VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Spoštění zp1, zp2.exe atd.

https://forum.viry.cz:443/viewtopic.php?t=106105

Stránka 1 z 1

Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 09:31
od ghostik
Zdravím, neustále antivir hlásí neplechu. Jená se o soubor zp2.exe zpl.exe zpe3.exe, když ho vymažu, zastavím proces atd. po restartu je to tam zase. V procesech je popis STEELS. Můžete prosím projet log.
Děkuji

Logfile of random's system information tool 1.08 (written by random/random)
Run by Romana at 2010-10-31 09:01:13
Microsoft Windows 7 Professional
System drive C: has 86 GB (86%) free of 100 GB
Total RAM: 766 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:01:31, on 31.10.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Users\Romana\AppData\Local\Temp\Zp2.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
C:\Program Files\Bluetooth Suite\BtvStack.exe
C:\Program Files\Bluetooth Suite\AthBtTray.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Brownie\BrStsWnd.exe
C:\Program Files\Brownie\Brnipmon.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Public\Documents\RSIT.exe
C:\Program Files\trend micro\Romana.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\ProgramData\LangSoft\WebIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\ProgramData\LangSoft\WebIE.dll
O3 - Toolbar: PandoraTV Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe
O4 - HKLM\..\Run: [AtherosBtStack] "C:\Program Files\Bluetooth Suite\BtvStack.exe"
O4 - HKLM\..\Run: [AthBtTray] "C:\Program Files\Bluetooth Suite\AthBtTray.exe"
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe Autorun
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Metropolis] rundll32.exe C:\Users\Romana\AppData\Local\Temp\sshnas21.dll,GetHandle
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\ProgramData\LangSoft\WebIE.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AtherosSvc - Atheros Communications - C:\Program Files\Bluetooth Suite\adminservice.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: GenericMount Helper Service - Symantec - C:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SymSnapService - Symantec - C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe

--
End of file - 7755 bytes

======Scheduled tasks folder======

C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\ProgramData\LangSoft\WebIE.dll [2010-10-29 798771]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
PandoraTV Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\ProgramData\LangSoft\WebIE.dll [2010-10-29 798771]
{D4027C7F-154A-4066-A1AD-4243D8127440} - PandoraTV Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-17 98304]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe [2010-03-04 496184]
"AtherosBtStack"=C:\Program Files\Bluetooth Suite\BtvStack.exe [2010-04-01 445528]
"AthBtTray"=C:\Program Files\Bluetooth Suite\AthBtTray.exe [2010-04-01 285784]
"AmIcoSinglun"=C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [2010-02-05 233472]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-02-26 1713448]
"Acer ePower Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2010-04-23 715296]
"MSSE"=C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-09-15 1094224]
"BrStsWnd"=C:\Program Files\Brownie\BrstsWnd.exe [2008-09-18 880640]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-10-11 14940040]
"Metropolis"=C:\Users\Romana\AppData\Local\Temp\sshnas21.dll [2010-10-29 315392]
""= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-09-02 672632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
C:\Program Files\Norton Ghost\Agent\VProTray.exe [2009-10-01 2596712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\U36VRSFLG6]
C:\Users\Romana\AppData\Local\Temp\Zpx.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-31 08:33:57 ----D---- C:\Program Files\trend micro
2010-10-31 08:33:56 ----D---- C:\rsit
2010-10-30 15:38:52 ----D---- C:\ProgramData\Nokia
2010-10-30 12:32:00 ----D---- C:\Windows\WindowsMobile
2010-10-30 09:18:45 ----D---- C:\Symantec
2010-10-30 09:14:52 ----D---- C:\Users\Romana\AppData\Roaming\URSoft
2010-10-30 09:14:51 ----AD---- C:\ProgramData\TEMP
2010-10-30 09:14:37 ----D---- C:\Program Files\Your Uninstaller 2010
2010-10-30 08:29:58 ----D---- C:\Program Files\MSXML 4.0
2010-10-29 22:44:31 ----D---- C:\Program Files\Ask.com
2010-10-29 22:42:33 ----D---- C:\Program Files\The KMPlayer
2010-10-29 22:34:27 ----A---- C:\Windows\WTRDCTM.INI
2010-10-29 22:27:47 ----D---- C:\TRANSLAT
2010-10-29 22:27:44 ----D---- C:\ProgramData\LangSoft
2010-10-29 22:27:25 ----D---- C:\Users\Romana\AppData\Roaming\LangSoft
2010-10-29 21:56:53 ----D---- C:\Users\Romana\AppData\Roaming\Nokia Ovi Suite
2010-10-29 21:29:04 ----D---- C:\Users\Romana\AppData\Roaming\Nokia
2010-10-29 21:27:29 ----D---- C:\ProgramData\PC Suite
2010-10-29 21:27:27 ----D---- C:\Users\Romana\AppData\Roaming\PC Suite
2010-10-29 21:24:00 ----D---- C:\Program Files\Common Files\Nokia
2010-10-29 21:23:04 ----A---- C:\Windows\system32\drivers\pccsmcfd.sys
2010-10-29 21:22:35 ----D---- C:\Program Files\PC Connectivity Solution
2010-10-29 21:21:48 ----A---- C:\Windows\system32\nmwcdcls.dll
2010-10-29 21:19:38 ----D---- C:\Users\Romana\AppData\Roaming\Symantec
2010-10-29 21:19:21 ----D---- C:\ProgramData\NokiaInstallerCache
2010-10-29 21:19:21 ----D---- C:\Program Files\Nokia
2010-10-29 20:48:21 ----D---- C:\Users\Romana\AppData\Roaming\Macromedia
2010-10-29 20:48:21 ----D---- C:\Users\Romana\AppData\Roaming\Adobe
2010-10-29 20:47:53 ----A---- C:\Windows\system32\capicom.dll
2010-10-29 20:47:52 ----D---- C:\Program Files\Symantec
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MSVCR71.DLL
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MSVCP71.DLL
2010-10-29 20:47:52 ----A---- C:\Windows\system32\MFC71.DLL
2010-10-29 20:47:18 ----A---- C:\Windows\system32\drivers\WimFltr.sys
2010-10-29 20:46:16 ----A---- C:\Windows\system32\drivers\symsnap.sys
2010-10-29 20:45:59 ----A---- C:\Windows\system32\drivers\vproeventmonitor.sys
2010-10-29 20:45:45 ----A---- C:\Windows\system32\GEARAspi.dll
2010-10-29 20:45:45 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 20:43:54 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-10-29 20:42:53 ----D---- C:\ProgramData\Symantec
2010-10-29 20:42:53 ----D---- C:\ProgramData\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 20:42:53 ----D---- C:\Program Files\Norton Ghost
2010-10-29 20:34:26 ----D---- C:\Program Files\Microsoft Works
2010-10-29 20:33:52 ----D---- C:\Program Files\Microsoft Visual Studio
2010-10-29 20:33:51 ----D---- C:\Program Files\Common Files\DESIGNER
2010-10-29 20:32:36 ----D---- C:\Windows\PCHEALTH
2010-10-29 20:32:36 ----D---- C:\Program Files\Microsoft.NET
2010-10-29 20:27:52 ----D---- C:\Program Files\Microsoft Office
2010-10-29 20:27:50 ----D---- C:\ProgramData\Microsoft Help
2010-10-29 20:27:13 ----RHD---- C:\MSOCache
2010-10-29 20:25:07 ----A---- C:\Windows\BRVIDEO.INI
2010-10-29 20:25:07 ----A---- C:\Windows\brmx2001.ini
2010-10-29 20:25:04 ----A---- C:\Windows\BRWMARK.INI
2010-10-29 20:24:52 ----N---- C:\Windows\system32\brlmw03a.ini
2010-10-29 20:24:52 ----N---- C:\Windows\system32\brlmw03a.dll
2010-10-29 20:24:50 ----D---- C:\Program Files\Brownie
2010-10-29 20:24:50 ----A---- C:\Windows\HL-2150N.INI
2010-10-29 20:24:39 ----N---- C:\Windows\system32\Pdrvinst.dll
2010-10-29 20:24:39 ----N---- C:\Windows\system32\BRWEBUP.EXE
2010-10-29 20:24:39 ----N---- C:\Windows\system32\BrWebIns.dll
2010-10-29 20:24:39 ----D---- C:\Program Files\Brother
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BRRBTOOL.EXE
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BROSNMP.DLL
2010-10-29 20:24:39 ----A---- C:\Windows\system32\BRLM03A.DLL
2010-10-29 20:24:10 ----A---- C:\Windows\Brownie.ini
2010-10-29 20:24:03 ----D---- C:\Program Files\Common Files\InstallShield
2010-10-29 20:18:40 ----D---- C:\Users\Romana\AppData\Roaming\skypePM
2010-10-29 20:16:39 ----D---- C:\Program Files\Common Files\Skype
2010-10-29 20:16:30 ----RD---- C:\Program Files\Skype
2010-10-29 20:16:29 ----D---- C:\Users\Romana\AppData\Roaming\Skype
2010-10-29 20:16:23 ----D---- C:\ProgramData\Skype
2010-10-29 20:15:58 ----D---- C:\Windows\system32\Macromed
