VIRY.CZ

Ahoj, mám docela problém. V poslední době se mi každfou chvíli ve WIN 7 objeví okno "Problémy s kompatibilitou", tento program není správně nainstalován..přitom třeba je spuštěná hra nebo film jenom! navíc rundll32.exe si bere 50% procesoru z nějakého důvodu. Už jsem osekal programy spuštěné po startu, projel to combofixem ale pořád to dělá. Prosím pomozte:(

V dalším postu přidám log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by ales at 2011-04-14 22:58:32
Microsoft Windows 7 Ultimate
System drive C: has 108 GB (69%) free of 157 GB
Total RAM: 3072 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:58:35, on 14.4.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\VMware\VMware Player\hqtray.exe
D:\UT\System\UnrealTournament.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files\trend micro\ales.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Foxit Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Startup: Dropbox.lnk = C:\Users\ales\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6681 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe"
C:\Windows\SysWOW64\vmnat.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
"C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e0152a1d-1ee9-4666-ab62-8ff5e35a1f86 -SystemEventPortName:HostProcess-ea5f42a7-e6d5-43f5-aeba-ae756513b27c -IoCancelEventPortName:HostProcess-c5b01c5e-76eb-49ae-90cc-0bfaeeff1386 -NonStateChangingEventPortName:HostProcess-ac00059b-9c4a-4f83-8fd1-1e14f3ba456f -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:ca483a13-db50-402c-b688-f8999b8ffd1f
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\VMware\VMware Player\hqtray.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Windows\system32\wuauclt.exe"
"D:\UT\System\UnrealTournament.exe"
C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {5e523e92-346a-4e9a-a41f-e06fedbed079};D:\UT\System\UnrealTournament.exe;940
C:\Windows\system32\svchost.exe -k SDRSVC
"taskhost.exe"
"C:\Windows\system32\notepad.exe"
"C:\Program Files (x86)\Opera\opera.exe"
"C:\Windows\system32\NOTEPAD.EXE" C:\rsit\info.txt
"C:\Users\ales\AppData\Local\Opera\Opera\profile\cache4\temporary_download\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Foxit Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-12-23 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Foxit Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2010-09-28 1400712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-11-18 2919168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CorelDRAW Graphics Suite 11b]
C:\Program Files (x86)\Corel\Corel Graphics 12\Languages\CZ\Programs\Registration.exe [2004-06-23 729088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
c:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [2004-06-16 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray]
C:\Program Files (x86)\VMware\VMware Player\hqtray.exe [2010-09-21 64048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
C:\PROGRA~2\HEWLET~1\DIGITA~1\bin\hpotdd01.exe [2003-04-09 28672]

C:\Users\ales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\ales\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 290304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 2 months======

