCHEALTH
2010-07-30 13:35:50 ----D---- C:\Program Files\Microsoft.NET
2010-07-30 13:33:15 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-07-30 13:32:18 ----D---- C:\Program Files\Microsoft Office
2010-07-30 13:31:11 ----RD---- C:\MSOCache

======List of files/folders modified in the last 1 months======

2010-08-26 13:19:50 ----RD---- C:\Program Files
2010-08-26 13:09:58 ----D---- C:\Windows
2010-08-26 13:08:40 ----D---- C:\Windows\ERDNT
2010-08-26 12:33:35 ----D---- C:\Windows\system32\drivers
2010-08-26 12:33:35 ----D---- C:\Windows\System32
2010-08-26 12:32:20 ----D---- C:\Windows\AppPatch
2010-08-26 12:32:19 ----D---- C:\Program Files\Common Files
2010-08-26 10:49:57 ----SHD---- C:\System Volume Information
2010-08-26 00:46:09 ----A---- C:\Windows\system.ini
2010-08-26 00:45:55 ----D---- C:\Windows\system32\drivers\etc
2010-08-26 00:20:23 ----SHD---- C:\Windows\Installer
2010-08-26 00:20:23 ----D---- C:\Config.Msi
2010-08-26 00:20:06 ----D---- C:\ProgramData
2010-08-26 00:17:43 ----D---- C:\Program Files\CCleaner
2010-08-25 23:48:20 ----D---- C:\ProgramData\Norton
2010-08-25 23:46:52 ----D---- C:\Windows\system32\Tasks
2010-08-25 23:46:49 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-08-25 23:46:48 ----D---- C:\Windows\system32\catroot
2010-08-25 23:46:47 ----D---- C:\Windows\inf
2010-08-25 23:46:42 ----DC---- C:\Windows\system32\DRVSTORE
2010-08-25 23:32:35 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-08-25 23:20:48 ----D---- C:\Windows\Prefetch
2010-08-25 23:16:13 ----D---- C:\Windows\system32\catroot2
2010-08-25 23:15:43 ----SD---- C:\Users\Libas\AppData\Roaming\Microsoft
2010-08-25 21:51:15 ----D---- C:\Windows\system32\LogFiles
2010-08-25 17:05:00 ----RSD---- C:\Windows\assembly
2010-08-25 17:05:00 ----D---- C:\Windows\Microsoft.NET
2010-08-25 16:04:35 ----D---- C:\Windows\system32\cs-CZ
2010-08-25 16:03:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-25 15:58:40 ----D---- C:\Windows\system32\en-US
2010-08-23 19:27:14 ----D---- C:\Program Files\Mozilla Firefox
2010-08-11 21:18:04 ----D---- C:\Boot
2010-08-11 18:25:09 ----D---- C:\Windows\winsxs
2010-08-11 18:23:05 ----D---- C:\Windows\Debug
2010-08-11 18:11:49 ----D---- C:\Windows\system32\migration
2010-08-11 18:11:49 ----D---- C:\Program Files\Internet Explorer
2010-08-11 18:11:48 ----D---- C:\Program Files\Movie Maker
2010-08-11 18:09:33 ----D---- C:\ProgramData\Microsoft Help
2010-08-11 18:06:26 ----D---- C:\Program Files\Windows Mail
2010-08-08 16:10:33 ----D---- C:\Users\Libas\AppData\Roaming\Vso
2010-08-07 18:36:46 ----D---- C:\Program Files\Microsoft Works
2010-08-06 12:19:21 ----D---- C:\ProgramData\VistaCodecs
2010-08-06 12:00:12 ----D---- C:\ProgramData\Adobe
2010-08-03 20:09:31 ----A---- C:\Windows\system32\mrt.exe
2010-08-03 14:20:36 ----D---- C:\Users\Libas\AppData\Roaming\ICQ
2010-07-30 14:38:53 ----D---- C:\Program Files\Common Files\microsoft shared
2010-07-30 14:36:05 ----A---- C:\Windows\win.ini
2010-07-30 14:36:04 ----D---- C:\Program Files\Common Files\System
2010-07-30 13:36:55 ----D---- C:\Program Files\MSBuild
2010-07-30 13:36:28 ----D---- C:\Windows\ShellNew
2010-07-30 13:36:03 ----RSD---- C:\Windows\Fonts
2010-07-30 13:35:50 ----SD---- C:\ProgramData\Microsoft
2010-07-30 13:23:40 ----D---- C:\ProgramData\WinZip
2010-07-29 20:39:38 ----D---- C:\Windows\system32\WDI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;ATI PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 8192]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-07 20264]
R0 PSDNServ;PSDNSERVER; C:\Windows\system32\drivers\PSDNServ.sys [2007-02-07 16680]
R0 psdvdisk;psdvdisk; C:\Windows\system32\drivers\psdvdisk.sys [2007-02-07 60712]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-06-28 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-06-28 46672]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-14 2427392]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-26 1761696]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-05-10 6144]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-06-22 47360]
R3 Ph3xIB32;Philips 713x VU PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-03-23 240128]
S3 catchme;catchme; \??\C:\Users\Libas\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-07-07 14904]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
R2 Acer TV Share Service;Acer TV Share Service; C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
R2 AcerMemUsageCheckService;ePerformance Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2006-12-29 28672]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-03-14 569344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-02-07 457512]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-01-31 53248]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-04-09 143360]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