2010-10-29 19:53:15 ----A---- C:\Windows\system32\msv1_0.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\PresentationHost.exe
2010-10-29 19:50:37 ----A---- C:\Windows\system32\netfxperf.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\mscoree.dll
2010-10-29 19:50:37 ----A---- C:\Windows\system32\dfshim.dll
2010-10-29 19:48:10 ----D---- C:\Program Files\Microsoft Silverlight
2010-10-29 19:43:29 ----A---- C:\Windows\system32\browserchoice.exe
2010-10-29 19:41:41 ----A---- C:\Windows\system32\MRT.exe
2010-10-29 19:41:19 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-10-29 19:41:14 ----A---- C:\Windows\system32\drivers\usbvideo.sys
2010-10-29 19:41:14 ----A---- C:\Windows\system32\drivers\ks.sys
2010-10-29 19:40:40 ----A---- C:\Windows\system32\msasn1.dll
2010-10-29 19:40:40 ----A---- C:\Windows\system32\ir32_32.dll
2010-10-29 19:40:40 ----A---- C:\Windows\system32\iccvid.dll
2010-10-29 19:40:39 ----A---- C:\Windows\system32\asycfilt.dll
2010-10-29 19:40:37 ----A---- C:\Windows\system32\mshtml.dll
2010-10-29 19:40:35 ----A---- C:\Windows\system32\ieframe.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\mstime.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-29 19:40:34 ----A---- C:\Windows\system32\iertutil.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\wininet.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\urlmon.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\licmgr10.dll
2010-10-29 19:40:33 ----A---- C:\Windows\system32\iedkcs32.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\msfeedssync.exe
2010-10-29 19:40:32 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\jsproxy.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\ieui.dll
2010-10-29 19:40:32 ----A---- C:\Windows\system32\iepeers.dll
2010-10-29 19:40:21 ----A---- C:\Windows\system32\lsasrv.dll
2010-10-29 19:40:21 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-10-29 19:40:18 ----A---- C:\Windows\system32\tzres.dll
2010-10-29 19:40:02 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-10-29 19:40:01 ----A---- C:\Windows\system32\CertEnroll.dll
2010-10-29 19:40:00 ----A---- C:\Windows\system32\winresume.exe
2010-10-29 19:40:00 ----A---- C:\Windows\system32\winload.exe
2010-10-29 19:39:55 ----A---- C:\Windows\system32\CPFilters.dll
2010-10-29 19:39:54 ----A---- C:\Windows\system32\msdri.dll
2010-10-29 19:39:53 ----A---- C:\Windows\system32\psisdecd.dll
2010-10-29 19:39:48 ----A---- C:\Windows\system32\spoolsv.exe
2010-10-29 19:39:46 ----A---- C:\Windows\system32\winlogon.exe
2010-10-29 19:39:46 ----A---- C:\Windows\explorer.exe
2010-10-29 19:39:44 ----A---- C:\Windows\system32\ole32.dll
2010-10-29 19:39:42 ----A---- C:\Windows\system32\shell32.dll
2010-10-29 19:39:40 ----A---- C:\Windows\system32\inetcomm.dll
2010-10-29 19:39:39 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-10-29 19:39:38 ----A---- C:\Windows\system32\ntdll.dll
2010-10-29 19:39:37 ----A---- C:\Windows\system32\t2embed.dll
2010-10-29 19:39:36 ----A---- C:\Windows\system32\msxml3.dll
2010-10-29 19:39:36 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-10-29 19:39:35 ----A---- C:\Windows\system32\schannel.dll
2010-10-29 19:39:34 ----A---- C:\Windows\system32\rtutils.dll
2010-10-29 19:39:32 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-10-29 19:39:23 ----A---- C:\Windows\system32\mfc40u.dll
2010-10-29 19:39:23 ----A---- C:\Windows\system32\mfc40.dll
2010-10-29 19:39:20 ----A---- C:\Windows\system32\wmp.dll
2010-10-29 19:39:18 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-29 19:39:16 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-29 19:39:16 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-29 19:39:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-10-29 19:39:14 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-10-29 19:39:10 ----A---- C:\Windows\system32\tsbyuv.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\quartz.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msyuv.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msvidc32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\msrle32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\mciavi32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\iyuv_32.dll
2010-10-29 19:39:10 ----A---- C:\Windows\system32\avifil32.dll
2010-10-29 19:39:08 ----A---- C:\Windows\system32\kernel32.dll
2010-10-29 19:39:07 ----A---- C:\Windows\system32\apphelp.dll
2010-10-29 19:39:06 ----A---- C:\Windows\system32\jscript.dll
2010-10-29 19:39:04 ----A---- C:\Windows\system32\comctl32.dll
2010-10-29 19:39:03 ----A---- C:\Windows\system32\win32k.sys
2010-10-29 19:33:37 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-29 19:33:24 ----A---- C:\Windows\system32\secproc_isv.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\secproc.dll
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-10-29 19:33:23 ----A---- C:\Windows\system32\RMActivate.exe
2010-10-29 19:33:22 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-10-29 19:33:21 ----A---- C:\Windows\system32\vbscript.dll
2010-10-29 19:33:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-10-29 19:33:20 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-10-29 19:33:20 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-10-29 19:33:18 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-10-29 19:32:35 ----A---- C:\Windows\system32\fontsub.dll
2010-10-29 19:32:35 ----A---- C:\Windows\system32\atmfd.dll
2010-10-29 19:32:34 ----A---- C:\Windows\system32\atmlib.dll
2010-10-29 19:32:05 ----A---- C:\Windows\system32\wintrust.dll
2010-10-29 19:31:54 ----A---- C:\Windows\system32\cabview.dll
2010-10-29 19:09:48 ----D---- C:\Users\Romana\AppData\Roaming\Zoner
2010-10-29 19:08:24 ----D---- C:\Windows\Panther
2010-10-29 19:05:05 ----A---- C:\Windows\system32\drivers\sptd.sys
2010-10-29 19:04:57 ----D---- C:\Program Files\DAEMON Tools Lite
2010-10-29 19:04:04 ----D---- C:\Users\Romana\AppData\Roaming\DAEMON Tools Lite
