VIRY.CZ

Zdravím,

vyskytl se mi menší problém na jednom pc, nejspíše se jedná o "zbota" ale asi tam bude i něco jiného.

Přikládám log z combofix:

ComboFix 10-12-07.04 - wasp 08.12.2010 13:01:44.1.4 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.3510.2067 [GMT 1:00]
Spuštěný z: c:\users\wasp\Downloads\ComboFix.exe
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\XSxS

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-08 do 2010-12-08 )))))))))))))))))))))))))))))))
.

2010-12-08 12:08 . 2010-12-08 12:08 -------- d-----w- c:\users\vcsinstall\AppData\Local\temp
2010-12-08 12:08 . 2010-12-08 12:08 -------- d-----w- c:\users\install\AppData\Local\temp
2010-12-08 12:08 . 2010-12-08 12:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-08 12:08 . 2010-12-08 12:08 -------- d-----w- c:\users\administrator\AppData\Local\temp
2010-12-08 11:52 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-08 11:52 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-08 11:41 . 2010-12-08 11:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-08 11:34 . 2010-12-08 11:34 -------- d-----w- c:\users\wasp\AppData\Roaming\Malwarebytes
2010-12-08 11:34 . 2010-12-08 11:52 -------- d-----w- c:\programdata\Malwarebytes
2010-12-08 09:54 . 2010-12-08 13:10 -------- d-----w- C:\Quarantine
2010-12-08 07:09 . 2010-12-08 07:11 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-12-05 20:58 . 2010-12-05 20:58 -------- d-----w- c:\program files\Microsoft Games
2010-11-29 07:14 . 2010-11-29 07:14 -------- d-----w- c:\program files\Xenocode
2010-11-25 07:57 . 2010-11-25 07:57 -------- d-----w- c:\program files\Winmail Opener
2010-11-23 08:11 . 2010-11-23 08:11 -------- d-----w- c:\program files\Microsoft.NET
2010-11-23 08:09 . 2010-11-23 08:09 -------- d-----w- c:\program files\Microsoft Analysis Services
2010-11-23 08:09 . 2010-11-23 08:09 -------- d-----w- c:\users\wasp\AppData\Local\Microsoft Help
2010-11-23 08:09 . 2010-11-23 08:15 -------- d-----w- c:\programdata\Microsoft Help
2010-11-22 19:00 . 2010-12-08 11:46 -------- d-----w- c:\users\wasp\AppData\Roaming\skypePM
2010-11-22 18:58 . 2010-11-22 18:58 -------- d-----w- c:\program files\Common Files\Skype
2010-11-22 18:58 . 2010-11-22 18:58 -------- d-----r- c:\program files\Skype
2010-11-22 18:58 . 2010-12-08 13:10 -------- d-----w- c:\users\wasp\AppData\Roaming\Skype
2010-11-22 18:58 . 2010-11-22 18:58 -------- d-----w- c:\programdata\Skype
2010-11-22 11:39 . 2010-11-22 11:39 -------- d-----w- c:\users\administrator\AppData\Roaming\Intel
2010-11-14 18:37 . 2010-11-14 18:37 -------- d-----w- c:\users\wasp\AppData\Local\Mozilla
2010-11-11 15:17 . 2010-12-05 20:59 -------- d-----w- c:\users\wasp\Tracing
2010-11-11 15:01 . 2010-11-11 15:11 -------- d-----w- c:\program files\Windows Live
2010-11-11 15:00 . 2010-11-11 15:00 -------- d-----w- c:\program files\Microsoft Silverlight
2010-11-11 14:59 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2010-11-11 14:59 . 2010-05-23 10:11 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2010-11-11 14:59 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\system32\mf.dll
2010-11-11 14:56 . 2010-12-05 21:00 -------- d-----w- c:\users\wasp\AppData\Local\Windows Live
2010-11-11 14:56 . 2010-11-11 14:56 -------- d-----w- c:\program files\Common Files\Windows Live