2011-04-14 20:12:11 ----D---- C:\rsit
2011-04-14 20:12:11 ----D---- C:\Program Files\trend micro
2011-04-14 14:33:16 ----D---- C:\Windows\pss
2011-04-14 14:28:37 ----A---- C:\ComboFix.txt
2011-04-14 14:19:32 ----A---- C:\Windows\SWXCACLS.exe
2011-04-10 18:32:10 ----A---- C:\Windows\zip.exe
2011-04-10 18:32:10 ----A---- C:\Windows\SWSC.exe
2011-04-10 18:32:10 ----A---- C:\Windows\SWREG.exe
2011-04-10 18:32:10 ----A---- C:\Windows\sed.exe
2011-04-10 18:32:10 ----A---- C:\Windows\PEV.exe
2011-04-10 18:32:10 ----A---- C:\Windows\NIRCMD.exe
2011-04-10 18:32:10 ----A---- C:\Windows\MBR.exe
2011-04-10 18:32:10 ----A---- C:\Windows\grep.exe
2011-04-10 16:50:04 ----D---- C:\Windows\ERDNT
2011-04-10 16:49:57 ----D---- C:\Qoobox
2011-04-08 14:46:51 ----D---- C:\Users\ales\AppData\Roaming\Red Alert 3 Uprising
2011-04-06 22:53:49 ----HD---- C:\Windows\AxInstSV
2011-03-25 13:39:16 ----D---- C:\Users\ales\AppData\Roaming\Leadertech
2011-03-25 13:15:04 ----D---- C:\Users\ales\AppData\Roaming\Dropbox
2011-03-20 20:15:59 ----D---- C:\Users\ales\AppData\Roaming\skypePM
2011-03-20 20:14:50 ----D---- C:\Users\ales\AppData\Roaming\Skype
2011-03-20 20:13:44 ----RD---- C:\Program Files (x86)\Skype
2011-03-20 20:13:31 ----D---- C:\ProgramData\Skype
2011-03-17 23:58:56 ----D---- C:\Users\ales\AppData\Roaming\calibre
2011-03-17 23:57:53 ----D---- C:\Program Files (x86)\Calibre2
2011-03-09 08:18:40 ----A---- C:\Windows\system32\EncDec.dll
2011-03-09 08:18:40 ----A---- C:\Windows\system32\CPFilters.dll
2011-03-09 08:18:39 ----A---- C:\Windows\SYSWOW64\EncDec.dll
2011-03-09 08:18:39 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2011-03-09 08:18:39 ----A---- C:\Windows\system32\sbe.dll
2011-03-09 08:18:38 ----A---- C:\Windows\SYSWOW64\sbe.dll
2011-03-09 08:18:35 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2011-03-09 08:18:35 ----A---- C:\Windows\system32\mstscax.dll
2011-03-09 08:18:34 ----A---- C:\Windows\SYSWOW64\mstsc.exe
2011-03-09 08:18:34 ----A---- C:\Windows\system32\mstsc.exe
2011-03-06 22:39:03 ----D---- C:\Users\ales\AppData\Roaming\dvdcss
2011-03-05 00:18:14 ----D---- C:\Users\ales\AppData\Roaming\VMware
2011-03-05 00:04:09 ----D---- C:\Program Files (x86)\ESET
2011-03-04 13:59:05 ----A---- C:\Windows\system32\drivers\vmci.sys
2011-03-04 13:58:59 ----A---- C:\Windows\system32\drivers\vmx86.sys
2011-03-04 13:58:59 ----A---- C:\Windows\system32\drivers\VMparport.sys
2011-03-04 13:58:20 ----A---- C:\Windows\SYSWOW64\vmnetdhcp.exe
2011-03-04 13:58:16 ----A---- C:\Windows\SYSWOW64\vmnat.exe
2011-03-04 13:58:16 ----A---- C:\Windows\system32\drivers\vmnetuserif.sys
2011-03-04 13:58:10 ----A---- C:\Windows\system32\vnetlib64.dll
2011-03-04 13:57:16 ----A---- C:\Windows\system32\drivers\VMkbd.sys
2011-03-04 13:57:13 ----A---- C:\Windows\system32\drivers\hcmon.sys
2011-03-04 13:56:29 ----D---- C:\ProgramData\VMware
2011-03-04 13:56:29 ----D---- C:\Program Files (x86)\VMware
2011-03-04 00:40:03 ----A---- C:\Windows\SYSWOW64\msxml4a.dll
2011-03-04 00:40:02 ----D---- C:\Program Files (x86)\TeXnicCenter
2011-03-04 00:09:18 ----D---- C:\texlive
2011-03-02 22:02:14 ----ASH---- C:\pagefile.sys
2011-03-02 01:37:21 ----D---- C:\Users\ales\AppData\Roaming\Hewlett-Packard
2011-03-02 01:32:18 ----D---- C:\Program Files (x86)\Hewlett-Packard
2011-03-02 01:31:32 ----D---- C:\temp
2011-02-28 00:25:32 ----D---- C:\Windows\vf_hip
2011-02-28 00:25:32 ----D---- C:\Program Files (x86)\Hide IP Platinum