2010-10-29 19:04:01 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-10-29 19:03:13 ----D---- C:\Users\Romana\AppData\Roaming\Win7codecs
2010-10-29 19:03:01 ----D---- C:\Program Files\Win7codecs
2010-10-29 19:02:44 ----D---- C:\ProgramData\Win7codecs
2010-10-29 18:59:03 ----D---- C:\Users\Romana\AppData\Roaming\Opera
2010-10-29 18:58:50 ----D---- C:\Program Files\Opera
2010-10-29 18:56:34 ----D---- C:\Program Files\Zoner
2010-10-29 18:55:22 ----D---- C:\Program Files\foxitreader
2010-10-29 18:54:57 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-29 18:53:13 ----D---- C:\Program Files\WinRAR
2010-10-29 18:52:44 ----D---- C:\Program Files\Microsoft Security Essentials
2010-10-29 18:47:01 ----D---- C:\ProgramData\OEM
2010-10-29 18:46:56 ----D---- C:\Program Files\Acer
2010-10-29 18:45:41 ----D---- C:\Program Files\Atheros
2010-10-29 18:45:41 ----A---- C:\Windows\system32\drivers\athr.sys
2010-10-29 18:45:20 ----D---- C:\ProgramData\Atheros
2010-10-29 18:45:19 ----D---- C:\Users\Romana\AppData\Roaming\InstallShield
2010-10-29 18:43:57 ----D---- C:\Windows\system32\Atheros_L1e
2010-10-29 18:43:02 ----D---- C:\Program Files\Synaptics
2010-10-29 18:42:07 ----HD---- C:\Program Files\InstallShield Installation Information
2010-10-29 18:42:04 ----A---- C:\Windows\system32\AmUStor.dll
2010-10-29 18:42:02 ----D---- C:\ProgramData\AmUStor
2010-10-29 18:42:02 ----D---- C:\Program Files\AmIcoSingLun
2010-10-29 18:38:33 ----D---- C:\Program Files\Bluetooth Suite
2010-10-29 18:36:35 ----D---- C:\Program Files\CONEXANT
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EEL32A.dll
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EEG32A.dll
2010-10-29 18:36:28 ----A---- C:\Windows\system32\EED32A.dll
2010-10-29 18:36:14 ----D---- C:\Users\Romana\AppData\Roaming\ATI
2010-10-29 18:36:14 ----D---- C:\ProgramData\ATI
2010-10-29 18:33:38 ----D---- C:\Program Files\DIFX
2010-10-29 18:33:35 ----DC---- C:\Windows\system32\DRVSTORE
2010-10-29 18:33:35 ----D---- C:\Program Files\AMD
2010-10-29 18:33:35 ----A---- C:\Windows\system32\drivers\usbfilter.sys
2010-10-29 18:31:27 ----SHD---- C:\Windows\Installer
2010-10-29 18:31:27 ----A---- C:\Windows\system32\drivers\AtiPcie.sys
2010-10-29 18:31:27 ----A---- C:\Windows\system32\drivers\AtiHdmi.sys
2010-10-29 18:31:27 ----A---- C:\Windows\system32\coinst.dll
2010-10-29 18:31:27 ----A---- C:\Windows\system32\atiuxpag.dll
2010-10-29 18:31:27 ----A---- C:\Windows\system32\atiumdva.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atipmdag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atikmpag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\drivers\atikmdag.sys
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiumdag.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiu9pag.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atitmmxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atipdlxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atioglxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atimuixx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atimpc32.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiglpxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atigktxx.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atiesrxx.exe
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atieclxx.exe
2010-10-29 18:31:26 ----A---- C:\Windows\system32\atidxx32.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\ATIDEMGX.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\aticalrt.dll
2010-10-29 18:31:26 ----A---- C:\Windows\system32\amdpcom32.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\drivers\ati2erec.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\aticaldd.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\aticalcl.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atibtmon.exe
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atiapfxx.exe
2010-10-29 18:31:25 ----A---- C:\Windows\system32\atiadlxx.dll
2010-10-29 18:31:25 ----A---- C:\Windows\system32\ati2edxx.dll
2010-10-29 18:31:12 ----D---- C:\Program Files\ATI Technologies
2010-10-29 18:31:09 ----D---- C:\Program Files\ATI
2010-10-29 18:28:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-29 18:24:47 ----D---- C:\Users\Romana\AppData\Roaming\Identities
2010-10-29 18:24:25 ----SD---- C:\Users\Romana\AppData\Roaming\Microsoft
2010-10-29 18:24:25 ----D---- C:\Users\Romana\AppData\Roaming\Media Center Programs
2010-10-29 18:22:42 ----SHD---- C:\Recovery
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Šablony
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Plocha
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Oblíbené položky
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Nabídka Start
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Dokumenty
2010-10-29 18:22:42 ----SHD---- C:\ProgramData\Data aplikací
2010-10-29 18:13:20 ----D---- C:\Windows\SoftwareDistribution
2010-10-29 18:10:25 ----D---- C:\Windows\Prefetch
2010-10-29 18:10:06 ----SHD---- C:\System Volume Information
2010-10-29 18:10:06 ----ASH---- C:\pagefile.sys
2010-10-29 18:10:06 ----ASH---- C:\hiberfil.sys
2010-10-29 17:02:56 ----A---- C:\Windows\system32\WdfCoInstaller01009.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\SynTPCo4.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\SynTPAPI.dll
2010-10-29 17:02:56 ----A---- C:\Windows\system32\drivers\SynTP.sys
2010-10-29 17:02:55 ----A---- C:\Windows\system32\SynCtrl.dll
2010-10-29 17:02:55 ----A---- C:\Windows\system32\SynCOM.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\UCI32A55.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\FMPropPageExt.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\FMAPO.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\drivers\CHDRT32.sys
2010-10-29 15:11:00 ----A---- C:\Windows\system32\CX32FP25.dll
2010-10-29 15:11:00 ----A---- C:\Windows\system32\CDolbyExt32.dll
2010-10-29 15:09:54 ----A---- C:\Windows\system32\drivers\L1C62x86.sys

