Aplikace Skype-není to kecálek

[Kotrmelec]

Zdravím, nevěděl jsem kde jidne se zeptat, ale mám problém jak na pc tak na ntb, že po spuštění se mi ve správci zařízení zobrazí aplikace skype (není to ten kecálek se zelenou ikonkou telefonu) .. nezdá se mi, že by mohla něco dělat, ale docela mě to znervózňuje, když vím, že jsem nic takovýho neinstaloval a pokaždý se to jakoby zapne po restart/zapnutí .. po ukončení ve správci zařízení zmizne a už se neukáže(do dalšího spuštění/restartu .. nevím jestli je potřeba nějaký výpis z logu(třeba s tím už někdo měl zkušenosti) .. popř. ho přiložím ..
Díky moc za pomoc

[Rudy]

Sice neznám jiný Skype, než ten "kecálek", nicméně dejte log z RSIT: http://viry.cz/forum/viewtopic.php?f=24&t=81939 .

[Kotrmelec]

Logfile of random's system information tool 1.08 (written by random/random)
Run by not at 2010-11-22 22:09:03
Microsoft Windows 7 Ultimate
System drive C: has 166 GB (70%) free of 238 GB
Total RAM: 2048 MB (34% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:09:05, on 22.11.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\not\Desktop\RSIT.exe
C:\Program Files\trend micro\not.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [User.exe] C:\Users\not\Documents\user.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 4321 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET Smart Security\egui.exe [2009-02-06 2021400]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-24 203928]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"User.exe"=C:\Users\not\Documents\user.exe [2010-07-05 18944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-22 22:07:54 ----D---- C:\Program Files\trend micro
2010-11-22 22:07:53 ----D---- C:\rsit
2010-11-15 23:21:05 ----D---- C:\Users\not\AppData\Roaming\Ventrilo
2010-11-15 23:20:20 ----D---- C:\Program Files\Ventrilo
2010-11-15 23:19:35 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-11-14 19:48:39 ----D---- C:\Users\not\AppData\Roaming\Tunngle
2010-11-14 19:48:39 ----D---- C:\ProgramData\Tunngle
2010-11-14 19:48:35 ----A---- C:\Windows\system32\drivers\tap0901t.sys
2010-11-11 17:34:49 ----D---- C:\temp
2010-11-11 17:32:26 ----D---- C:\Program Files\Microsoft.NET
2010-11-11 12:52:33 ----D---- C:\ProgramData\Blizzard Entertainment
2010-11-11 12:10:11 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-11-11 11:00:21 ----D---- C:\ProgramData\Blizzard
2010-11-11 10:40:19 ----A---- C:\Windows\system32\ole32.dll
2010-11-11 10:40:13 ----A---- C:\Windows\system32\iertutil.dll
2010-11-11 10:40:11 ----A---- C:\Windows\system32\mshtml.dll
2010-11-11 10:40:09 ----A---- C:\Windows\system32\ieframe.dll
2010-11-11 10:40:08 ----A---- C:\Windows\system32\urlmon.dll
2010-11-11 10:40:08 ----A---- C:\Windows\system32\msfeeds.dll
2010-11-11 10:40:08 ----A---- C:\Windows\system32\licmgr10.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\wininet.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\mstime.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\mshtmled.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\msfeedssync.exe
2010-11-11 10:40:07 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\jsproxy.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\ieui.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\iepeers.dll
2010-11-11 10:40:07 ----A---- C:\Windows\system32\iedkcs32.dll
2010-11-11 10:40:06 ----A---- C:\Windows\system32\t2embed.dll
2010-11-11 10:40:00 ----A---- C:\Windows\system32\msdri.dll
2010-11-11 10:39:59 ----A---- C:\Windows\system32\CPFilters.dll
2010-11-11 10:39:52 ----A---- C:\Windows\system32\schannel.dll
2010-11-11 10:39:50 ----A---- C:\Windows\system32\comctl32.dll
2010-11-11 10:39:48 ----A---- C:\Windows\system32\mfc40u.dll
2010-11-11 10:39:48 ----A---- C:\Windows\system32\mfc40.dll
2010-11-11 10:39:38 ----A---- C:\Windows\system32\wmp.dll
2010-11-11 10:39:37 ----A---- C:\Windows\system32\wmploc.DLL
2010-11-11 10:39:34 ----A---- C:\Windows\system32\win32k.sys
2010-11-11 10:39:34 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-11-11 10:39:32 ----A---- C:\Windows\system32\srvsvc.dll
2010-11-11 10:39:32 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-11-11 10:39:32 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-11-11 10:39:32 ----A---- C:\Windows\system32\drivers\srv.sys
2010-11-11 10:39:31 ----A---- C:\Windows\system32\wmpmde.dll
2010-11-11 10:38:16 ----A---- C:\Windows\system32\StructuredQuery.dll