[stell]

zdravim.
log vyzera ,ok.

[klim11]

pro jistotu jsem ještě udělal scan z ComboFixu... a nějakou havěť to přece našlo...)))Ještě ohledně toho ComboFixu"spouštěl jsem ho jak v normálním režimu tak i nouzovém Rež...a stále mi to psalo že :"Access Denied.Administrations permissions are needed to use the selected options.Use an Administrations command prompt to complete these task."Nevíte co to znamená.???a po dokončení scanu se chtěl restartovat,ale PC se kouslo tak,že tvrdý vypnutí a po zapnutí-ComboFix pokračoval v činosti,,...)) nevím,jest-li je to normální postup,ale nezdá se mi to můžete mi prosím poradit..???děkuju..)

ComboFix 10-08-25.01 - Libas 26.08.2010 15:04:00.1.1 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.1023.572 [GMT 2:00]
Spuštěný z: c:\users\Libas\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie c:\windows\system32\wininit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\wininit.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-26 do 2010-08-26 )))))))))))))))))))))))))))))))
.

2010-08-26 13:11 . 2010-08-26 13:16 -------- d-----w- c:\users\Libas\AppData\Local\temp
2010-08-26 13:11 . 2010-08-26 13:11 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-08-26 13:11 . 2010-08-26 13:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-26 11:19 . 2010-08-26 11:21 -------- d-----w- c:\program files\trend micro
2010-08-26 11:19 . 2010-08-26 11:21 -------- d-----w- C:\rsit
2010-08-25 22:20 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-08-25 22:20 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-08-25 22:20 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-08-25 22:20 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-08-25 22:20 . 2010-06-28 20:32 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-08-25 22:20 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-08-25 22:20 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-08-25 22:20 . 2010-08-25 22:20 -------- d-----w- c:\programdata\Alwil Software
2010-08-25 22:20 . 2010-08-25 22:20 -------- d-----w- c:\program files\Alwil Software
2010-08-25 21:32 . 2010-08-25 21:32 53632 ----a-w- c:\users\Libas\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-25 19:58 . 2010-08-25 20:20 -------- d-----w- c:\users\Public\Filmy
2010-08-25 14:46 . 2008-08-17 20:09 274944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp64X.dll
2010-08-17 10:47 . 2010-08-17 10:49 -------- d-----w- c:\program files\FlatOut
2010-08-17 10:13 . 2010-08-17 10:43 -------- d-----w- c:\users\Libas\AppData\Local\Microsoft Games
2010-08-11 15:22 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-11 15:22 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-11 15:22 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-11 15:21 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-11 15:21 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-11 15:21 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-03 22:24 . 2010-08-03 22:24 -------- d-----w- C:\totalcmd
2010-08-03 13:49 . 2010-08-03 13:49 -------- d-----w- c:\program files\Secunia
2010-08-01 12:57 . 2010-08-01 12:57 -------- d-----w- c:\programdata\vsosdk
2010-07-30 13:40 . 2010-07-30 13:40 -------- d-----w- c:\users\Libas\AppData\Roaming\Tific
2010-07-30 11:35 . 2010-08-25 13:58 -------- d-----w- c:\program files\Microsoft.NET
2010-07-30 11:35 . 2010-07-30 11:35 -------- d-----w- c:\windows\PCHEALTH