======List of files/folders modified in the last 1 months======

2010-10-31 08:51:46 ----D---- C:\Windows\Temp
2010-10-31 08:33:57 ----RD---- C:\Program Files
2010-10-31 08:26:44 ----D---- C:\Windows\System32
2010-10-31 08:26:44 ----D---- C:\Windows\inf
2010-10-31 08:24:47 ----D---- C:\Windows\system32\Tasks
2010-10-31 08:24:43 ----D---- C:\Windows\Tasks
2010-10-31 08:21:34 ----D---- C:\Windows\system32\config
2010-10-31 08:10:22 ----RSD---- C:\Windows\assembly
2010-10-30 19:00:52 ----D---- C:\Windows\system32\drivers
2010-10-30 15:38:52 ----HD---- C:\ProgramData
2010-10-30 13:30:32 ----D---- C:\Windows\system32\wdi
2010-10-30 12:35:19 ----D---- C:\Windows\system32\drivers\UMDF
2010-10-30 12:35:18 ----D---- C:\Windows\system32\DriverStore
2010-10-30 12:35:18 ----D---- C:\Windows\system32\catroot
2010-10-30 12:33:12 ----D---- C:\Windows\system32\LogFiles
2010-10-30 12:32:00 ----D---- C:\Windows
2010-10-30 12:31:48 ----D---- C:\Windows\system32\catroot2
2010-10-30 12:20:42 ----D---- C:\Windows\system32\NDF
2010-10-30 09:11:00 ----SD---- C:\ProgramData\Microsoft
2010-10-30 08:49:54 ----D---- C:\Windows\winsxs
2010-10-30 08:49:49 ----D---- C:\Windows\Microsoft.NET
2010-10-30 08:35:09 ----RSD---- C:\Windows\Fonts
2010-10-30 08:34:57 ----D---- C:\Program Files\Common Files\microsoft shared
2010-10-30 08:32:37 ----D---- C:\Program Files\Common Files\System
2010-10-30 08:32:37 ----A---- C:\Windows\win.ini
2010-10-29 22:07:39 ----D---- C:\Windows\system32\cs-CZ
2010-10-29 21:59:10 ----D---- C:\Windows\system32\en-US
2010-10-29 21:42:11 ----D---- C:\Windows\ModemLogs
2010-10-29 21:24:00 ----D---- C:\Program Files\Common Files
2010-10-29 20:48:31 ----D---- C:\Windows\Registration
2010-10-29 20:29:28 ----D---- C:\Windows\ShellNew
2010-10-29 19:58:55 ----D---- C:\Windows\system32\migration
2010-10-29 19:58:55 ----D---- C:\Program Files\Internet Explorer
2010-10-29 19:58:53 ----D---- C:\Windows\ehome
2010-10-29 19:58:52 ----D---- C:\Windows\system32\Boot
2010-10-29 19:58:52 ----D---- C:\Program Files\Windows Mail
2010-10-29 19:58:51 ----D---- C:\Windows\AppPatch
2010-10-29 19:58:51 ----D---- C:\Program Files\Windows Media Player
2010-10-29 19:41:42 ----D---- C:\Windows\debug
2010-10-29 19:30:40 ----D---- C:\Windows\Logs
2010-10-29 19:07:57 ----D---- C:\Windows\Setup
2010-10-29 18:38:09 ----D---- C:\Windows\system32\restore
2010-10-29 18:34:01 ----D---- C:\Windows\system32\CodeIntegrity
2010-10-29 18:28:04 ----D---- C:\Windows\system32\wbem
2010-10-29 18:24:44 ----SHD---- C:\$Recycle.Bin
2010-10-29 18:24:25 ----RD---- C:\Users
2010-10-29 18:22:42 ----D---- C:\Program Files\Windows NT
2010-10-29 18:13:21 ----D---- C:\Windows\system32\sysprep
2010-10-29 18:11:01 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-23 14392]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-29 691696]
R0 symsnap;Symantec Volume Snap Shot Driver; C:\Windows\system32\DRIVERS\symsnap.sys [2009-09-21 138592]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-03-18 5341696]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2010-03-31 1792512]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 100352]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2010-03-31 517688]
R3 GEARAspiWDM;GearAspiWDM; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 GenericMount;Generic Mount Driver; C:\Windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-02-26 242992]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
S3 aqy4sf98;aqy4sf98; C:\Windows\system32\drivers\aqy4sf98.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2010-03-30 47144]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 VProEventMonitor;Symantec Event Monitor Driver; C:\Windows\system32\DRIVERS\vproeventmonitor.sys [2009-09-21 15096]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2009-10-01 131000]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-17 172032]
R2 AtherosSvc;AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
R2 Norton Ghost;Norton Ghost; C:\Program Files\Norton Ghost\Agent\VProSvc.exe [2009-10-01 4584288]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 SymSnapService;SymSnapService; C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 GenericMount Helper Service;GenericMount Helper Service; C:\Program Files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [2009-07-14 7168]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 09:47
od vyosek
Zdravim a pekny den preji :)