======List of files/folders modified in the last 1 months======

2010-11-22 22:09:04 ----D---- C:\Windows\Temp
2010-11-22 22:08:56 ----D---- C:\Windows\Prefetch
2010-11-22 22:07:54 ----RD---- C:\Program Files
2010-11-22 16:29:02 ----D---- C:\Windows\system32\config
2010-11-21 16:21:21 ----D---- C:\Windows\System32
2010-11-21 16:21:21 ----D---- C:\Windows\inf
2010-11-21 16:21:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-19 12:34:53 ----SHD---- C:\System Volume Information
2010-11-18 23:26:26 ----SHD---- C:\Windows\Installer
2010-11-18 23:26:17 ----D---- C:\Program Files\Opera
2010-11-15 23:22:16 ----SD---- C:\Users\not\AppData\Roaming\Microsoft
2010-11-15 23:19:35 ----D---- C:\Program Files\Common Files
2010-11-15 23:06:23 ----RSD---- C:\Windows\Fonts
2010-11-14 20:42:38 ----D---- C:\Games
2010-11-14 19:49:09 ----D---- C:\Windows\system32\drivers
2010-11-14 19:49:07 ----D---- C:\Windows\system32\catroot
2010-11-14 19:49:04 ----D---- C:\Windows\system32\DriverStore
2010-11-14 19:48:39 ----HD---- C:\ProgramData
2010-11-14 16:08:03 ----D---- C:\Windows\Microsoft.NET
2010-11-14 16:07:23 ----RSD---- C:\Windows\assembly
2010-11-14 15:52:49 ----D---- C:\Windows\winsxs
2010-11-13 03:02:52 ----D---- C:\Program Files\Internet Explorer
2010-11-13 03:02:51 ----D---- C:\Windows\system32\migration
2010-11-13 03:02:50 ----D---- C:\Windows\ehome
2010-11-11 21:17:46 ----D---- C:\Windows\rescache
2010-11-11 19:44:32 ----D---- C:\Windows\AppPatch
2010-11-11 19:44:30 ----D---- C:\Program Files\Windows Media Player
2010-11-11 17:32:28 ----D---- C:\Windows\system32\en-US
2010-11-11 10:47:25 ----D---- C:\Download
2010-11-11 10:39:28 ----D---- C:\Windows\system32\catroot2
2010-11-02 16:47:16 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 giveio;giveio; C:\Windows\system32\giveio.sys [1996-04-03 5248]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 speedfan;speedfan; C:\Windows\system32\speedfan.sys [2006-09-24 5248]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-11-17 721904]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-09-30 4450816]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
S3 a5cnfe4b;a5cnfe4b; C:\Windows\system32\drivers\a5cnfe4b.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 ajxnoqci;ajxnoqci; C:\Windows\system32\drivers\ajxnoqci.sys []
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-05-25 26736]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-09-30 733184]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET Smart Security\ekrn.exe [2009-02-06 727720]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET Smart Security\EHttpSrv.exe [2009-02-06 20680]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-22 654848]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-25 1343400]

-----------------EOF-----------------

[Rudy]

Šmejda tam máte. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Kotrmelec]

Je normální aby mě po dokončení logu z combofixu nešlo nic spustit? Po restartu pc už v pohodě .. (ale Skype program je stále funkční)


ComboFix 10-11-22.02 - not 22.11.2010 22:20:02.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.2048.1274 [GMT 1:00]
Spuštěný z: c:\users\not\Desktop\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
PEV Error: ProfilesFile

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-22 do 2010-11-22 )))))))))))))))))))))))))))))))
.