2010-07-30 11:33 . 2010-07-30 11:33 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-07-30 11:31 . 2010-07-30 11:31 -------- d-----r- C:\MSOCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 22:17 . 2010-06-21 17:02 -------- d-----w- c:\program files\CCleaner
2010-08-25 21:48 . 2010-06-21 15:57 -------- d-----w- c:\programdata\Norton
2010-08-25 21:46 . 2007-05-10 10:21 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-08-25 21:32 . 2010-06-21 16:51 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-25 21:32 . 2010-06-21 16:52 53632 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-25 14:03 . 2007-01-08 21:09 607232 ----a-w- c:\windows\system32\perfh005.dat
2010-08-25 14:03 . 2007-01-08 21:09 117912 ----a-w- c:\windows\system32\perfc005.dat
2010-08-11 16:09 . 2007-05-10 10:30 -------- d-----w- c:\programdata\Microsoft Help
2010-08-11 16:06 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-08 14:17 . 2010-07-04 08:50 153726 ----a-w- c:\windows\HPHins15.dat
2010-08-08 14:10 . 2010-06-22 13:24 -------- d-----w- c:\users\Libas\AppData\Roaming\Vso
2010-08-07 16:36 . 2007-05-10 10:31 -------- d-----w- c:\program files\Microsoft Works
2010-08-06 10:19 . 2010-07-04 12:42 -------- d-----w- c:\programdata\VistaCodecs
2010-08-03 12:20 . 2010-06-22 15:04 -------- d-----w- c:\users\Libas\AppData\Roaming\ICQ
2010-07-30 12:16 . 2010-06-21 15:20 102424 ----a-w- c:\users\Libas\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-30 11:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild
2010-07-30 11:23 . 2010-07-26 11:24 -------- d-----w- c:\programdata\WinZip
2010-07-26 11:27 . 2007-05-10 10:17 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-22 18:30 . 2010-07-22 18:30 680 ----a-w- c:\users\Libas\AppData\Local\d3d9caps.dat
2010-07-10 20:44 . 2010-07-10 20:25 -------- d-----w- c:\users\Libas\AppData\Roaming\Download Manager
2010-07-07 20:00 . 2010-06-22 21:57 -------- d-----w- c:\programdata\NortonInstaller
2010-07-07 14:05 . 2010-07-07 14:05 14904 ----a-w- c:\windows\system32\drivers\psi_mf.sys
2010-07-06 08:59 . 2010-07-06 08:59 -------- d-----w- c:\users\Libas\AppData\Roaming\Malwarebytes
2010-07-06 08:59 . 2010-07-06 08:59 -------- d-----w- c:\programdata\Malwarebytes
2010-07-06 08:51 . 2010-07-06 08:51 -------- d-----w- c:\users\Libas\AppData\Roaming\VitySoft
2010-07-06 08:51 . 2010-07-06 08:51 -------- d-----w- c:\program files\Common Files\Java
2010-07-06 08:51 . 2010-07-06 08:51 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-06 08:51 . 2010-07-06 08:51 -------- d-----w- c:\program files\Java
2010-07-06 08:42 . 2010-07-06 08:36 -------- d-----w- c:\users\Libas\AppData\Roaming\HpUpdate
2010-07-04 12:43 . 2010-07-04 12:43 -------- d-----w- c:\users\Libas\AppData\Roaming\VistaCodecs
2010-07-04 12:43 . 2010-07-04 12:43 -------- d-----w- c:\program files\VistaCodecPack
2010-07-04 09:00 . 2010-07-04 09:00 -------- d-----w- c:\users\Libas\AppData\Roaming\HP
2010-07-04 08:59 . 2010-07-04 08:59 -------- d-----w- c:\programdata\WEBREG
2010-07-04 08:58 . 2010-07-04 08:50 -------- d-----w- c:\programdata\HP
2010-07-04 08:57 . 2010-07-04 08:57 -------- d-----w- c:\programdata\HPSSUPPLY
2010-07-04 08:57 . 2010-07-04 08:53 -------- d-----w- c:\program files\HP
2010-07-04 08:56 . 2010-07-04 08:56 -------- d-----w- c:\programdata\HP Product Assistant
2010-07-04 08:54 . 2010-07-04 08:54 -------- d-----w- c:\program files\Common Files\HP
2010-07-04 08:50 . 2010-07-04 08:50 -------- d-----w- c:\programdata\Hewlett-Packard