:arrow: Havet tam je a ne jedna :arcisit:

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 10:59
od ghostik
ComboFix 10-10-30.04 - Romana 31.10.2010 10:02:54.1.1 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.766.239 [GMT 1:00]
Spuštěný z: c:\users\Romana\Desktop\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Romana\AppData\Local\Temp\sshnas21.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-31 07:33 . 2010-10-31 08:01 -------- d-----w- c:\program files\trend micro
2010-10-31 07:33 . 2010-10-31 07:34 -------- d-----w- C:\rsit
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49DE2646-F771-48AC-A591-872F65EC5CBE}\mpengine.dll
2010-10-30 14:38 . 2010-10-30 14:38 -------- d-----w- c:\programdata\Nokia
2010-10-30 11:32 . 2010-10-30 11:33 -------- d-----w- c:\windows\WindowsMobile
2010-10-30 08:18 . 2010-10-30 08:18 -------- d-----w- C:\Symantec
2010-10-30 08:14 . 2010-10-30 08:14 -------- d-----w- c:\program files\Your Uninstaller 2010
2010-10-30 07:36 . 2010-10-30 07:36 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-10-30 07:29 . 2010-10-30 07:29 -------- d-----w- c:\program files\MSXML 4.0
2010-10-29 21:44 . 2010-10-29 21:44 -------- d-----w- c:\program files\Ask.com
2010-10-29 21:42 . 2010-10-29 21:44 -------- d-----w- c:\program files\The KMPlayer
2010-10-29 21:27 . 2010-10-29 21:34 -------- d-----w- C:\TRANSLAT
2010-10-29 21:27 . 2010-10-29 21:33 -------- d-----w- c:\programdata\LangSoft
2010-10-29 20:27 . 2010-10-29 20:52 -------- d-----w- c:\programdata\PC Suite
2010-10-29 20:24 . 2010-10-29 20:24 -------- d-----w- c:\program files\Common Files\Nokia
2010-10-29 20:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-10-29 20:22 . 2010-10-29 20:22 -------- d-----w- c:\program files\PC Connectivity Solution
2010-10-29 20:21 . 2010-02-26 12:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-10-29 20:19 . 2010-10-29 20:23 -------- d-----w- c:\program files\Nokia
2010-10-29 19:47 . 2010-10-29 19:47 -------- d-----w- c:\program files\Symantec
2010-10-29 19:47 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-10-29 19:47 . 2009-10-01 20:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys
2010-10-29 19:46 . 2009-09-21 18:20 138592 ----a-w- c:\windows\system32\drivers\symsnap.sys
2010-10-29 19:45 . 2009-09-21 18:40 15096 ----a-w- c:\windows\system32\drivers\vproeventmonitor.sys
2010-10-29 19:45 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 19:45 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-10-29 19:43 . 2010-10-29 19:47 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-29 19:42 . 2010-10-30 17:33 -------- d-----w- c:\programdata\Symantec
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\program files\Norton Ghost
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 19:34 . 2010-10-30 07:34 -------- d-----w- c:\program files\Microsoft Works
2010-10-29 19:32 . 2010-10-29 20:58 -------- d-----w- c:\program files\Microsoft.NET
2010-10-29 19:32 . 2010-10-29 19:32 -------- d-----w- c:\windows\PCHEALTH
2010-10-29 19:27 . 2010-10-31 07:15 -------- d-----w- c:\programdata\Microsoft Help
2010-10-29 19:27 . 2010-10-29 19:27 -------- d-----r- C:\MSOCache
2010-10-29 19:24 . 2004-08-09 22:42 77824 ------w- c:\windows\system32\brlmw03a.dll
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brownie
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brother
2010-10-29 19:24 . 2007-08-19 16:34 94208 ----a-w- c:\windows\system32\BRRBTOOL.EXE
2010-10-29 19:24 . 2007-04-23 23:30 192512 ------w- c:\windows\system32\Pdrvinst.dll
2010-10-29 19:24 . 2006-12-21 02:23 176128 ----a-w- c:\windows\system32\BROSNMP.DLL
2010-10-29 19:24 . 2006-08-04 15:43 73728 ------w- c:\windows\system32\BRWEBUP.EXE
2010-10-29 19:24 . 2006-08-03 11:14 90112 ------w- c:\windows\system32\BrWebIns.dll
2010-10-29 19:24 . 2004-09-23 15:00 24223 ----a-w- c:\windows\system32\BRLM03A.DLL
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\program files\Common Files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----r- c:\program files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\programdata\Skype
2010-10-29 19:15 . 2010-10-29 19:15 -------- d-----w- c:\windows\system32\Macromed
2010-10-29 18:53 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-10-29 18:50 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-10-29 18:50 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-10-29 18:50 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-10-29 18:50 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-10-29 18:50 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-10-29 18:48 . 2010-10-29 18:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-29 18:43 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-10-29 18:41 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-10-29 18:41 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-10-29 18:41 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-10-29 18:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-29 18:33 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-29 18:32 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-10-29 18:32 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-10-29 18:32 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-29 18:32 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-10-29 18:31 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-10-29 18:08 . 2010-10-29 17:23 -------- d-----w- c:\windows\Panther
2010-10-29 18:05 . 2010-10-29 18:05 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-29 18:04 . 2010-10-29 18:05 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-10-29 18:04 . 2010-10-29 18:04 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-10-29 18:03 . 2010-10-29 18:03 -------- d-----w- c:\program files\Win7codecs
2010-10-29 18:02 . 2010-10-29 18:03 -------- d-----w- c:\programdata\Win7codecs
2010-10-29 17:58 . 2010-10-29 17:58 -------- d-----w- c:\program files\Opera
2010-10-29 17:56 . 2010-10-29 17:56 -------- d-----w- c:\program files\Zoner
2010-10-29 17:55 . 2010-10-29 17:55 -------- d-----w- c:\program files\foxitreader
2010-10-29 17:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-29 17:52 . 2010-10-29 18:52 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-29 17:47 . 2010-10-29 17:47 -------- d-----w- c:\programdata\OEM
2010-10-29 17:46 . 2010-10-29 17:46 -------- d-----w- c:\program files\Acer
2010-10-29 17:45 . 2010-10-29 17:45 -------- d-----w- c:\program files\Atheros
2010-10-29 17:45 . 2010-03-31 16:51 1792512 ----a-w- c:\windows\system32\drivers\athr.sys
2010-10-29 17:45 . 2010-10-29 20:39 -------- d-----w- c:\programdata\Atheros
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\windows\system32\Atheros_L1e
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\program files\Synaptics
2010-10-29 17:42 . 2010-10-29 19:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-29 17:42 . 2009-05-05 12:08 9216 ----a-w- c:\windows\system32\AmUStor.dll
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\programdata\AmUStor
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\program files\AmIcoSingLun
2010-10-29 17:38 . 2010-10-29 17:38 -------- d-----w- c:\program files\Bluetooth Suite
2010-10-29 17:36 . 2010-04-04 22:03 1048 ------w- c:\windows\system32\drivers\SamSfPa.dat
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\program files\CONEXANT
2010-10-29 17:36 . 2009-12-16 08:26 76488 ----a-w- c:\windows\system32\EEL32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 62664 ----a-w- c:\windows\system32\EEG32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 168648 ----a-w- c:\windows\system32\EED32A.dll
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\programdata\ATI
2010-10-29 17:34 . 2010-10-29 17:34 0 ----a-w- c:\windows\ativpsrm.bin
2010-10-29 17:33 . 2010-10-29 20:23 -------- d-----w- c:\program files\DIFX
2010-10-29 17:33 . 2010-10-29 20:23 -------- dc----w- c:\windows\system32\DRVSTORE
2010-10-29 17:33 . 2010-10-29 17:33 -------- d-----w- c:\program files\AMD
2010-10-29 17:33 . 2009-12-22 00:26 30392 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2010-10-29 17:28 . 2010-10-31 08:56 -------- d-----w- c:\windows\system32\wbem\Performance
2010-10-29 17:24 . 2010-10-29 17:24 -------- d-----w- c:\users\Romana
2010-10-29 16:02 . 2010-02-26 08:33 242992 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-10-29 16:02 . 2010-02-26 08:31 165160 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-10-29 16:02 . 2010-02-26 08:31 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-10-29 16:02 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2010-10-29 16:02 . 2010-02-26 08:31 210216 ----a-w- c:\windows\system32\SynCtrl.dll
2010-10-29 16:02 . 2010-02-26 08:31 173352 ----a-w- c:\windows\system32\SynCOM.dll
2010-10-29 14:11 . 2010-03-31 12:49 517688 ----a-w- c:\windows\system32\drivers\CHDRT32.sys
2010-10-29 14:11 . 2010-03-30 08:57 1737272 ----a-w- c:\windows\system32\CX32FP25.dll
2010-10-29 14:11 . 2010-03-30 08:45 301624 ----a-w- c:\windows\system32\UCI32A55.dll
2010-10-29 14:11 . 2010-03-16 10:43 303008 ----a-w- c:\windows\system32\FMAPO.dll
2010-10-29 14:11 . 2010-03-15 08:56 76344 ----a-w- c:\windows\system32\FMPropPageExt.dll
2010-10-29 14:11 . 2010-01-20 11:48 428088 ----a-w- c:\windows\system32\CDolbyExt32.dll
2010-10-29 14:09 . 2010-04-21 13:47 68208 ----a-w- c:\windows\system32\drivers\L1C62x86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-29 17:39 . 2010-04-01 05:36 246804 ----a-w- c:\windows\system32\drivers\AtherosBt.bin
2010-08-21 05:36 . 2010-10-29 18:39 224256 ----a-w- c:\windows\system32\schannel.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-17 98304]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2010-03-04 496184]
"AtherosBtStack"="c:\program files\Bluetooth Suite\BtvStack.exe" [2010-04-01 445528]
"AthBtTray"="c:\program files\Bluetooth Suite\AthBtTray.exe" [2010-04-01 285784]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2010-02-05 233472]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-04-23 715296]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-18 880640]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-09-02 08:26 672632 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
2009-10-01 19:32 2596712 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [2010-03-30 47144]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
R3 GenericMount Helper Service;GenericMount Helper Service;c:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2009-07-14 7168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-29 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-17 172032]
S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-17 5341696]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
S3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-U36VRSFLG6 - c:\users\Romana\AppData\Local\Temp\Zpx.exe
AddRemove-PC Translator - c:\users\Romana\AppData\Local\Temp\UN32.EXE


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3364)
c:\program files\Bluetooth Suite\AthCopyHook.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\atieclxx.exe
c:\program files\Norton Ghost\Agent\VProSvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Brownie\Brnipmon.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-10-31 10:54:59 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-31 09:54

Před spuštěním: Volných bajtů: 89 641 361 408
Po spuštění: Volných bajtů: 89 799 680 000