2010-11-22 21:24 . 2010-11-22 21:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-11-22 21:07 . 2010-11-22 21:09 -------- d-----w- c:\program files\trend micro
2010-11-22 21:07 . 2010-11-22 21:08 -------- d-----w- C:\rsit
2010-11-19 11:35 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DBD53F73-67C7-4182-9DEA-DFF6A35A611C}\mpengine.dll
2010-11-15 22:21 . 2010-11-15 22:22 -------- d-----w- c:\users\not\AppData\Roaming\Ventrilo
2010-11-15 22:20 . 2010-11-15 22:20 -------- d-----w- c:\program files\Ventrilo
2010-11-15 22:19 . 2010-11-15 22:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-11-14 18:48 . 2010-11-14 20:35 -------- d-----w- c:\users\not\AppData\Roaming\Tunngle
2010-11-14 18:48 . 2010-11-14 20:31 -------- d-----w- c:\programdata\Tunngle
2010-11-14 18:48 . 2009-09-16 07:02 27136 ----a-w- c:\windows\system32\drivers\tap0901t.sys
2010-11-11 18:53 . 2010-11-11 18:53 -------- d-----w- c:\users\not\AppData\Local\ElevatedDiagnostics
2010-11-11 16:34 . 2010-11-11 16:34 -------- d-----w- C:\temp
2010-11-11 16:32 . 2010-11-11 16:32 -------- d-----w- c:\program files\Microsoft.NET
2010-11-11 11:52 . 2010-11-11 12:05 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-11-11 11:10 . 2010-11-11 11:40 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-11-11 10:00 . 2010-11-11 10:00 -------- d-----w- c:\programdata\Blizzard
2010-11-11 09:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-11-11 09:38 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-18 11:56 222080 ------w- c:\windows\system32\MpSigStub.exe
.

------- Sigcheck -------

[-] 2010-07-15 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"User.exe"="c:\users\not\Documents\user.exe" [2010-07-05 18944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET Smart Security\egui.exe" [2009-02-06 2021400]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-05-24 26736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-25 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-17 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S2 ekrn;ESET Service;c:\program files\ESET Smart Security\ekrn.exe [2009-02-06 727720]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]

.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\gamelsp.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-11-22 22:26:07
ComboFix-quarantined-files.txt 2010-11-22 21:26

Před spuštěním: 174 139 768 832 bytes free
Po spuštění: 174 145 425 408 bytes free

- - End Of File - - AEA11285789F1C4E3810B7BAA24D37C4

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\users\not\Documents\user.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"User.exe"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[Kotrmelec]

Díky moc "Skype" zmiznul .. Doufám, že už bude vše v pořádku a jestli to stejné můžu udělat i na ntb nebo mám raději postnout log z ntb zvlášť ? A ještě bych se chtěl zeptat co ten "program" dělal, protože jsem teď zpozoroval i že se mi fotí plocha a ukládá se do dokumentů (1soubor s názvem pc myslím nebo uživatele a zdálo se mi jakoby se stále aktualizoval po dobu spuštěnýho "skype")

LOG:

ComboFix 10-11-22.02 - not 22.11.2010 22:59:49.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.2048.1383 [GMT 1:00]
Spuštěný z: c:\users\not\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\not\Desktop\CFScript.txt
* Rezidentní štít AV je zapnutý


file zipped: c:\users\not\Documents\user.exe
.
PEV Error: ProfilesFile

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\not\Documents\user.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-22 do 2010-11-22 )))))))))))))))))))))))))))))))
.

2010-11-22 22:05 . 2010-11-22 22:05 -------- d-----w- c:\users\not\AppData\Local\temp
2010-11-22 22:05 . 2010-11-22 22:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-11-22 21:07 . 2010-11-22 21:09 -------- d-----w- c:\program files\trend micro
2010-11-22 21:07 . 2010-11-22 21:08 -------- d-----w- C:\rsit
2010-11-19 11:35 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DBD53F73-67C7-4182-9DEA-DFF6A35A611C}\mpengine.dll
2010-11-15 22:21 . 2010-11-15 22:22 -------- d-----w- c:\users\not\AppData\Roaming\Ventrilo
2010-11-15 22:20 . 2010-11-15 22:20 -------- d-----w- c:\program files\Ventrilo
2010-11-15 22:19 . 2010-11-15 22:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-11-14 18:48 . 2010-11-14 20:35 -------- d-----w- c:\users\not\AppData\Roaming\Tunngle
2010-11-14 18:48 . 2010-11-14 20:31 -------- d-----w- c:\programdata\Tunngle
2010-11-14 18:48 . 2009-09-16 07:02 27136 ----a-w- c:\windows\system32\drivers\tap0901t.sys
2010-11-11 18:53 . 2010-11-11 18:53 -------- d-----w- c:\users\not\AppData\Local\ElevatedDiagnostics
2010-11-11 16:34 . 2010-11-11 16:34 -------- d-----w- C:\temp
2010-11-11 16:32 . 2010-11-11 16:32 -------- d-----w- c:\program files\Microsoft.NET
2010-11-11 11:52 . 2010-11-11 12:05 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-11-11 11:10 . 2010-11-11 11:40 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-11-11 10:00 . 2010-11-11 10:00 -------- d-----w- c:\programdata\Blizzard
2010-11-11 09:39 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-11-11 09:38 . 2010-05-05 06:46 363520 ----a-w- c:\windows\system32\StructuredQuery.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-18 11:56 222080 ------w- c:\windows\system32\MpSigStub.exe
.