2010-06-26 06:05 . 2010-08-11 15:23 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-11 15:23 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-11 15:23 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-11 15:23 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-23 10:35 . 2010-06-23 10:35 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-06-23 10:35 . 2010-06-23 10:35 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-06-22 14:10 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-06-22 13:24 . 2010-06-22 13:24 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-06-22 13:24 . 2010-06-22 13:24 47360 ----a-w- c:\users\Libas\AppData\Roaming\pcouffin.sys
2010-06-22 13:24 . 2010-06-22 13:24 47360 ----a-w- c:\users\Libas\AppData\Roaming\pcouffin.sys
2010-06-22 09:57 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-06-22 09:56 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-06-22 08:06 . 2010-06-22 08:06 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-06-21 21:50 . 2010-06-21 21:50 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll
2010-06-21 21:50 . 2010-06-21 21:50 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll
2010-06-21 21:50 . 2010-06-21 21:50 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll
2010-06-21 21:50 . 2010-06-21 21:50 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll
2010-06-21 21:50 . 2010-06-21 21:50 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll
2010-06-21 21:50 . 2010-06-21 21:50 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll
2010-06-21 21:50 . 2010-06-21 21:50 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll
2010-06-21 21:50 . 2010-06-21 21:50 5499904 ----a-w- c:\windows\system32\NlsLexicons0022.dll
2010-06-21 21:50 . 2010-06-21 21:50 7964672 ----a-w- c:\windows\system32\NlsLexicons0024.dll
2010-06-21 21:50 . 2010-06-21 21:50 5791232 ----a-w- c:\windows\system32\NlsLexicons0026.dll
2010-06-21 21:50 . 2010-06-21 21:50 6224896 ----a-w- c:\windows\system32\NlsLexicons0027.dll
2010-06-21 21:48 . 2010-06-21 21:48 1523712 ----a-w- c:\windows\system32\NlsData0000.dll
2010-06-21 21:36 . 2010-06-21 21:36 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-06-21 20:53 . 2010-06-21 20:53 23552 ----a-w- c:\windows\system32\lpk.dll
2010-06-21 20:53 . 2010-06-21 20:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-06-21 20:53 . 2010-06-21 20:53 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-06-21 20:53 . 2010-06-21 20:53 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-06-21 20:48 . 2010-06-21 20:48 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-06-21 20:48 . 2010-06-21 20:48 272896 ----a-w- c:\windows\system32\polstore.dll
2010-06-21 20:46 . 2010-06-21 20:46 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-21 20:41 . 2010-06-21 20:41 17920 ----a-w- c:\windows\system32\netevent.dll
2010-06-21 20:41 . 2010-06-21 20:41 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-06-21 20:41 . 2010-06-21 20:41 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-06-21 20:41 . 2010-06-21 20:41 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-06-21 20:41 . 2010-06-21 20:41 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-06-21 20:41 . 2010-06-21 20:41 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-06-21 20:41 . 2010-06-21 20:41 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-06-21 20:41 . 2010-06-21 20:41 105984 ----a-w- c:\windows\system32\netiohlp.dll
2010-06-21 20:41 . 2010-06-21 20:41 10240 ----a-w- c:\windows\system32\finger.exe