- - End Of File - - F388C8736DD760B95A57C7877FEAA86B

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 11:12
od vyosek
:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 11:49
od ghostik
ComboFix 10-10-30.04 - Romana 31.10.2010 11:19:38.2.1 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.766.248 [GMT 1:00]
Spuštěný z: c:\users\Romana\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Romana\Desktop\CFScript.txt
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-31 10:42 . 2010-10-31 10:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-31 07:33 . 2010-10-31 08:01 -------- d-----w- c:\program files\trend micro
2010-10-31 07:33 . 2010-10-31 07:34 -------- d-----w- C:\rsit
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-10-30 17:58 . 2010-10-07 14:21 6146896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49DE2646-F771-48AC-A591-872F65EC5CBE}\mpengine.dll
2010-10-30 14:38 . 2010-10-30 14:38 -------- d-----w- c:\programdata\Nokia
2010-10-30 11:32 . 2010-10-30 11:33 -------- d-----w- c:\windows\WindowsMobile
2010-10-30 08:18 . 2010-10-30 08:18 -------- d-----w- C:\Symantec
2010-10-30 08:14 . 2010-10-30 08:14 -------- d-----w- c:\program files\Your Uninstaller 2010
2010-10-30 07:36 . 2010-10-30 07:36 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-10-30 07:29 . 2010-10-30 07:29 -------- d-----w- c:\program files\MSXML 4.0
2010-10-29 21:42 . 2010-10-29 21:44 -------- d-----w- c:\program files\The KMPlayer
2010-10-29 21:27 . 2010-10-29 21:34 -------- d-----w- C:\TRANSLAT
2010-10-29 21:27 . 2010-10-29 21:33 -------- d-----w- c:\programdata\LangSoft
2010-10-29 20:27 . 2010-10-29 20:52 -------- d-----w- c:\programdata\PC Suite
2010-10-29 20:24 . 2010-10-29 20:24 -------- d-----w- c:\program files\Common Files\Nokia
2010-10-29 20:23 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-10-29 20:22 . 2010-10-29 20:22 -------- d-----w- c:\program files\PC Connectivity Solution
2010-10-29 20:21 . 2010-02-26 12:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-10-29 20:19 . 2010-10-29 20:23 -------- d-----w- c:\program files\Nokia
2010-10-29 19:47 . 2010-10-29 19:47 -------- d-----w- c:\program files\Symantec
2010-10-29 19:47 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-10-29 19:47 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-10-29 19:47 . 2009-10-01 20:03 131000 ----a-w- c:\windows\system32\drivers\WimFltr.sys
2010-10-29 19:46 . 2009-09-21 18:20 138592 ----a-w- c:\windows\system32\drivers\symsnap.sys
2010-10-29 19:45 . 2009-09-21 18:40 15096 ----a-w- c:\windows\system32\drivers\vproeventmonitor.sys
2010-10-29 19:45 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-29 19:45 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-10-29 19:43 . 2010-10-29 19:47 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-29 19:42 . 2010-10-30 17:33 -------- d-----w- c:\programdata\Symantec
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\program files\Norton Ghost
2010-10-29 19:42 . 2010-10-29 19:43 -------- d-----w- c:\programdata\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}
2010-10-29 19:34 . 2010-10-30 07:34 -------- d-----w- c:\program files\Microsoft Works
2010-10-29 19:32 . 2010-10-29 20:58 -------- d-----w- c:\program files\Microsoft.NET
2010-10-29 19:32 . 2010-10-29 19:32 -------- d-----w- c:\windows\PCHEALTH
2010-10-29 19:27 . 2010-10-31 07:15 -------- d-----w- c:\programdata\Microsoft Help
2010-10-29 19:27 . 2010-10-29 19:27 -------- d-----r- C:\MSOCache
2010-10-29 19:24 . 2004-08-09 22:42 77824 ------w- c:\windows\system32\brlmw03a.dll
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brownie
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Brother
2010-10-29 19:24 . 2007-08-19 16:34 94208 ----a-w- c:\windows\system32\BRRBTOOL.EXE
2010-10-29 19:24 . 2007-04-23 23:30 192512 ------w- c:\windows\system32\Pdrvinst.dll
2010-10-29 19:24 . 2006-12-21 02:23 176128 ----a-w- c:\windows\system32\BROSNMP.DLL
2010-10-29 19:24 . 2006-08-04 15:43 73728 ------w- c:\windows\system32\BRWEBUP.EXE
2010-10-29 19:24 . 2006-08-03 11:14 90112 ------w- c:\windows\system32\BrWebIns.dll
2010-10-29 19:24 . 2004-09-23 15:00 24223 ----a-w- c:\windows\system32\BRLM03A.DLL
2010-10-29 19:24 . 2010-10-29 19:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\program files\Common Files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----r- c:\program files\Skype
2010-10-29 19:16 . 2010-10-29 19:16 -------- d-----w- c:\programdata\Skype
2010-10-29 19:15 . 2010-10-29 19:15 -------- d-----w- c:\windows\system32\Macromed
2010-10-29 18:53 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-10-29 18:50 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-10-29 18:50 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-10-29 18:50 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-10-29 18:50 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-10-29 18:50 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-10-29 18:48 . 2010-10-29 18:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-29 18:43 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-10-29 18:41 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-10-29 18:41 . 2010-03-04 04:04 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-10-29 18:41 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-10-29 18:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-29 18:33 . 2010-08-21 05:36 738816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-29 18:32 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-10-29 18:32 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-10-29 18:32 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-29 18:32 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-10-29 18:31 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-10-29 18:08 . 2010-10-29 17:23 -------- d-----w- c:\windows\Panther
2010-10-29 18:05 . 2010-10-29 18:05 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-29 18:04 . 2010-10-29 18:05 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-10-29 18:04 . 2010-10-29 18:04 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-10-29 18:03 . 2010-10-29 18:03 -------- d-----w- c:\program files\Win7codecs
2010-10-29 18:02 . 2010-10-29 18:03 -------- d-----w- c:\programdata\Win7codecs
2010-10-29 17:58 . 2010-10-29 17:58 -------- d-----w- c:\program files\Opera
2010-10-29 17:56 . 2010-10-29 17:56 -------- d-----w- c:\program files\Zoner
2010-10-29 17:55 . 2010-10-29 17:55 -------- d-----w- c:\program files\foxitreader
2010-10-29 17:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-29 17:52 . 2010-10-29 18:52 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-29 17:47 . 2010-10-29 17:47 -------- d-----w- c:\programdata\OEM