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-08 13:10 . 2010-09-23 11:58 0 ----a-w- c:\users\wasp\AppData\Local\WavXMapDrive.bat
2010-10-25 17:01 . 2010-11-01 12:50 149968 ----a-w- c:\users\wasp\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
2010-10-19 10:41 . 2010-09-23 20:30 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-14 19:14 . 2010-10-14 19:14 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-10-14 19:14 . 2010-10-14 19:14 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-10-09 20:05 . 2010-10-09 20:05 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-09 20:05 . 2010-10-09 20:05 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-07 23:21 . 2010-10-31 06:15 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4D0AD635-A5EE-408A-9404-5416BD58E382}\mpengine.dll
2010-09-23 11:25 . 2010-09-23 08:54 0 ----a-w- c:\users\administrator\AppData\Local\WavXMapDrive.bat
2010-09-23 08:37 . 2010-09-23 08:37 0 ----a-w- c:\users\install\AppData\Local\WavXMapDrive.bat
2010-09-22 23:47 . 2010-09-22 23:47 49016 ----a-w- c:\windows\system32\sirenacm.dll
2010-09-21 13:03 . 2010-09-21 13:03 208768 ----a-w- c:\windows\system32\LIVESSP.DLL
2010-09-11 19:53 . 2010-09-11 19:53 35840 ----a-w- c:\windows\system32\drivers\winusb.sys
2010-09-11 19:53 . 2010-09-11 19:53 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-09-11 19:53 . 2010-09-11 19:53 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-09-11 19:53 . 2010-09-11 19:53 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-09-11 19:53 . 2010-09-11 19:53 41984 ----a-w- c:\windows\system32\drivers\usbehci.sys
2010-09-11 19:53 . 2010-09-11 19:53 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2010-09-11 19:53 . 2010-09-11 19:53 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-09-11 19:53 . 2010-09-11 19:53 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-09-11 19:53 . 2010-09-11 19:53 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-09-11 19:53 . 2010-09-11 19:53 34816 ----a-w- c:\windows\system32\msasn1.dll
2010-09-11 19:53 . 2010-09-11 19:53 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-11 19:53 . 2010-09-11 19:53 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-09-11 19:53 . 2010-09-11 19:53 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-11 19:53 . 2010-09-11 19:53 977920 ----a-w- c:\windows\system32\wininet.dll
2010-09-11 19:53 . 2010-09-11 19:53 91648 ----a-w- c:\windows\system32\avifil32.dll
2010-09-11 19:53 . 2010-09-11 19:53 84480 ----a-w- c:\windows\system32\mciavi32.dll
2010-09-11 19:53 . 2010-09-11 19:53 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-09-11 19:53 . 2010-09-11 19:53 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-09-11 19:53 . 2010-09-11 19:53 285696 ----a-w- c:\windows\system32\winlogon.exe
2010-09-11 19:53 . 2010-09-11 19:53 2614272 ----a-w- c:\windows\explorer.exe
2010-09-11 19:53 . 2010-09-11 19:53 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-09-11 19:53 . 2010-09-11 19:53 22016 ----a-w- c:\windows\system32\msyuv.dll
2010-09-11 19:53 . 2010-09-11 19:53 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-09-11 19:53 . 2010-09-11 19:53 1328640 ----a-w- c:\windows\system32\quartz.dll
2010-09-11 19:53 . 2010-09-11 19:53 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-09-11 19:53 . 2010-09-11 19:53 417792 ----a-w- c:\windows\system32\msdri.dll
2010-09-11 19:53 . 2010-09-11 19:53 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-09-11 19:53 . 2010-09-11 19:53 108544 ----a-w- c:\windows\system32\t2embed.dll
2010-09-11 19:53 . 2010-09-11 19:53 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-09-11 19:53 . 2010-09-11 19:53 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-09-11 19:53 . 2010-09-11 19:53 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-09-11 19:53 . 2010-09-11 19:53 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-09-11 19:53 . 2010-09-11 19:53 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-11 19:53 . 2010-09-11 19:53 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-09-11 19:53 . 2010-09-11 19:53 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-09-11 19:53 . 2010-09-11 19:53 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-09-11 19:53 . 2010-09-11 19:53 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-09-11 19:53 . 2010-09-11 19:53 369152 ----a-w- c:\windows\system32\secproc.dll
2010-09-11 19:53 . 2010-09-11 19:53 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-09-11 19:53 . 2010-09-11 19:53 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-09-11 19:53 . 2010-09-11 19:53 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-09-11 19:53 . 2010-09-11 19:53 292864 ----a-w- c:\windows\system32\apphelp.dll
2010-09-11 19:53 . 2010-09-11 19:53 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-09-11 19:53 . 2010-09-11 19:53 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-09-11 19:53 . 2010-09-11 19:53 204288 ----a-w- c:\windows\system32\MSNP.ax
2010-09-11 19:53 . 2010-09-11 19:53 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-09-11 19:53 . 2010-09-11 19:53 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-09-11 19:53 . 2010-09-11 19:53 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-11 19:53 . 2010-09-11 19:53 507568 ----a-w- c:\windows\system32\winload.exe
2010-09-11 19:53 . 2010-09-11 19:53 442920 ----a-w- c:\windows\system32\winresume.exe
2010-09-11 19:53 . 2010-09-11 19:53 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-09-11 19:53 . 2010-09-11 19:53 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-09-11 19:53 . 2010-09-11 19:53 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-09-11 19:53 . 2010-09-11 19:53 132608 ----a-w- c:\windows\system32\cabview.dll
2010-09-11 19:53 . 2010-09-11 19:53 1320960 ----a-w- c:\windows\system32\CertEnroll.dll
2010-09-11 19:53 . 2010-09-11 19:53 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-09-11 19:53 . 2010-09-11 19:53 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-09-11 19:53 . 2010-09-11 19:53 93696 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2010-09-11 19:53 . 2010-09-11 19:53 86528 ----a-w- c:\windows\system32\isoburn.exe
2010-09-11 19:53 . 2010-09-11 19:53 67584 ----a-w- c:\windows\system32\WUDFSvc.dll
2010-09-11 19:53 . 2010-09-11 19:53 573440 ----a-w- c:\windows\system32\WUDFx.dll
2010-09-11 19:53 . 2010-09-11 19:53 514560 ----a-w- c:\windows\system32\qdvd.dll
2010-09-11 19:53 . 2010-09-11 19:53 488448 ----a-w- c:\windows\system32\evr.dll
2010-09-11 19:53 . 2010-09-11 19:53 39936 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2010-09-11 19:53 . 2010-09-11 19:53 292864 ----a-w- c:\windows\system32\mfds.dll
2010-09-11 19:53 . 2010-09-11 19:53 197632 ----a-w- c:\windows\system32\WUDFHost.exe
2010-09-11 19:53 . 2010-09-11 19:53 163328 ----a-w- c:\windows\system32\WUDFPlatform.dll
2010-09-11 19:53 . 2010-09-11 19:53 163328 ----a-w- c:\windows\system32\drivers\1394ohci.sys
2010-09-11 19:53 . 2010-09-11 19:53 132352 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2010-09-11 19:53 . 2010-09-11 19:53 27736 ----a-w- c:\windows\system32\drivers\msahci.sys
2010-09-11 19:53 . 2010-09-11 19:53 246784 ----a-w- c:\windows\system32\drivers\udfs.sys
2010-09-11 17:03 . 2010-09-11 17:04 411368 ----a-w- c:\windows\system32\deployJava1.dll
2009-10-07 02:59 . 2010-09-23 10:46 3145728 ----a-w- c:\program files\Common Files\sapxlhelper.dll
2009-10-07 02:59 . 2010-09-23 10:46 192512 ----a-w- c:\program files\Common Files\sapconsr3.dll
2009-10-07 02:59 . 2010-09-23 10:46 626688 ----a-w- c:\program files\Common Files\sapconsaccess.dll
2009-10-07 02:58 . 2010-09-23 10:46 40960 ----a-w- c:\program files\Common Files\DigitalSignature.ocx
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2010-03-29 17:45 62832 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2010-03-29 17:45 62832 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-05-13 288112]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-05-26 495708]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 169496]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"IMSS"="c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2010-12-08 114200]
"PNMService"="c:\program files\Intel\IntelPNM\PNMService.exe" [2010-01-21 400896]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-11-02 657920]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2010-07-21 147840]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-06-22 34232]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-03-12 462993]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2010-06-01 140608]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2010-08-25 124224]
"CfgDownload"="c:\program files\IXOS\IXOS-eCONtext\bin\CfgDownload.exe" [2003-06-29 443384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-12-08 37808]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-1-8 828704]
Spr vce syst‚mu Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2010-2-8 1327472]
TdmNotify.lnk - c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe [2010-3-29 132456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R3 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [2010-12-08 73728]
R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\Drivers\CtAudDrv.sys [2009-05-28 134144]
R3 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2009-11-09 99896]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 25112]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-25 66536]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2009-10-26 17408]
R3 NgFilter;Aventail VPN Filter;c:\windows\system32\DRIVERS\ngfilter.sys [2009-05-11 20608]
R3 NgLog;Aventail VPN Logging;c:\windows\system32\DRIVERS\nglog.sys [2009-05-11 25216]
R3 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2009-05-11 225885]
R3 NgWfp;Aventail VPN Callout;c:\windows\system32\DRIVERS\ngwfp.sys [2009-05-11 23168]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2010-03-21 48640]
R3 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe86.sys [2010-03-21 38912]
R3 vpcuxd;Služba zástupné procedury virtualizace rozhraní USB;c:\windows\system32\DRIVERS\vpcuxd.sys [2009-09-23 12800]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-04 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
R3 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-12-08 239104]
R3 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [2010-10-05 1060352]
R3 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [2010-10-05 484352]
S0 stdflt;Disk Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdfltn.sys [2010-01-18 17072]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [2010-05-26 81920]
S2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [2009-11-20 278304]
S2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [2010-03-24 812448]
S2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [2010-03-24 27040]
S2 dcpsysmgrsvc;Správce systému Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2010-02-08 386928]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 InstallFilterService;FF Install Filter Service;c:\program files\STMicroelectronics\AccelerometerP11\InstallFilterService.exe [2010-01-10 60928]
S2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\EngineServer.exe [2010-08-25 22816]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-08-25 69192]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe86.sys [2010-03-21 59904]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-04-14 2533400]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-01-18 42672]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-01-11 274472]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-01-11 33320]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-09-16 144576]
S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [2009-10-30 33832]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2010-04-06 224424]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 132480]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 232960]
S3 NETw5s32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
S3 NgVpn;Aventail VPN Adapter;c:\windows\system32\DRIVERS\ngvpn.sys [2009-05-11 77952]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://intranet/apps%5Cportail%5Cpixpor ... F=FRAMESET
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath - c:\users\wasp\AppData\Roaming\Mozilla\Firefox\Profiles\e23dxj44.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\progra~1\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\users\wasp\AppData\Roaming\Mozilla\Firefox\Profiles\e23dxj44.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\windows\system32\Wat\npWatWeb.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Extension: meebo: firefox@meebo.com - c:\users\wasp\AppData\Roaming\Mozilla\Firefox\Profiles\e23dxj44.default\extensions\firefox@meebo.com
FF - Extension: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - c:\users\wasp\AppData\Roaming\Mozilla\Firefox\Profiles\e23dxj44.default\extensions\LogMeInClient@logmein.com
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-Locked - (no file)


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3068)
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\IDT\WDM\STacSV.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\lotus\ntmulti.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\mfeann.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\Apntex.exe
c:\windows\system32\conhost.exe
c:\program files\DellTPad\HidFind.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\McAfee\Common Framework\McTray.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
c:\program files\windows defender\MpCmdRun.exe
c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
c:\program files\Common Files\Java\Java Update\jusched.exe
.
**************************************************************************
.
Celkový čas: 2010-12-08 14:12:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-08 13:12

Před spuštěním: Volných bajtů: 217 096 572 928
Po spuštění: Volných bajtů: 221 339 136 000

- - End Of File - - 9A21EF65A99B3BE77691EEA60E93F484

Předem děkuji všem za pomoc

Tady ještě výsledek AVPtool. McAfee hlásil Zbota, ale Kaspersky našel Murofet.a Poradí někdo co dál? myslíte si že je už ta havěť pryč?

Automatická kontrola: dokončeno před 6 min. (události: 107, objekty: 373498, čas: 01:30:42)
8.12.2010 15:00:27 Úloha byla spuštěna
8.12.2010 15:02:12 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\glmPT.exe
8.12.2010 15:02:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\glmPT.exe
8.12.2010 15:02:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\glmPT.exe
8.12.2010 15:02:12 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbax.exe
8.12.2010 15:02:13 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbax.exe
8.12.2010 15:02:13 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbax.exe
8.12.2010 15:02:13 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbmx.exe
8.12.2010 15:02:13 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbmx.exe
8.12.2010 15:02:13 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbmx.exe
8.12.2010 15:02:13 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbux.exe
8.12.2010 15:02:14 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbux.exe
8.12.2010 15:02:14 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnbux.exe
8.12.2010 15:02:14 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnetx.exe
8.12.2010 15:02:14 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnetx.exe
8.12.2010 15:02:14 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnetx.exe
8.12.2010 15:02:16 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gngax.exe
8.12.2010 15:02:18 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gngax.exe
8.12.2010 15:02:21 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gngax.exe
8.12.2010 15:02:21 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnhpx.exe
8.12.2010 15:02:21 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnhpx.exe
8.12.2010 15:02:21 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnhpx.exe
8.12.2010 15:02:22 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnscx.exe
8.12.2010 15:02:22 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnscx.exe
8.12.2010 15:02:22 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnscx.exe
8.12.2010 15:02:22 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnupx.exe
8.12.2010 15:02:22 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnupx.exe
8.12.2010 15:02:23 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\gnupx.exe
8.12.2010 15:02:23 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\guixt.exe
8.12.2010 15:02:25 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\guixt.exe
8.12.2010 15:02:25 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\guixt.exe
8.12.2010 15:02:26 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\lprint.exe
8.12.2010 15:02:30 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\lprint.exe
8.12.2010 15:02:37 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\lprint.exe
8.12.2010 15:02:40 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\OIS.EXE
8.12.2010 15:02:43 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\OIS.EXE
8.12.2010 15:02:51 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\OIS.EXE
8.12.2010 15:02:52 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
8.12.2010 15:02:54 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
8.12.2010 15:02:54 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
8.12.2010 15:02:54 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\rfccom.exe
8.12.2010 15:02:54 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\rfccom.exe
8.12.2010 15:02:54 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\rfccom.exe
8.12.2010 15:02:55 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\Main\Roxio_Central36.exe
8.12.2010 15:02:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\Main\Roxio_Central36.exe
8.12.2010 15:02:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\Main\Roxio_Central36.exe
8.12.2010 15:02:57 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapcms.exe
8.12.2010 15:02:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapcms.exe
8.12.2010 15:02:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapcms.exe
8.12.2010 15:02:58 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPftp.exe
8.12.2010 15:03:01 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPftp.exe
8.12.2010 15:03:01 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPftp.exe
8.12.2010 15:03:01 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPgui.exe
8.12.2010 15:03:01 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPgui.exe
8.12.2010 15:03:02 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPgui.exe
8.12.2010 15:03:02 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPGUIControlPlugin.exe
8.12.2010 15:03:02 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPGUIControlPlugin.exe
8.12.2010 15:03:02 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPGUIControlPlugin.exe
8.12.2010 15:03:02 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPhttp.exe
8.12.2010 15:03:04 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPhttp.exe
8.12.2010 15:03:04 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\SAPhttp.exe
8.12.2010 15:03:05 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\sapphone\sapphone2.exe
8.12.2010 15:03:06 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\sapphone\sapphone2.exe
8.12.2010 15:03:06 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\sapphone\sapphone2.exe
8.12.2010 15:03:07 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapRegSv.exe
8.12.2010 15:03:09 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapRegSv.exe
8.12.2010 15:03:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapRegSv.exe
8.12.2010 15:03:12 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SEM\SapSEMFrontendPurge.exe
8.12.2010 15:03:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SEM\SapSEMFrontendPurge.exe
8.12.2010 15:03:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SEM\SapSEMFrontendPurge.exe
8.12.2010 15:03:12 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapshcut.exe
8.12.2010 15:03:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapshcut.exe
8.12.2010 15:03:12 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\sapshcut.exe
8.12.2010 15:03:13 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapStart.exe
8.12.2010 15:03:15 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapStart.exe
8.12.2010 15:03:18 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\SapSetup\setup\SapStart.exe
8.12.2010 15:03:19 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\ssfrfc.exe
8.12.2010 15:03:28 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\ssfrfc.exe
8.12.2010 15:03:28 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\ssfrfc.exe
8.12.2010 15:03:30 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\visu_se.exe
8.12.2010 15:03:30 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\visu_se.exe
8.12.2010 15:03:31 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\visu_se.exe
8.12.2010 15:03:32 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbtask.exe
8.12.2010 15:03:34 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbtask.exe
8.12.2010 15:03:43 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbtask.exe
8.12.2010 15:03:44 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbwpub.exe
8.12.2010 15:03:44 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbwpub.exe
8.12.2010 15:03:44 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\Bw\wdbwpub.exe
8.12.2010 15:03:44 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\utils\wdftrace.exe
8.12.2010 15:03:44 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\utils\wdftrace.exe
8.12.2010 15:03:44 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\utils\wdftrace.exe
8.12.2010 15:03:45 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsam97.exe
8.12.2010 15:03:45 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsam97.exe
8.12.2010 15:03:45 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsam97.exe
8.12.2010 15:03:45 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsat97.exe
8.12.2010 15:03:46 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsat97.exe
8.12.2010 15:03:46 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\PS\ACCESS\wdpsat97.exe
8.12.2010 15:03:50 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\Windows Live\Installer\wlarp.exe
8.12.2010 15:03:50 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Windows Live\Installer\wlarp.exe
8.12.2010 15:03:50 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\Windows Live\Installer\wlarp.exe
8.12.2010 15:03:53 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wswinsrv.exe
8.12.2010 15:03:54 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wswinsrv.exe
8.12.2010 15:03:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wswinsrv.exe
8.12.2010 15:03:57 Zjištěno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\wwirun.exe
8.12.2010 15:03:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\wwirun.exe
8.12.2010 15:03:57 Dezinfikováno: Virus.Win32.Murofet.a C:\Program Files\SAP\FrontEnd\SAPgui\wwi\wwirun.exe
8.12.2010 16:31:09 Úloha byla dokončena