------- Sigcheck -------

[-] 2010-07-15 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET Smart Security\egui.exe" [2009-02-06 2021400]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-05-24 26736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-25 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-17 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S2 ekrn;ESET Service;c:\program files\ESET Smart Security\ekrn.exe [2009-02-06 727720]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]

.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\gamelsp.dll
.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-11-22 23:06:57
ComboFix-quarantined-files.txt 2010-11-22 22:06
ComboFix2.txt 2010-11-22 21:26

Před spuštěním: 174 110 662 656 bytes free
Po spuštění: 173 828 198 400 bytes free

- - End Of File - - FB845DC02038CCE88E7197DF6B25AA77

[Rudy]

Log vypadá čistý. Udělejte ještě sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log.

[Kotrmelec]

Automatická kontrola: dokončeno před 3 min. (události: 2, objekty: 353956, čas: 00:59:46)
23.11.2010 11:46:12 Úloha byla spuštěna
23.11.2010 12:45:58 Úloha byla dokončena

_________________________________________________
Přikládám LOG z ntb - děkuji moc za pomoc a kontrolu dalšího logu kde mám problém navíc s nefunkčností bluetooth
_________________________________________________

Logfile of random's system information tool 1.08 (written by random/random)
Run by nothing at 2010-11-23 12:40:04
Microsoft Windows 7 Ultimate
System drive C: has 17 GB (6%) free of 305 GB
Total RAM: 3066 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:40:37, on 23.11.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET Smart Security\egui.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Users\nothing\Documents\user.exe
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\nothing\Desktop\RSIT.exe
C:\Program Files\trend micro\nothing.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [User.exe] C:\Users\nothing\Documents\user.exe
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\gamelsp.dll
O16 - DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} (Gif89 Class) - file:///C:/Program%20Files/Windows%20Sidebar/Gadgets/xplugCam.gadget/en-US/xplug.ocx
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - AppInit_DLLs:
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6175 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Install_NSS.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET Smart Security\egui.exe [2009-02-06 2021400]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2009-06-17 288312]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-07-23 498744]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-01 1164584]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"User.exe"=C:\Users\nothing\Documents\user.exe [2010-07-05 18944]
""= []
"NokiaOviSuite2"=C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-07-02 671608]


Install_NSS.job
SA.DAT
SCHEDLGU.TXT


Install_NSS.job
SA.DAT
SCHEDLGU.TXT

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-23 12:40:04 ----D---- C:\rsit
2010-11-23 12:40:04 ----D---- C:\Program Files\trend micro
2010-11-17 20:50:37 ----D---- C:\Program Files\Z
2010-11-15 19:23:28 ----D---- C:\Users\nothing\AppData\Roaming\dunelegacy
2010-11-14 19:44:35 ----D---- C:\Users\nothing\AppData\Roaming\Tunngle
2010-11-14 19:44:35 ----D---- C:\ProgramData\Tunngle
2010-11-09 03:01:18 ----D---- C:\Program Files\Microsoft.NET
2010-10-27 14:17:05 ----A---- C:\Windows\system32\msdri.dll
2010-10-27 14:17:05 ----A---- C:\Windows\system32\CPFilters.dll
2010-10-27 14:16:40 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-10-27 12:33:09 ----A---- C:\Windows\system32\javaws.exe
2010-10-27 12:33:09 ----A---- C:\Windows\system32\javaw.exe
2010-10-27 12:33:09 ----A---- C:\Windows\system32\java.exe
2010-10-25 10:48:54 ----D---- C:\Users\nothing\AppData\Roaming\Ventrilo
2010-10-25 10:48:27 ----D---- C:\Program Files\Ventrilo
2010-10-25 10:47:22 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

======List of files/folders modified in the last 1 months======

2010-11-23 12:40:28 ----D---- C:\Windows\Prefetch
2010-11-23 12:40:05 ----D---- C:\Windows\Temp
2010-11-23 12:40:04 ----RD---- C:\Program Files
2010-11-23 12:39:11 ----HD---- C:\ProgramData
2010-11-23 12:39:11 ----A---- C:\ProgramData\HPWALog.txt
2010-11-23 12:38:32 ----D---- C:\Windows\system32\config
2010-11-23 10:43:34 ----SHD---- C:\System Volume Information
2010-11-17 20:51:18 ----D---- C:\Games
2010-11-16 16:46:57 ----D---- C:\Users\nothing\AppData\Roaming\ICQ
2010-11-14 19:45:11 ----RSD---- C:\Windows\Fonts
2010-11-14 19:45:02 ----D---- C:\Windows\System32
2010-11-11 03:00:30 ----A---- C:\Windows\system32\MRT.exe
2010-11-09 03:08:44 ----D---- C:\Windows\Microsoft.NET
2010-11-09 03:08:43 ----RSD---- C:\Windows\assembly
2010-11-09 03:03:12 ----SHD---- C:\Windows\Installer
2010-11-09 03:03:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-09 03:03:08 ----D---- C:\Windows\inf
2010-11-09 03:01:19 ----D---- C:\Windows\system32\en-US
2010-11-08 16:18:31 ----D---- C:\Windows\rescache
2010-11-02 20:34:16 ----D---- C:\Program Files\ICQ7.2
2010-10-31 23:23:27 ----D---- C:\Users\nothing\AppData\Roaming\uTorrent
2010-10-28 02:01:07 ----D---- C:\Windows\winsxs
2010-10-28 02:01:04 ----D---- C:\Windows\ehome
2010-10-28 02:00:51 ----D---- C:\Windows\AppPatch
2010-10-28 02:00:33 ----D---- C:\Windows\system32\drivers
2010-10-27 14:16:31 ----D---- C:\Windows\system32\catroot
2010-10-27 14:16:29 ----D---- C:\Windows\system32\catroot2
2010-10-27 12:32:52 ----D---- C:\Program Files\Java
2010-10-25 10:47:22 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 BtHidBus;Bluetooth HID Bus Service; C:\Windows\System32\Drivers\BtHidBus.sys [2009-09-24 19592]
R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2010-02-26 25656]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-10-15 721904]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-07-14 117248]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2010-02-26 33848]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-13 1035776]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2010-03-23 2661368]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2009-04-20 9344]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2009-04-29 15872]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 an1m3oye;an1m3oye; C:\Windows\system32\drivers\an1m3oye.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BT;Bluetooth PAN Network Adapter; C:\Windows\system32\DRIVERS\btnetdrv.sys []
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 btnetBUs;Bluetooth PAN Bus Service; C:\Windows\System32\Drivers\btnetBus.sys [2009-09-24 22528]
S3 EagleXNt;EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys []
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:\Windows\System32\Drivers\IvtBtBus.sys [2009-08-26 25480]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 VComm;Virtual Serial port driver; C:\Windows\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\Windows\System32\Drivers\VcommMgr.sys []
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET Smart Security\ekrn.exe [2009-02-06 727720]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2010-02-26 26168]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-03-02 75064]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2010-07-28 214520]
R3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET Smart Security\EHttpSrv.exe [2009-02-06 20680]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-05 654848]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2009-09-03 3347280]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-25 1343400]

-----------------EOF-----------------

[Rudy]

Nic nebezpečného tam nevidím. Zkuste obnovu systému k datu, kdy korektně fungoval.

[Kotrmelec]

nefungoval už od začátku .. a s tím "skype" (user.exe) můžu použít stejný script jako u pc?

[Rudy]

Skript vám bude k ničemu, neboť user.exe v NTB nemáte. Proč vám nefunguje bluetooth, těžko říci, ale virem to nebude.

[Kotrmelec]

Příkládám screeny ze správce zařízení a v dokumentech mám user.exe s aktualizovaným screenem mé obrazovky s názvem jak jsem pojmenoval ntb

[Rudy]

V tom případě zopakujte postup s ComboFixem.