2010-10-29 17:46 . 2010-10-29 17:46 -------- d-----w- c:\program files\Acer
2010-10-29 17:45 . 2010-10-29 17:45 -------- d-----w- c:\program files\Atheros
2010-10-29 17:45 . 2010-03-31 16:51 1792512 ----a-w- c:\windows\system32\drivers\athr.sys
2010-10-29 17:45 . 2010-10-29 20:39 -------- d-----w- c:\programdata\Atheros
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\windows\system32\Atheros_L1e
2010-10-29 17:43 . 2010-10-29 17:43 -------- d-----w- c:\program files\Synaptics
2010-10-29 17:42 . 2010-10-29 19:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-10-29 17:42 . 2009-05-05 12:08 9216 ----a-w- c:\windows\system32\AmUStor.dll
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\programdata\AmUStor
2010-10-29 17:42 . 2010-10-29 17:42 -------- d-----w- c:\program files\AmIcoSingLun
2010-10-29 17:38 . 2010-10-29 17:38 -------- d-----w- c:\program files\Bluetooth Suite
2010-10-29 17:36 . 2010-04-04 22:03 1048 ------w- c:\windows\system32\drivers\SamSfPa.dat
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\program files\CONEXANT
2010-10-29 17:36 . 2009-12-16 08:26 76488 ----a-w- c:\windows\system32\EEL32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 62664 ----a-w- c:\windows\system32\EEG32A.dll
2010-10-29 17:36 . 2009-12-16 08:26 168648 ----a-w- c:\windows\system32\EED32A.dll
2010-10-29 17:36 . 2010-10-29 17:36 -------- d-----w- c:\programdata\ATI
2010-10-29 17:34 . 2010-10-29 17:34 0 ----a-w- c:\windows\ativpsrm.bin
2010-10-29 17:33 . 2010-10-29 20:23 -------- d-----w- c:\program files\DIFX
2010-10-29 17:33 . 2010-10-29 20:23 -------- dc----w- c:\windows\system32\DRVSTORE
2010-10-29 17:33 . 2010-10-29 17:33 -------- d-----w- c:\program files\AMD
2010-10-29 17:33 . 2009-12-22 00:26 30392 ----a-w- c:\windows\system32\drivers\usbfilter.sys
2010-10-29 17:28 . 2010-10-31 09:55 -------- d-----w- c:\windows\system32\wbem\Performance
2010-10-29 17:24 . 2010-10-29 17:24 -------- d-----w- c:\users\Romana
2010-10-29 16:02 . 2010-02-26 08:33 242992 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-10-29 16:02 . 2010-02-26 08:31 165160 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-10-29 16:02 . 2010-02-26 08:31 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-10-29 16:02 . 2009-08-07 08:49 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2010-10-29 16:02 . 2010-02-26 08:31 210216 ----a-w- c:\windows\system32\SynCtrl.dll
2010-10-29 16:02 . 2010-02-26 08:31 173352 ----a-w- c:\windows\system32\SynCOM.dll
2010-10-29 14:11 . 2010-03-31 12:49 517688 ----a-w- c:\windows\system32\drivers\CHDRT32.sys
2010-10-29 14:11 . 2010-03-30 08:57 1737272 ----a-w- c:\windows\system32\CX32FP25.dll
2010-10-29 14:11 . 2010-03-30 08:45 301624 ----a-w- c:\windows\system32\UCI32A55.dll
2010-10-29 14:11 . 2010-03-16 10:43 303008 ----a-w- c:\windows\system32\FMAPO.dll
2010-10-29 14:11 . 2010-03-15 08:56 76344 ----a-w- c:\windows\system32\FMPropPageExt.dll
2010-10-29 14:11 . 2010-01-20 11:48 428088 ----a-w- c:\windows\system32\CDolbyExt32.dll
2010-10-29 14:09 . 2010-04-21 13:47 68208 ----a-w- c:\windows\system32\drivers\L1C62x86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-29 17:39 . 2010-04-01 05:36 246804 ----a-w- c:\windows\system32\drivers\AtherosBt.bin
2010-08-21 05:36 . 2010-10-29 18:39 224256 ----a-w- c:\windows\system32\schannel.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-17 98304]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2010-03-04 496184]
"AtherosBtStack"="c:\program files\Bluetooth Suite\BtvStack.exe" [2010-04-01 445528]
"AthBtTray"="c:\program files\Bluetooth Suite\AthBtTray.exe" [2010-04-01 285784]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2010-02-05 233472]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-04-23 715296]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-18 880640]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 15.0]
2009-10-01 19:32 2596712 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 25600]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-03-30 38440]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [2010-03-30 47144]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-03-30 257064]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-03-30 177704]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-03-30 48168]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-03-30 141992]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-03-30 230952]
R3 GenericMount Helper Service;GenericMount Helper Service;c:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2009-09-21 1571336]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2009-07-14 7168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-29 691696]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-17 172032]
S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2010-04-01 27224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-04-23 735776]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-17 5341696]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-17 152064]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-03-30 28200]
S3 GenericMount;Generic Mount Driver;c:\windows\system32\DRIVERS\GenericMount.sys [2009-09-21 46192]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-04-21 68208]
S3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2009-09-21 1964528]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\programdata\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\programdata\LangSoft\WebIE.dll
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-10-31 11:46:32
ComboFix-quarantined-files.txt 2010-10-31 10:46
ComboFix2.txt 2010-10-31 09:55

Před spuštěním: Volných bajtů: 89 851 514 880
Po spuštění: Volných bajtů: 89 803 321 344

- - End Of File - - 55C98BAC757BCF13A54B8E1C42F9EFF9

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 12:01
od vyosek
Jak se chova PC :???:

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 12:26
od ghostik
Děkuji za optání, daří se mu skvěle. CPU už není tak zatížen, procesy jsou čisté, složka Temp je o 90% prázdnější. Good work. Thx. Mohu ještě tady přihodit další log? Každý člen domácnosti má jedno PC. Děti na tom budou asi nejhůř. Po vyčištění udělám komplet zálohu HDD a když bude problém jen to překopčím.

Re: Spoštění zp1, zp2.exe atd.

Napsal: 31 říj 2010 12:37
od vyosek
:arrow: Na dalsi PC zalozte nove tema a do predmetu dejte "pro vyosek - PC2" - kolegove mi to nechaji, tady by se nam to motalo

Zde jeste uklidime :wink:
:arrow: Odinstalujte Combofix
  • Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
  • Napiste ComboFix /Uninstall
  • Stisknete Enter
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za 14 dni

:arrow: A myslim ze ho muzem prohlasit za cisty :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz