VIRY.CZ

Můj prowider netu mne upozornil,že mám příliš velký objem odeslaných dat a abych skontroloval PC, zda není zavirované?
Logfile of random's system information tool 1.08 (written by random/random)
Run by rejnao at 2011-03-15 21:58:51
Microsoft Windows 7 Home Premium
System drive C: has 147 GB (83%) free of 177 GB
Total RAM: 2926 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:58:54, on 15.3.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\ProgramData\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Windows Live\Toolbar\wltuser.exe
C:\windows\SysWow64\Macromed\Flash\FlashUtil10d.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\ICQ7.4\ICQ.exe
C:\Program Files\trend micro\rejnao.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msi.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/sm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Badoo Desktop] "C:\ProgramData\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe"
O4 - HKCU\..\Run: [Odorik] "C:\Users\rejnao\Desktop\Odorik.exe"
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.4\ICQ.exe" silent loginmode=4
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\windows\SysWow64\Macromed\Flash\FlashUtil10d.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Micro Star SCM - Micro-Star International Co., Ltd. - C:\Program Files (x86)\System Control Manager\MSIService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe
O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10590 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
winlogon.exe
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\System Control Manager\MSIService.exe"
"C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\diMaster.dll" /prefetch:1
"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" service
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\SearchIndexer.exe /Embedding
"taskhost.exe"
"C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe" /c /a /s UserSession
"C:\windows\system32\Dwm.exe"
C:\windows\Explorer.EXE
"C:\Windows\System32\igfxtray.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\FSP\FspUip.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
"C:\ProgramData\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe"
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"
C:\windows\system32\wbem\unsecapp.exe -Embedding
ArcCon.ac 66256 0
C:\windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe" /SILENT
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4432 CREDAT:71937
"C:\Program Files (x86)\Windows Live\Toolbar\wltuser.exe" -Embedding
C:\windows\SysWow64\Macromed\Flash\FlashUtil10d.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding
"C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=1 -AU_DISPLAY_LANG=cs_CZ -AU_LAUNCH_APPID=reader9rdr-cs_CZ
"taskhost.exe"
"C:\totalcmd\TOTALCMD.EXE"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4432 CREDAT:203176
"C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe"
"C:\Program Files (x86)\ICQ7.4\ICQ.exe"
C:\windows\system32\msfeedssync.exe sync
"C:\windows\system32\NOTEPAD.EXE" C:\rsit\info.txt
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe63_ Global\UsGthrCtrlFltPipeMssGthrPipe63 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\rejnao\Desktop\RSITx64.exe"
C:\windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll [2010-09-04 396144]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL [2010-05-14 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-02-11 1246600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll [2010-09-04 396144]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2010-06-21 1018680]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2010-07-23 161304]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2010-07-23 386584]
"Persistence"=C:\windows\system32\igfxpers.exe [2010-07-23 415256]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-11-20 9608224]
"fspuip"=C:\Program Files\FSP\fspuip.exe [2009-12-17 3768832]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-01-26 15026056]
"Badoo Desktop"=C:\ProgramData\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe [2010-10-29 983552]
"Odorik"=C:\Users\rejnao\Desktop\Odorik.exe [2011-03-09 646144]
"ICQ"=C:\Program Files (x86)\ICQ7.4\ICQ.exe [2011-03-15 119608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\windows\SysWow64\Macromed\Flash\FlashUtil10d.exe [2009-10-28 257440]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-03-04 284696]
"MGSysCtrl"=C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2009-08-05 2072576]
"ArcSoft Connection Service"=C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"NortonOnlineBackup"=C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2010-03-06 1112920]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"NeroFilterCheck"=C:\windows\system32\NeroCheck.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2010-07-19 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-03-15 21:56:13 ----D---- C:\Program Files\trend micro
2011-03-15 21:56:10 ----D---- C:\rsit
2011-03-15 21:36:41 ----D---- C:\Program Files (x86)\ICQ6Toolbar
2011-03-15 21:36:40 ----D---- C:\Users\rejnao\AppData\Roaming\Mozilla
2011-03-15 21:36:40 ----D---- C:\ProgramData\ICQ
2011-03-15 21:36:33 ----D---- C:\Users\rejnao\AppData\Roaming\ICQ
2011-03-15 21:36:29 ----D---- C:\Program Files (x86)\ICQ7.4
2011-03-13 18:54:10 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2011-03-13 18:53:31 ----D---- C:\windows\PCHEALTH
2011-03-13 18:53:30 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-03-13 18:52:13 ----D---- C:\Program Files\Microsoft Office
2011-03-13 18:52:09 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-03-13 18:51:15 ----RHD---- C:\MSOCache
2011-03-13 18:41:37 ----SHD---- C:\Config.Msi
2011-03-11 21:01:53 ----A---- C:\windows\SYSWOW64\TwnLib20.dll
2011-03-11 21:01:52 ----N---- C:\windows\SYSWOW64\ImagXRA7.dll
2011-03-11 21:01:52 ----N---- C:\windows\SYSWOW64\ImagXR7.dll
2011-03-11 21:01:52 ----N---- C:\windows\SYSWOW64\ImagXpr7.dll
2011-03-11 21:01:52 ----N---- C:\windows\SYSWOW64\ImagX7.dll
2011-03-11 21:01:52 ----A---- C:\windows\SYSWOW64\NeroCheck.exe
2011-03-11 21:01:48 ----D---- C:\Program Files (x86)\Ahead
2011-03-11 20:38:59 ----D---- C:\totalcmd
2011-03-11 20:38:59 ----A---- C:\windows\UC.PIF
2011-03-11 20:38:59 ----A---- C:\windows\RAR.PIF
2011-03-11 20:38:59 ----A---- C:\windows\PKZIP.PIF
2011-03-11 20:38:59 ----A---- C:\windows\PKUNZIP.PIF
2011-03-11 20:38:59 ----A---- C:\windows\NOCLOSE.PIF
2011-03-11 20:38:59 ----A---- C:\windows\LHA.PIF
2011-03-11 20:38:59 ----A---- C:\windows\ARJ.PIF
2011-03-08 17:53:38 ----D---- C:\ProgramData\Badoo
2011-03-08 17:43:13 ----D---- C:\Users\rejnao\AppData\Roaming\skypePM
2011-03-08 17:42:06 ----RD---- C:\Program Files (x86)\Skype
2011-03-08 17:42:05 ----D---- C:\Users\rejnao\AppData\Roaming\Skype
2011-03-08 17:42:02 ----D---- C:\ProgramData\Skype
2011-03-08 16:33:33 ----D---- C:\Users\rejnao\AppData\Roaming\Macromedia
2011-03-08 16:18:31 ----D---- C:\Users\rejnao\AppData\Roaming\Adobe
2011-03-08 15:29:01 ----D---- C:\Program Files\Symantec
2011-03-08 15:29:01 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-03-08 15:29:01 ----A---- C:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-03-08 15:29:00 ----D---- C:\Users\rejnao\AppData\Roaming\Intel Corporation
2011-03-08 15:28:44 ----D---- C:\Users\rejnao\AppData\Roaming\ArcSoft
2011-03-08 15:28:13 ----D---- C:\Users\rejnao\AppData\Roaming\Identities
2011-03-08 15:26:49 ----D---- C:\ProgramData\Adobe
2011-03-08 15:26:48 ----D---- C:\Program Files (x86)\Adobe
2011-03-08 15:26:17 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-03-08 15:25:54 ----D---- C:\Program Files (x86)\Microsoft Sync Framework
2011-03-08 15:25:12 ----A---- C:\windows\SYSWOW64\d3dx9_32.dll
2011-03-08 15:25:12 ----A---- C:\windows\system32\d3dx9_32.dll
2011-03-08 15:24:44 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-03-08 15:24:00 ----D---- C:\Program Files (x86)\Microsoft
2011-03-08 15:23:47 ----D---- C:\Program Files (x86)\Windows Live SkyDrive
2011-03-08 15:23:42 ----D---- C:\Program Files (x86)\Windows Live
2011-03-08 15:19:32 ----A---- C:\windows\silentOnce.tmp
2011-03-08 15:18:07 ----D---- C:\windows\SoftwareDistribution
2011-03-08 15:16:00 ----SD---- C:\Users\rejnao\AppData\Roaming\Microsoft
2011-03-08 15:16:00 ----D---- C:\Users\rejnao\AppData\Roaming\Media Center Programs
2011-03-08 15:13:09 ----SHD---- C:\Recovery

======List of files/folders modified in the last 1 months======

2011-03-15 21:58:45 ----D---- C:\windows\Temp
2011-03-15 21:56:13 ----RD---- C:\Program Files
2011-03-15 21:36:41 ----RD---- C:\Program Files (x86)
2011-03-15 21:36:40 ----HD---- C:\ProgramData
2011-03-15 21:36:40 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-03-15 16:33:19 ----D---- C:\windows\Prefetch
2011-03-15 14:35:26 ----D---- C:\windows\system32\config
2011-03-15 14:25:31 ----SHD---- C:\System Volume Information
2011-03-15 14:25:21 ----A---- C:\windows\SYSWOW64\log.txt
2011-03-14 13:18:00 ----D---- C:\windows\system32\LogFiles
2011-03-14 12:00:52 ----SD---- C:\ProgramData\Microsoft
2011-03-13 18:56:42 ----SHD---- C:\windows\Installer
2011-03-13 18:56:41 ----D---- C:\ProgramData\Microsoft Help
2011-03-13 18:56:33 ----RSD---- C:\windows\assembly
2011-03-13 18:54:56 ----D---- C:\Program Files (x86)\Microsoft Works
2011-03-13 18:54:55 ----D---- C:\windows\SysWOW64
2011-03-13 18:54:41 ----D---- C:\Program Files (x86)\MSBuild
2011-03-13 18:54:20 ----D---- C:\Program Files (x86)\Microsoft Office
2011-03-13 18:54:09 ----D---- C:\Program Files (x86)\Common Files
2011-03-13 18:54:06 ----D---- C:\windows\ShellNew
2011-03-13 18:53:40 ----RSD---- C:\windows\Fonts
2011-03-13 18:53:31 ----D---- C:\Windows
2011-03-13 18:52:59 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-03-13 18:51:59 ----A---- C:\windows\win.ini
2011-03-12 13:55:16 ----D---- C:\windows\system32\NDF
2011-03-11 23:12:47 ----D---- C:\windows\system32\catroot2
2011-03-11 22:10:52 ----D---- C:\windows\winsxs
2011-03-11 21:49:04 ----D---- C:\windows\system32\catroot
2011-03-11 21:38:16 ----D---- C:\windows\rescache
2011-03-11 21:31:07 ----D---- C:\windows\System32
2011-03-11 21:19:43 ----D---- C:\windows\system32\wdi
2011-03-11 21:18:01 ----D---- C:\Program Files\Windows Sidebar
2011-03-11 21:18:01 ----D---- C:\Program Files\Windows Mail
2011-03-11 21:18:00 ----D---- C:\Program Files\Windows Media Player
2011-03-11 21:18:00 ----D---- C:\Program Files\Windows Journal
2011-03-11 21:18:00 ----D---- C:\Program Files\Internet Explorer
2011-03-11 21:17:59 ----D---- C:\Program Files\Windows Photo Viewer
2011-03-11 21:17:59 ----D---- C:\Program Files\Common Files\System
2011-03-11 21:17:58 ----D---- C:\Program Files\Windows Defender
2011-03-11 21:17:58 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-03-11 21:17:58 ----D---- C:\Program Files (x86)\Windows Mail
2011-03-11 21:17:58 ----D---- C:\Program Files (x86)\Internet Explorer
2011-03-11 21:17:57 ----D---- C:\windows\servicing
2011-03-11 21:17:57 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2011-03-11 21:17:57 ----D---- C:\Program Files (x86)\Windows Media Player
2011-03-11 21:17:57 ----D---- C:\Program Files (x86)\Windows Defender
2011-03-11 21:17:56 ----D---- C:\windows\SYSWOW64\winrm
2011-03-11 21:17:56 ----D---- C:\windows\SYSWOW64\slmgr
2011-03-11 21:17:56 ----D---- C:\windows\SYSWOW64\sk-SK
2011-03-11 21:17:56 ----D---- C:\windows\SYSWOW64\migwiz
2011-03-11 21:17:56 ----D---- C:\windows\SYSWOW64\en
2011-03-11 21:17:56 ----D---- C:\windows\ehome
2011-03-11 21:17:43 ----D---- C:\windows\SYSWOW64\en-US
2011-03-11 21:17:43 ----D---- C:\windows\SYSWOW64\drivers\en-US
2011-03-11 21:17:43 ----D---- C:\windows\SYSWOW64\drivers
2011-03-11 21:17:32 ----D---- C:\windows\SYSWOW64\WCN
2011-03-11 21:17:32 ----D---- C:\windows\SYSWOW64\wbem
2011-03-11 21:17:32 ----D---- C:\windows\SYSWOW64\Printing_Admin_Scripts
2011-03-11 21:17:32 ----D---- C:\windows\SYSWOW64\DriverStore
2011-03-11 21:17:32 ----D---- C:\windows\SYSWOW64\Dism
2011-03-11 21:17:30 ----D---- C:\windows\en-US
2011-03-11 21:17:29 ----D---- C:\windows\system32\winrm
2011-03-11 21:17:29 ----D---- C:\windows\system32\slmgr
2011-03-11 21:17:29 ----D---- C:\windows\system32\oobe
2011-03-11 21:17:29 ----D---- C:\windows\system32\migwiz
2011-03-11 21:17:29 ----D---- C:\windows\system32\Boot
2011-03-11 21:17:29 ----D---- C:\windows\PolicyDefinitions
2011-03-11 21:17:28 ----D---- C:\windows\system32\sysprep
2011-03-11 21:17:28 ----D---- C:\windows\system32\sk-SK
2011-03-11 21:17:28 ----D---- C:\windows\system32\en
2011-03-11 21:17:12 ----D---- C:\windows\system32\en-US
2011-03-11 21:16:57 ----D---- C:\windows\system32\drivers\en-US
2011-03-11 21:16:57 ----D---- C:\windows\system32\drivers
2011-03-11 21:16:56 ----D---- C:\windows\system32\WCN
2011-03-11 21:16:55 ----D---- C:\windows\system32\DriverStore
2011-03-11 21:16:55 ----D---- C:\windows\system32\Dism
2011-03-11 21:16:52 ----D---- C:\windows\system32\Printing_Admin_Scripts
2011-03-11 21:16:50 ----D---- C:\windows\system32\wbem
2011-03-11 21:16:06 ----D---- C:\windows\SYSWOW64\XPSViewer
2011-03-11 21:16:06 ----D---- C:\windows\SYSWOW64\MUI
2011-03-11 21:16:06 ----D---- C:\windows\SYSWOW64\migration
2011-03-11 21:16:05 ----D---- C:\windows\SYSWOW64\hu-HU
2011-03-11 21:15:37 ----D---- C:\windows\SYSWOW64\com
2011-03-11 21:15:37 ----D---- C:\windows\IME
2011-03-11 21:15:36 ----D---- C:\windows\inf
2011-03-11 21:15:34 ----D---- C:\windows\system32\migration
2011-03-11 21:15:34 ----D---- C:\windows\system32\drivers\UMDF
2011-03-11 21:15:32 ----D---- C:\windows\system32\MUI
2011-03-11 21:15:24 ----D---- C:\windows\system32\hu-HU
2011-03-11 21:14:44 ----D---- C:\windows\system32\com
2011-03-11 21:14:44 ----D---- C:\windows\AppPatch
2011-03-11 21:14:14 ----D---- C:\windows\SYSWOW64\lv-LV
2011-03-11 21:13:58 ----D---- C:\windows\system32\lv-LV
2011-03-11 21:13:21 ----D---- C:\windows\SYSWOW64\lt-LT
2011-03-11 21:13:02 ----D---- C:\windows\system32\lt-LT
2011-03-11 21:12:20 ----D---- C:\windows\SYSWOW64\et-EE
2011-03-11 21:12:03 ----D---- C:\windows\system32\et-EE
2011-03-11 21:11:25 ----D---- C:\windows\SYSWOW64\bg-BG
2011-03-11 21:11:04 ----D---- C:\windows\system32\bg-BG
2011-03-11 21:10:14 ----D---- C:\Program Files\DVD Maker
2011-03-11 21:09:05 ----D---- C:\windows\Speech
2011-03-11 17:23:18 ----A---- C:\windows\system32\PerfStringBackup.INI
2011-03-11 16:57:01 ----D---- C:\ProgramData\ArcSoft
2011-03-10 15:51:00 ----D---- C:\windows\Logs
2011-03-09 14:12:17 ----D---- C:\windows\system32\Tasks
2011-03-09 14:07:12 ----D---- C:\windows\system32\drivers\NISx64
2011-03-09 06:11:19 ----D---- C:\windows\debug
2011-03-08 15:51:58 ----D---- C:\windows\Microsoft.NET
2011-03-08 15:29:29 ----D---- C:\ProgramData\Norton
2011-03-08 15:29:01 ----D---- C:\Program Files\Common Files
2011-03-08 15:28:11 ----SHD---- C:\$Recycle.Bin
2011-03-08 15:24:47 ----D---- C:\windows\system32\restore
2011-03-08 15:20:23 ----D---- C:\Utility
2011-03-08 15:16:00 ----RD---- C:\Users
2011-03-08 15:13:18 ----D---- C:\windows\Panther
2011-03-08 15:13:09 ----D---- C:\windows\system32\Recovery

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2010-03-04 540696]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 SymDS;Symantec Data Store; C:\windows\system32\drivers\NISx64\1108000.005\SYMDS64.SYS [2009-10-15 433200]
R0 SymEFA;Symantec Extended File Attributes; C:\windows\system32\drivers\NISx64\1108000.005\SYMEFA64.SYS [2010-04-22 221232]
R1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\BASHDefs\20110309.001\BHDrvx64.sys [2011-02-25 1124472]
R1 ccHP;Symantec Hash Provider; C:\windows\system32\drivers\NISx64\1108000.005\ccHPx64.sys [2010-02-26 615040]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2011-03-08 475696]
R1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\IPSDefs\20110314.001\IDSvia64.sys [2011-02-21 476792]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\windows\system32\drivers\NISx64\1108000.005\SRTSPX64.SYS [2010-04-22 32304]
R1 SymIRON;Symantec Iron Driver; C:\windows\system32\drivers\NISx64\1108000.005\Ironx64.SYS [2010-04-29 150064]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\windows\System32\Drivers\NISx64\1108000.005\SYMTDIV.SYS [2010-05-06 451120]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect; C:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-08 132656]
R3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64; C:\windows\system32\DRIVERS\fspad_wlh64.sys [2009-12-17 53248]
R3 HECIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2010-07-19 10603904]
R3 Impcd;Impcd; C:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2009-11-20 2041376]
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20110315.002\ENG64.SYS [2011-03-08 117880]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20110315.002\EX64.SYS [2011-03-08 1791096]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver; C:\windows\system32\DRIVERS\netr28x.sys [2010-02-08 855328]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040]
R3 SRTSP;Symantec Real Time Storage Protection x64; C:\windows\System32\Drivers\NISx64\1108000.005\SRTSP64.SYS [2010-04-22 505392]
R3 SymEvent;SymEvent; \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS [2011-03-08 173104]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athrx.sys [2009-07-16 1488384]
S3 EUCR;EUCR; C:\windows\system32\DRIVERS\EUCR6SK.SYS [2009-12-04 87888]
S3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64; C:\windows\system32\DRIVERS\fspad_xp64.sys [2009-12-17 53248]
S3 MGHwCtrl;MGHwCtrl; \??\C:\Program Files\msi\msi Software Install\MGHwCtrl.sys []
S3 pciide;pciide; C:\windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-06-21 246584]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-09-30 268824]
R2 Micro Star SCM;Micro Star SCM; C:\Program Files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]
R2 NIS;Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
R2 NOBU;Norton Online Backup; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-03-06 2782552]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

ComboFix 11-03-15.01 - rejnao 15.03.2011 22:37:11.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2926.1667 [GMT 1:00]
Spuštěný z: c:\users\rejnao\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
FW: Norton Internet Security *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
SP: Norton Internet Security *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-15 do 2011-03-15 )))))))))))))))))))))))))))))))
.
.
2011-03-15 21:41 . 2011-03-15 21:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-15 20:56 . 2011-03-15 20:58 -------- d-----w- c:\program files\trend micro
2011-03-15 20:56 . 2011-03-15 20:56 -------- d-----w- C:\rsit
2011-03-15 20:36 . 2011-03-15 20:36 -------- d-----w- c:\program files (x86)\ICQ6Toolbar
2011-03-15 20:36 . 2011-03-15 20:36 -------- d-----w- c:\programdata\ICQ
2011-03-15 20:36 . 2011-03-15 20:36 -------- d-----w- c:\program files (x86)\ICQ7.4
2011-03-13 17:53 . 2011-03-13 17:53 -------- d-----w- c:\windows\PCHEALTH
2011-03-13 17:52 . 2011-03-13 17:52 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-03-13 17:51 . 2011-03-13 17:51 -------- d-----r- C:\MSOCache
2011-03-11 20:01 . 2000-06-26 09:45 106496 ----a-w- c:\windows\SysWow64\TwnLib20.dll
2011-03-11 20:01 . 2011-03-11 20:01 -------- d-----w- c:\program files (x86)\Common Files\Ahead
2011-03-11 20:01 . 2004-07-26 15:16 476320 ------w- c:\windows\SysWow64\ImagXpr7.dll
2011-03-11 20:01 . 2004-07-26 15:16 471040 ------w- c:\windows\SysWow64\ImagXRA7.dll
2011-03-11 20:01 . 2004-07-26 15:16 262144 ------w- c:\windows\SysWow64\ImagXR7.dll
2011-03-11 20:01 . 2004-07-26 15:16 1568768 ------w- c:\windows\SysWow64\ImagX7.dll
2011-03-11 20:01 . 2001-07-09 09:50 155648 ----a-w- c:\windows\SysWow64\NeroCheck.exe
2011-03-11 20:01 . 2011-03-11 20:01 -------- d-----w- c:\program files (x86)\Ahead
2011-03-11 19:38 . 2011-03-11 19:45 -------- d-----w- C:\totalcmd
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2011-03-11 19:38 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
2011-03-10 15:55 . 2011-03-10 15:55 -------- d-sh--we c:\windows\SysWow64\config\systemprofile\Soubory cookie
2011-03-10 15:55 . 2011-03-10 15:55 -------- d-sh--we c:\windows\SysWow64\config\systemprofile\Data aplikací
2011-03-09 09:22 . 2011-03-09 13:06 -------- d-----w- c:\windows\system32\drivers\NISx64\1108000.005
2011-03-08 16:53 . 2011-03-08 16:53 -------- d-----w- c:\programdata\Badoo
2011-03-08 16:42 . 2011-03-08 16:42 -------- d-----r- c:\program files (x86)\Skype
2011-03-08 16:42 . 2011-03-08 16:42 -------- d-----w- c:\program files (x86)\Common Files\Skype
2011-03-08 16:42 . 2011-03-08 16:42 -------- d-----w- c:\programdata\Skype
2011-03-08 15:47 . 2011-03-08 15:47 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2011-03-08 14:29 . 2011-03-08 14:29 -------- d-----w- c:\users\Public\Symantec
2011-03-08 14:29 . 2011-03-08 14:29 173104 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2011-03-08 14:29 . 2011-03-08 14:29 -------- d-----w- c:\program files\Symantec
2011-03-08 14:29 . 2011-03-08 14:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2011-03-08 14:26 . 2011-03-08 14:26 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-03-08 14:26 . 2011-03-13 08:46 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2011-03-08 14:25 . 2011-03-08 14:25 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework
2011-03-08 14:25 . 2006-11-29 12:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-03-08 14:25 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
2011-03-08 14:24 . 2011-03-08 14:24 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2011-03-08 14:24 . 2011-03-08 14:24 -------- d-----w- c:\program files (x86)\Microsoft
2011-03-08 14:23 . 2011-03-08 14:23 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive
2011-03-08 14:23 . 2011-03-08 14:26 -------- d-----w- c:\program files (x86)\Windows Live
2011-03-08 14:22 . 2011-03-08 14:22 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2011-03-08 14:19 . 2011-03-08 14:19 6 ----a-w- c:\windows\silentOnce.tmp
2011-03-08 14:16 . 2011-03-08 14:28 -------- d-----w- c:\users\rejnao
2011-03-08 14:13 . 2011-03-08 14:13 -------- d-----w- C:\Recovery
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"Badoo Desktop"="c:\programdata\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe" [2010-10-29 983552]
"Odorik"="c:\users\rejnao\Desktop\Odorik.exe" [2011-03-09 646144]
"ICQ"="c:\program files (x86)\ICQ7.4\ICQ.exe" [2011-03-15 119608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2009-08-05 2072576]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"NortonOnlineBackup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-03-05 1112920]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [x]
R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\DRIVERS\fspad_xp64.sys [x]
R3 MGHwCtrl;MGHwCtrl;c:\program files\msi\msi Software Install\MGHwCtrl.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1108000.005\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1108000.005\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\BASHDefs\20110309.001\BHDrvx64.sys [2011-02-25 1124472]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NISx64\1108000.005\ccHPx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\IPSDefs\20110314.001\IDSvia64.sys [2011-02-21 476792]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1108000.005\Ironx64.SYS [x]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1108000.005\SYMTDIV.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-06-21 246584]
S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-08 132656]
S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-23 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-23 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-23 415256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-20 9608224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/sm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-fspuip - %ProgramFiles%\FSP\fspuip.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-03-15 22:43:21
ComboFix-quarantined-files.txt 2011-03-15 21:43
.
Před spuštěním: Volných bajtů: 153 722 073 088
Po spuštění: Volných bajtů: 153 848 786 944
.
- - End Of File - - A3AFD15B4438A9CFF1C8DFCD6EAC6B76

Nic nebezpečného není ani zde vidět. Používáte P2P sítě?

ne nepoužívám

V tom případě nevidím nic, co by mohlo odesílat data ve velkém objemu. Ledaže byste je odesílal vy sám.