Zdravím, přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Nakonec použij Cure It z mého podpisu a dej vědět jak sken dopadl.

nechci zakládat nové téma, mohl by mi ještě někdo kouknout na jeden log? Mám podezření na nakažení zbotem také + nějakou jinou havět, která neumožní napsat háček ani čárku nad písmenka =(

Za chvíli jěště pošlu výsledek z CureIT z kontroly prvního PC.

tady je log z RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by lhtvotrubova at 2010-12-09 08:51:08
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 215 GB (90%) free of 238 GB
Total RAM: 3292 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:51, on 2010-12-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\mfevtps.exe
C:\lotus\notes\ntmulti.exe
C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\Program Files\IXOS\bin\spawner.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\IXOS\bin\DP.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\IXOS\bin\cfbx.exe
C:\Program Files\IXOS\bin\Chkpout.exe
C:\Program Files\IXOS\bin\cpfile.exe
C:\Program Files\IXOS\bin\docrm.exe
C:\Program Files\IXOS\bin\doctods.exe
C:\Program Files\IXOS\bin\doctods.exe
C:\Program Files\IXOS\bin\doctods.exe
C:\Program Files\IXOS\bin\GenR3ins.exe
C:\Program Files\IXOS\bin\page_idx.exe
C:\Program Files\IXOS\bin\Prepdoc.exe
C:\Program Files\IXOS\bin\R3AidSel.exe
C:\Program Files\IXOS\bin\R3Formid.exe
C:\Program Files\IXOS\bin\R3Insert.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\Tiff2Mtiff.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\xsl_parser.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\Program Files\IXOS\bin\perldtn.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\Twain_32\Fjscan32\SOP\FtLnSOP.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAP\FrontEnd\SAPgui\SAPlpd\SAPlpd.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\lotus\notes\NLNOTES.EXE
C:\lotus\notes\NCDaemon.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\lotus\notes\ntaskldr.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\lhtvotrubova\Plocha\RSIT.exe
C:\Program Files\trend micro\lhtvotrubova.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy-pac.lhoist.com/bti-lht.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SAP_WUS_UNT] "C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [FtLnSOP_setup] C:\WINDOWS\Twain_32\Fjscan32\SOP\FtLnSOP.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [CfgDownload] C:\Program Files\IXOS\bin\CfgDownload.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [{3D4C5C5F-D3F6-5697-BAD5-E9D2472AA339}] "C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges\umlae.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SAP Printer Daemon.lnk = C:\Program Files\SAP\FrontEnd\SAPgui\SAPlpd\SAPlpd.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.ibm.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 2821195625
O16 - DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} (Active602XMLFiller Control) - https://www.mojedatovaschranka.cz/stati ... b?3,14,8,0
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2821188328
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = LHT.LHOIST.COM
O17 - HKLM\Software\..\Telephony: DomainName = LHT.LHOIST.COM
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = LHT.LHOIST.COM
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = LHT.LHOIST.COM
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\lotus\notes\ntmulti.exe
O23 - Service: SAPSetup Automatic Workstation Update Service (NWSAPAutoWorkstationUpdateSvc) - SAP AG - C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: IXOS Spawner (spawner) - IXOS SOFTWARE AG - an Open Text company - C:\Program Files\IXOS\bin\spawner.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 11832 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-07-24 1044480]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-01-11 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-01-11 173592]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-01-11 141336]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"SAP_WUS_UNT"=C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe [2008-03-11 136552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"FtLnSOP_setup"=C:\WINDOWS\Twain_32\Fjscan32\SOP\FtLnSOP.exe [2007-03-08 212992]
"McAfeeUpdaterUI"=C:\Program Files\McAfee\Common Framework\udaterui.exe [2010-06-01 140608]
"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"ShStatEXE"=C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [2010-08-25 124224]
"CfgDownload"=C:\Program Files\IXOS\bin\CfgDownload.exe [2008-01-10 188416]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"{3D4C5C5F-D3F6-5697-BAD5-E9D2472AA339}"=C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges\umlae.exe [2009-06-26 159808]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe [2010-01-27 256280]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-C740-BA7E-100000000002}\SC_Acrobat.exe
SAP Printer Daemon.lnk - C:\Program Files\SAP\FrontEnd\SAPgui\SAPlpd\SAPlpd.exe

C:\Documents and Settings\lhtvotrubova\Nabídka Start\Programy\Po spuštění
PowerMenu.lnk - C:\Program Files\PowerMenu\PowerMenu.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-11-03 205312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe"="C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe:*:Enabled:Sentinel Protection Server"
"C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe"="C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe:*:Enabled:Sentinel Keys Server"
"C:\Program Files\IXOS\bin\EnterpriseScan.exe"="C:\Program Files\IXOS\bin\EnterpriseScan.exe:*:Enabled:Livelink Enterprise Scan"
"C:\Program Files\IXOS\bin\LivelinkScan.exe"="C:\Program Files\IXOS\bin\LivelinkScan.exe:*:Enabled:Livelink Scan"
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe"="C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe"="C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service"
"C:\opentext\scan\bin\EnterpriseScan.exe"="C:\opentext\scan\bin\EnterpriseScan.exe:*:Enabled:Enterprise Scan"
"C:\opentext\scan\bin\LivelinkScan.exe"="C:\opentext\scan\bin\LivelinkScan.exe:*:Enabled:Livelink Scan"
"C:\Program Files\IXOS\bin\EnterpriseScan.exe"="C:\Program Files\IXOS\bin\EnterpriseScan.exe:*:Enabled:Livelink Enterprise Scan"
"C:\Program Files\IXOS\bin\LivelinkScan.exe"="C:\Program Files\IXOS\bin\LivelinkScan.exe:*:Enabled:Livelink Scan"

======List of files/folders created in the last 1 months======

2010-12-09 08:51:08 ----D---- C:\rsit
2010-12-09 08:51:08 ----D---- C:\Program Files\trend micro
2010-12-08 14:06:59 ----A---- C:\WINDOWS\saplogon.bak
2010-12-08 14:03:17 ----A---- C:\WINDOWS\zip.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\VFIND.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\SWSC.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\SWREG.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\sed.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\NIRCMD.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\grep.exe
2010-12-08 14:03:17 ----A---- C:\WINDOWS\fdsv.exe
2010-12-08 14:03:03 ----D---- C:\ComboFix
2010-12-08 14:03:02 ----A---- C:\WINDOWS\system32\CF32172.exe
2010-12-08 14:00:42 ----D---- C:\Quarantine
2010-12-08 13:59:18 ----A---- C:\WINDOWS\system32\CF31441.exe
2010-12-08 13:54:56 ----D---- C:\WINDOWS\ccleaner
2010-12-08 13:54:05 ----D---- C:\Qoobox
2010-12-08 13:38:39 ----D---- C:\Temp
2010-12-08 13:33:33 ----A---- C:\WINDOWS\system32\CF26412.exe
2010-12-08 13:29:01 ----A---- C:\WINDOWS\system32\CF25507.exe
2010-12-08 13:17:51 ----A---- C:\WINDOWS\system32\CF23319.exe
2010-12-08 13:09:04 ----D---- C:\WINDOWS\ERDNT
2010-12-08 13:07:41 ----D---- C:\Documents and Settings\lhtvotrubova\Data aplikací\Malwarebytes
2010-12-08 13:07:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-12-08 13:07:40 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-12-08 13:07:40 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-12-08 09:44:58 ----D---- C:\Install
2010-12-08 08:15:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-12-08 07:41:54 ----D---- C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges
2010-12-08 07:41:54 ----D---- C:\Documents and Settings\lhtvotrubova\Data aplikací\Owufi

======List of files/folders modified in the last 1 months======

2010-12-09 08:51:22 ----D---- C:\WINDOWS\Prefetch
2010-12-09 08:51:08 ----RD---- C:\Program Files
2010-12-09 08:49:42 ----D---- C:\WINDOWS\Temp
2010-12-09 07:29:24 ----D---- C:\WINDOWS\security
2010-12-09 07:27:52 ----D---- C:\WINDOWS
2010-12-08 15:24:28 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-12-08 14:03:04 ----D---- C:\WINDOWS\system32
2010-12-08 14:00:33 ----D---- C:\WINDOWS\system32\CatRoot2
2010-12-08 13:55:15 ----D---- C:\WINDOWS\Debug
2010-12-08 13:40:11 ----A---- C:\WINDOWS\wk2000.ini
2010-12-08 13:40:11 ----A---- C:\WINDOWS\winklav.ini
2010-12-08 13:40:11 ----A---- C:\WINDOWS\wg2000.ini
2010-12-08 13:18:13 ----SHD---- C:\System Volume Information
2010-12-08 13:18:13 ----D---- C:\WINDOWS\system32\Restore
2010-12-08 13:07:40 ----D---- C:\WINDOWS\system32\drivers
2010-12-08 12:44:26 ----A---- C:\WINDOWS\setscan.ini
2010-12-08 07:42:05 ----SD---- C:\Documents and Settings\lhtvotrubova\Data aplikací\Microsoft
2010-11-29 08:15:38 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2010-08-25 344712]
R0 SFAUDIO;Sonic Focus DSP Driver; C:\WINDOWS\system32\drivers\sfaudio.sys [2008-03-28 24064]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 mfetdik;McAfee Inc. mfetdik; C:\WINDOWS\system32\drivers\mfetdik.sys [2010-08-25 64208]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2007-04-27 90688]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-07-24 338944]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\WINDOWS\system32\DRIVERS\e1k5132.sys [2008-06-05 144480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HECI;Intel(R) Management Engine Interface; C:\WINDOWS\system32\DRIVERS\HECI.sys [2008-07-23 40832]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-11-03 6273504]
R3 mfeapfk;McAfee Inc. mfeapfk; C:\WINDOWS\system32\drivers\mfeapfk.sys [2010-08-25 76024]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2010-08-25 91896]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2010-08-25 43192]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S0 cercsr6;cercsr6; C:\WINDOWS\system32\drivers\cercsr6.sys [2004-12-13 39904]
S3 mferkdet;McAfee Inc. mferkdet; C:\WINDOWS\system32\drivers\mferkdet.sys [2010-08-25 66536]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 McAfeeEngineService;McAfee Engine Service; C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe [2010-08-25 22816]
R2 McAfeeFramework;McAfee Framework Service; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2010-06-01 120128]
R2 McShield;McAfee McShield; C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe [2010-08-25 147984]
R2 McTaskManager;McAfee Task Manager; C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [2010-08-25 66880]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\WINDOWS\system32\mfevtps.exe [2010-08-25 69192]
R2 Multi-user Cleanup Service;Multi-user Cleanup Service; C:\lotus\notes\ntmulti.exe [2006-09-27 53248]
R2 NWSAPAutoWorkstationUpdateSvc;SAPSetup Automatic Workstation Update Service; C:\Program Files\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe [2008-03-11 185712]
R2 SentinelKeysServer;Sentinel Keys Server; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2007-04-27 316992]
R2 SentinelProtectionServer;Sentinel Protection Server; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe [2007-04-27 206400]
R2 spawner;IXOS Spawner; C:\Program Files\IXOS\bin\spawner.exe [2006-12-01 180224]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

CureIT
zatím výsledek z prvního testovaného PC je OK, jediné co to našlo tak winvnc4.exe a wm_hooks.dll u obojího stav Program.RemoteAdmin

Ted ještě jedu kopletní sken, tak až bude výsledek ozvu se.

log z druhého testovaného PC. Scanoval jsem AVP tool a nakonec pročistil Ccleanerem.

Automatická kontrola: dokončeno před 21 min. (události: 7, objekty: 171583, čas: 00:42:30)
2010-12-09 11:00 Úloha byla spuštěna
2010-12-09 11:01 Zjištěno: Trojan-Dropper.Win32.FrauDrop.bqb C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges\umlae.exe
2010-12-09 11:48 Úloha byla zastavena
2010-12-09 11:53 Úloha byla spuštěna
2010-12-09 12:23 Zjištěno: Trojan-Dropper.Win32.FrauDrop.bqb C:\System Volume Information\_restore{4711089A-2D3E-4F79-80DA-B989DB20CF67}\RP313\A0051664.exe
2010-12-09 12:23 Odstraněno: Trojan-Dropper.Win32.FrauDrop.bqb C:\System Volume Information\_restore{4711089A-2D3E-4F79-80DA-B989DB20CF67}\RP313\A0051664.exe
2010-12-09 12:35 Úloha byla dokončena
Dezinfikovat aktivní hrozby: dokončeno před 1 hod. (události: 4, objekty: 4318, čas: 00:01:49)
2010-12-09 11:48 Úloha byla spuštěna
2010-12-09 11:48 Zjištěno: Trojan-Dropper.Win32.FrauDrop.bqb C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges\umlae.exe
2010-12-09 11:48 Odstraněno: Trojan-Dropper.Win32.FrauDrop.bqb C:\Documents and Settings\lhtvotrubova\Data aplikací\Yges\umlae.exe
2010-12-09 11:49 Úloha byla dokončena

tady je výsledek testu z CrueIT, je to kopmpletní test. Jedná se o to první PC.

pro rekapitulaci je pročistěn AVPtool,Ccleanerem vyčištěno a nakonec proscanováno CrueIT. Snad je to už OK.

Druhé PC
logy jsem přiložil a chová se již dobře, myslíte že bude ještě potřeba nějakého scanu?

Děkuji

Pokud jsou již obě PC v pořádku, žádný log třeba nebude a ani tam nic špatného nevidím.