2010-06-21 20:37 . 2010-06-21 20:37 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2010-06-21 20:37 . 2010-06-21 20:37 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2010-06-21 20:37 . 2010-06-21 20:37 65024 ----a-w- c:\windows\system32\wlanapi.dll
2010-06-21 20:37 . 2010-06-21 20:37 513536 ----a-w- c:\windows\system32\wlansvc.dll
2010-06-21 20:37 . 2010-06-21 20:37 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-06-21 20:37 . 2010-06-21 20:37 302592 ----a-w- c:\windows\system32\wlansec.dll
2010-06-21 20:37 . 2010-06-21 20:37 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2010-06-21 20:35 . 2010-06-21 20:35 1401856 ----a-w- c:\windows\system32\msxml6.dll
2010-06-21 20:35 . 2010-06-21 20:35 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-06-21 20:35 . 2010-06-21 20:35 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-06-21 20:34 . 2010-06-21 20:34 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-06-21 20:34 . 2010-06-21 20:34 9728 ----a-w- c:\windows\system32\lsass.exe
2010-06-21 20:34 . 2010-06-21 20:34 72704 ----a-w- c:\windows\system32\secur32.dll
2010-06-21 20:34 . 2010-06-21 20:34 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-06-21 20:34 . 2010-06-21 20:34 218624 ----a-w- c:\windows\system32\msv1_0.dll
2010-06-21 20:34 . 2010-06-21 20:34 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2010-06-21 20:33 . 2010-06-21 20:33 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-06-21 20:33 . 2010-06-21 20:33 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-06-21 20:33 . 2010-06-21 20:33 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-10 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PCM Media Sharing.lnk]
backup=c:\windows\pss\PCM Media Sharing.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Libas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk]
backup=c:\windows\pss\Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-03-23 11:04 4423680 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-03-16 07:06 1822720 ----a-w- c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
2006-11-05 19:48 57344 ----a-w- c:\acer\WR_PopUp\WarReg_PopUp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):c8,cb,14,91,0b,12,cb,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-07-07 14904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S1 aswSP;aswSP; [x]
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
S2 Acer TV Share Service;Acer TV Share Service;c:\program files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://cs.intl.acer.yahoo.com
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Libas\AppData\Roaming\Mozilla\Firefox\Profiles\2f8a83c0.default\
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-26 15:16
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Celkový čas: 2010-08-26 15:22:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-26 13:22

Před spuštěním: Volných bajtů: 152 563 249 152
Po spuštění: Volných bajtů: 151 367 319 552

- - End Of File - - 012494FA2E08DFB43B27F83F6EB8A201

[stell]

to znamena ze mal si spustit combofix z uctu administartora, combofix nasiel infikovany systemovy subor, a opravil,
ak nemas problem s pc , tot vse.

[klim11]

combofix jsem pustil jako správce !!!!to by mělo být v pořádku néé??? ale stejnak to píše.)
nevím ,ale možná by pomohlo vypnout (UAC)-ale teď si nejsem jistý.))abych to šlo přímo z Účtu admina..)) máte s tím zkušenosti.??

[stell]

hm, ak nemas stym skusenost, preco si spustal z vlastnej iniciativy combofix??
Tak ako som pisal, log je ok,