[Kotrmelec]

ComboFix 10-11-23.01 - nothing 23.11.2010 20:01:21.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3066.2084 [GMT 1:00]
Spuštěný z: c:\users\nothing\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe
c:\windows\npptools.dll
c:\windows\system\DPLAY.DLL

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-23 do 2010-11-23 )))))))))))))))))))))))))))))))
.

2010-11-23 18:59 . 2010-11-23 19:00 -------- d-----w- C:\32788R22FWJFW
2010-11-23 11:40 . 2010-11-23 11:40 -------- d-----w- C:\rsit
2010-11-23 11:40 . 2010-11-23 11:40 -------- d-----w- c:\program files\trend micro
2010-11-23 09:43 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{07613667-6C25-4E06-A637-1B321959B007}\mpengine.dll
2010-11-17 19:50 . 2010-11-17 20:08 -------- d-----w- c:\program files\Z
2010-11-15 18:23 . 2010-11-15 18:55 -------- d-----w- c:\users\nothing\AppData\Roaming\dunelegacy
2010-11-14 18:44 . 2010-11-14 18:44 -------- d-----w- c:\users\nothing\AppData\Roaming\Tunngle
2010-11-14 18:44 . 2010-11-14 18:44 -------- d-----w- c:\programdata\Tunngle
2010-11-09 02:01 . 2010-11-09 02:01 -------- d-----w- c:\program files\Microsoft.NET
2010-10-27 13:17 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-10-27 13:17 . 2010-08-04 06:17 417792 ----a-w- c:\windows\system32\msdri.dll
2010-10-27 13:17 . 2010-08-04 06:15 204288 ----a-w- c:\windows\system32\MSNP.ax
2010-10-27 13:17 . 2010-08-04 06:15 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2010-10-27 13:16 . 2010-07-13 05:22 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2010-10-25 09:48 . 2010-10-25 09:49 -------- d-----w- c:\users\nothing\AppData\Roaming\Ventrilo
2010-10-25 09:48 . 2010-10-25 09:48 -------- d-----w- c:\program files\Ventrilo
2010-10-25 09:47 . 2010-10-25 09:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-20 17:20 . 2010-10-20 17:20 40448 ----a-w- c:\windows\hypremv1.exe
2010-10-19 09:41 . 2009-10-13 22:37 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-15 02:50 . 2010-10-06 12:30 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-08 04:30 . 2010-10-13 19:16 978432 ----a-w- c:\windows\system32\wininet.dll
2010-09-08 04:28 . 2010-10-13 19:16 44544 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-08 03:22 . 2010-10-13 19:16 386048 ----a-w- c:\windows\system32\html.iec
2010-09-08 02:48 . 2010-10-13 19:16 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-09-01 04:23 . 2010-10-13 19:16 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-09-01 02:34 . 2010-10-13 19:16 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-08-31 04:32 . 2010-10-13 19:16 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-08-31 04:32 . 2010-10-13 19:16 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-08-27 05:46 . 2010-10-13 19:16 168448 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 03:31 . 2010-10-13 19:16 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-27 03:30 . 2010-10-13 19:16 308736 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-27 03:30 . 2010-10-13 19:16 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-08-26 04:39 . 2010-10-13 19:16 109056 ----a-w- c:\windows\system32\t2embed.dll
.

------- Sigcheck -------

[-] 2010-07-15 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"User.exe"="c:\users\nothing\Documents\user.exe" [2010-07-05 18944]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-07-02 671608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"egui"="c:\program files\ESET Smart Security\egui.exe" [2009-02-06 2021400]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-06-17 288312]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [2009-09-24 22528]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [2009-08-26 25480]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-09-03 3347280]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-25 1343400]
S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [2009-09-24 19592]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-15 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 ekrn;ESET Service;c:\program files\ESET Smart Security\ekrn.exe [2009-02-06 727720]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-02-06 38240]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2010-02-26 26168]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]

.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.com/
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\gamelsp.dll
DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} - file:///C:/Program%20Files/Windows%20Sidebar/Gadgets/xplugCam.gadget/en-US/xplug.ocx
.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-11-23 20:09:02
ComboFix-quarantined-files.txt 2010-11-23 19:09

Před spuštěním: 17 155 944 448 bytes free
Po spuštění: 17 399 959 552 bytes free

- - End Of File - - C958EA909EB398C0AB8D153DEC65CBEE