======List of files/folders modified in the last 2 months======

2011-04-14 22:29:32 ----D---- C:\Windows\Temp
2011-04-14 22:07:30 ----SHD---- C:\Windows\Installer
2011-04-14 20:12:11 ----RD---- C:\Program Files
2011-04-14 18:33:27 ----AD---- C:\ProgramData\TEMP
2011-04-14 17:31:36 ----D---- C:\Users\ales\AppData\Roaming\FileZilla
2011-04-14 16:00:22 ----D---- C:\Windows\system32\config
2011-04-14 14:33:16 ----D---- C:\Windows
2011-04-14 14:26:42 ----A---- C:\Windows\system.ini
2011-04-14 14:24:41 ----D---- C:\Windows\SYSWOW64\drivers
2011-04-14 14:24:41 ----D---- C:\Windows\SysWOW64
2011-04-14 14:24:41 ----D---- C:\Windows\system32\drivers
2011-04-14 14:24:41 ----D---- C:\Windows\System32
2011-04-14 14:24:41 ----D---- C:\Windows\AppPatch
2011-04-14 14:24:39 ----D---- C:\Program Files\Common Files
2011-04-14 14:24:39 ----D---- C:\Program Files (x86)\Common Files
2011-04-14 10:34:44 ----D---- C:\Windows\inf
2011-04-14 10:34:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-04-14 10:28:26 ----D---- C:\ProgramData\NVIDIA
2011-04-13 22:07:45 ----D---- C:\Windows\system32\Tasks
2011-04-12 17:39:05 ----SHD---- C:\System Volume Information
2011-04-10 18:38:57 ----D---- C:\Windows\system32\drivers\etc
2011-04-10 18:38:40 ----D---- C:\Program Files (x86)\TNod User & Password Finder
2011-04-10 18:32:17 ----D---- C:\Windows\Prefetch
2011-04-10 17:05:03 ----D---- C:\Windows\system32\catroot2
2011-04-02 23:02:12 ----A---- C:\Users\ales\AppData\Roaming\myMPQ.ini
2011-03-25 13:35:29 ----RSD---- C:\Windows\assembly
2011-03-25 00:25:01 ----D---- C:\Windows\system32\catroot
2011-03-23 21:15:53 ----D---- C:\Windows\system32\NDF
2011-03-21 08:41:36 ----D---- C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 11
2011-03-20 20:16:08 ----D---- C:\ProgramData
2011-03-20 20:13:44 ----RD---- C:\Program Files (x86)
2011-03-17 23:58:37 ----D---- C:\Windows\winsxs
2011-03-09 09:37:25 ----D---- C:\ProgramData\Microsoft Help
2011-03-04 13:58:26 ----D---- C:\Windows\system32\DriverStore
2011-03-04 13:57:02 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-03-02 01:32:31 ----A---- C:\Windows\win.ini
2011-02-28 00:28:12 ----SD---- C:\Users\ales\AppData\Roaming\Microsoft
2011-02-28 00:28:12 ----SD---- C:\ProgramData\Microsoft
2011-02-22 01:12:33 ----RD---- C:\Users
2011-02-16 07:41:05 ----D---- C:\Windows\system32\wdi
2011-02-16 01:16:39 ----D---- C:\Users\ales\AppData\Roaming\vlc

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-23 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-07-29 141264]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-09-03 170104]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-07-29 171152]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-07-29 50624]
R2 hcmon;VMware hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [2010-09-21 38448]
R2 vmci;VMware vmci; \??\C:\Windows\system32\drivers\vmci.sys [2010-09-21 80944]
R2 VMnetBridge;VMware Bridge Protocol; C:\Windows\system32\DRIVERS\vmnetbridge.sys [2010-09-21 45104]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\Windows\system32\drivers\vmnetuserif.sys [2010-09-21 30256]
R2 VMparport;VMware VMparport; \??\C:\Windows\system32\drivers\VMparport.sys [2010-09-21 30768]
R2 vmx86;VMware vmx86; \??\C:\Windows\system32\drivers\vmx86.sys [2010-09-21 68656]
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys [2010-08-19 32816]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-07-29 33632]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
R3 vmkbd;VMware kbd; \??\C:\Windows\system32\drivers\VMkbd.sys [2010-09-21 31792]
R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys [2010-09-21 20016]
S3 ax09xrzu;ax09xrzu; C:\Windows\system32\drivers\ax09xrzu.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 vmusb;VMware USB Client Driver; C:\Windows\System32\Drivers\vmusb.sys [2010-09-21 37680]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2010-11-18 810144]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2010-10-16 989800]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [2010-09-21 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\Windows\syswow64\vmnetdhcp.exe [2010-09-21 334384]
R2 VMUSBArbService;VMware USB Arbitration Service; C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
R2 VMware NAT Service;VMware NAT Service; C:\Windows\syswow64\vmnat.exe [2010-09-21 404016]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-11-18 42360]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ufad-ws60;VMware Agent Service; C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe [2010-08-19 191024]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-12-24 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Tady je, dekuju predem:(

ComboFix 11-04-13.06 - ales 15.04.2011 0:12.3.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3072.1210 [GMT 2:00]
Spuštěný z: c:\users\ales\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-14 do 2011-04-14 )))))))))))))))))))))))))))))))
.
.
2011-04-14 22:17 . 2011-04-14 22:17 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-04-14 22:17 . 2011-04-14 22:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-14 22:17 . 2011-04-14 22:17 -------- d-----w- c:\users\cizi\AppData\Local\temp
2011-04-14 18:12 . 2011-04-14 20:58 -------- d-----w- c:\program files\trend micro
2011-04-14 18:12 . 2011-04-14 18:12 -------- d-----w- C:\rsit
2011-04-12 15:39 . 2011-03-15 05:17 8424784 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA44D773-9104-4E0F-8B3A-D3B912F228F2}\mpengine.dll
2011-04-08 12:46 . 2011-04-08 12:51 -------- d-----w- c:\users\ales\AppData\Roaming\Red Alert 3 Uprising
2011-04-06 20:53 . 2011-04-06 20:55 -------- d--h--w- c:\windows\AxInstSV
2011-03-28 22:47 . 2011-03-28 22:47 -------- d-----w- c:\users\ales\preezzii
2011-03-25 11:39 . 2011-03-25 11:39 -------- d-----w- c:\users\ales\AppData\Roaming\Leadertech
2011-03-25 11:15 . 2011-04-14 10:25 -------- d-----w- c:\users\ales\AppData\Roaming\Dropbox
2011-03-24 17:20 . 2011-03-24 17:20 -------- d-----w- c:\users\cizi\AppData\Roaming\Corel
2011-03-24 06:02 . 2011-03-24 06:02 -------- d-----w- c:\users\cizi\AppData\Roaming\NVIDIA
2011-03-24 06:01 . 2011-03-24 06:01 -------- d-----w- c:\users\cizi\AppData\Local\Ascaron Entertainment
2011-03-20 18:15 . 2011-04-04 17:35 -------- d-----w- c:\users\ales\AppData\Roaming\skypePM
2011-03-20 18:14 . 2011-04-04 17:57 -------- d-----w- c:\users\ales\AppData\Roaming\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----w- c:\program files (x86)\Common Files\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----r- c:\program files (x86)\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----w- c:\programdata\Skype
2011-03-17 22:06 . 2011-03-17 22:06 -------- d-----w- c:\users\ales\retorika, Moderni
2011-03-17 21:59 . 2011-04-03 09:37 -------- d-----w- c:\users\ales\Calibre knihovna
2011-03-17 21:58 . 2011-03-17 22:01 -------- d-----w- c:\users\ales\AppData\Roaming\calibre
2011-03-17 21:57 . 2011-03-17 21:58 -------- d-----w- c:\program files (x86)\Calibre2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:11 . 2010-12-23 17:22 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-30 15:31 . 2011-01-30 15:31 419840 ----a-w- c:\windows\system32\wrap_oal.dll
2011-01-30 15:31 . 2011-01-30 15:31 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-01-30 15:31 . 2011-01-30 15:31 133632 ----a-w- c:\windows\system32\OpenAL32.dll
2011-01-30 15:31 . 2011-01-30 15:31 110592 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-10_16.39.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-23 17:06 . 2011-04-14 08:30 31598 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-04-13 21:06 31354 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-04-09 06:18 31354 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-12-23 16:44 . 2011-04-14 12:32 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-23 16:44 . 2011-04-07 17:52 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-23 16:44 . 2011-04-07 17:52 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-12-23 16:44 . 2011-04-14 12:32 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-04-14 12:32 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-04-07 17:52 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-23 20:14 . 2011-04-10 16:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-23 20:14 . 2011-04-14 22:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-23 20:14 . 2011-04-10 16:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-23 20:14 . 2011-04-14 22:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-23 16:49 . 2011-04-13 21:06 9662 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3472066644-2925166866-4189672384-1000_UserData.bin
+ 2011-04-14 08:28 . 2011-04-14 08:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-04-10 16:28 . 2011-04-10 16:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-04-14 08:28 . 2011-04-14 08:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-04-10 16:28 . 2011-04-10 16:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-04-14 08:34 654818 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-04-10 16:33 654818 c:\windows\system32\perfh009.dat
- 2009-07-14 15:18 . 2011-04-10 16:33 669074 c:\windows\system32\perfh005.dat
+ 2009-07-14 15:18 . 2011-04-14 08:34 669074 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-04-10 16:33 122276 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-04-14 08:34 122276 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-04-14 08:34 141296 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-04-10 16:33 141296 c:\windows\system32\perfc005.dat
+ 2009-07-14 05:01 . 2011-04-13 19:33 406636 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-04-09 23:39 406636 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2010-12-24 08:56 . 2011-04-10 16:09 2983936 c:\windows\Installer\15b537.msi
+ 2010-12-24 08:56 . 2011-04-14 20:07 2983936 c:\windows\Installer\15b537.msi
- 2009-07-14 02:34 . 2011-04-10 15:04 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-04-14 14:00 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2011-02-12 23:00 . 2011-04-13 19:33 17112112 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3472066644-2925166866-4189672384-1000-8192.dat
- 2011-02-12 23:00 . 2011-04-09 23:39 17112112 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3472066644-2925166866-4189672384-1000-8192.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 21:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
c:\users\ales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ales\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-3-31 23360040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2010-11-18 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-11-18 2919168]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\VMware\VMware Player\vsocklib.dll
FF - ProfilePath - c:\users\ales\AppData\Roaming\Mozilla\Firefox\Profiles\u2u1bwwy.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-15 00:19:22
ComboFix-quarantined-files.txt 2011-04-14 22:19
ComboFix2.txt 2011-04-14 12:28
ComboFix3.txt 2011-04-10 16:40
.
Před spuštěním: Volných bajtů: 114 688 303 104
Po spuštění: Volných bajtů: 114 506 539 008
.
- - End Of File - - 13696932DEA60C064D7B93D8D5D92D17

Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files (x86)\Ask.com

Registry::
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Dík moc, tady je nový log (bez infa o snapshotu):


ComboFix 11-04-13.06 - ales 15.04.2011 22:06:41.4.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3072.1465 [GMT 2:00]
Spuštěný z: c:\users\ales\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\ales\Desktop\CFScript.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Ask.com
c:\program files (x86)\Ask.com\cb_fd94.ico
c:\program files (x86)\Ask.com\cobrand.ico
c:\program files (x86)\Ask.com\config.xml
c:\program files (x86)\Ask.com\favicon.ico
c:\program files (x86)\Ask.com\fv_ca5e.ico
c:\program files (x86)\Ask.com\GenericAskToolbar.dll
c:\program files (x86)\Ask.com\mupcfg.xml
c:\program files (x86)\Ask.com\SaUpdate.exe
c:\program files (x86)\Ask.com\UpdateTask.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-15 do 2011-04-15 )))))))))))))))))))))))))))))))
.
.
2011-04-15 20:11 . 2011-04-15 20:11 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-04-15 20:11 . 2011-04-15 20:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-15 20:11 . 2011-04-15 20:11 -------- d-----w- c:\users\cizi\AppData\Local\temp
2011-04-15 18:03 . 2011-03-15 05:17 8424784 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89FF4C66-7CE2-4DD9-ADB3-9F1BBBA228B9}\mpengine.dll
2011-04-15 05:32 . 2011-02-18 06:37 612352 ----a-w- c:\windows\system32\vbscript.dll
2011-04-15 05:32 . 2011-02-18 05:36 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-04-15 05:32 . 2011-03-03 03:58 3133440 ----a-w- c:\windows\system32\win32k.sys
2011-04-15 05:32 . 2011-03-11 06:19 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2011-04-15 05:32 . 2011-03-11 06:19 1395712 ----a-w- c:\windows\system32\mfc42.dll
2011-04-15 05:32 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
2011-04-14 18:12 . 2011-04-14 20:58 -------- d-----w- c:\program files\trend micro
2011-04-14 18:12 . 2011-04-14 18:12 -------- d-----w- C:\rsit
2011-04-08 12:46 . 2011-04-08 12:51 -------- d-----w- c:\users\ales\AppData\Roaming\Red Alert 3 Uprising
2011-04-06 20:53 . 2011-04-06 20:55 -------- d--h--w- c:\windows\AxInstSV
2011-03-28 22:47 . 2011-03-28 22:47 -------- d-----w- c:\users\ales\preezzii
2011-03-25 11:39 . 2011-03-25 11:39 -------- d-----w- c:\users\ales\AppData\Roaming\Leadertech
2011-03-25 11:15 . 2011-04-15 19:21 -------- d-----w- c:\users\ales\AppData\Roaming\Dropbox
2011-03-24 17:20 . 2011-03-24 17:20 -------- d-----w- c:\users\cizi\AppData\Roaming\Corel
2011-03-24 06:02 . 2011-03-24 06:02 -------- d-----w- c:\users\cizi\AppData\Roaming\NVIDIA
2011-03-24 06:01 . 2011-03-24 06:01 -------- d-----w- c:\users\cizi\AppData\Local\Ascaron Entertainment
2011-03-20 18:15 . 2011-04-04 17:35 -------- d-----w- c:\users\ales\AppData\Roaming\skypePM
2011-03-20 18:14 . 2011-04-04 17:57 -------- d-----w- c:\users\ales\AppData\Roaming\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----w- c:\program files (x86)\Common Files\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----r- c:\program files (x86)\Skype
2011-03-20 18:13 . 2011-03-20 18:13 -------- d-----w- c:\programdata\Skype
2011-03-17 22:06 . 2011-03-17 22:06 -------- d-----w- c:\users\ales\retorika, Moderni
2011-03-17 21:59 . 2011-04-03 09:37 -------- d-----w- c:\users\ales\Calibre knihovna
2011-03-17 21:58 . 2011-03-17 22:01 -------- d-----w- c:\users\ales\AppData\Roaming\calibre
2011-03-17 21:57 . 2011-03-17 21:58 -------- d-----w- c:\program files (x86)\Calibre2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:11 . 2010-12-23 17:22 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-30 15:31 . 2011-01-30 15:31 419840 ----a-w- c:\windows\system32\wrap_oal.dll
2011-01-30 15:31 . 2011-01-30 15:31 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-01-30 15:31 . 2011-01-30 15:31 133632 ----a-w- c:\windows\system32\OpenAL32.dll
2011-01-30 15:31 . 2011-01-30 15:31 110592 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.

.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
c:\users\ales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ales\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-3-31 23360040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2010-11-18 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-21 539184]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 97792 ----a-w- c:\users\ales\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-11-18 2919168]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\VMware\VMware Player\vsocklib.dll
FF - ProfilePath - c:\users\ales\AppData\Roaming\Mozilla\Firefox\Profiles\u2u1bwwy.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-15 22:13:59
ComboFix-quarantined-files.txt 2011-04-15 20:13
ComboFix2.txt 2011-04-14 22:19
ComboFix3.txt 2011-04-14 12:28
ComboFix4.txt 2011-04-10 16:40
.
Před spuštěním: Volných bajtů: 113 877 442 560
Po spuštění: Volných bajtů: 113 949 310 976
.
- - End Of File - - 56728B6A29369C74EF490763D902FB37

Smazáno, log již vypadá čistý. Nastala nějaká změna?

JJ, uz se to chova normalne...diky mockrat:)

Rádo se stalo!

Tak opět bojuju s problémem:( Můžete mi prosím někdo pomoci? Díky moc..

Log jsme dal na dropbox, abzch tu nemusel zabrat vice nez tri prispevky:(
http://dl.dropbox.com/u/24258828/combofix.txt

Především odinstalujte cracklý NOD a použijte některé free řešení: http://www.viry.cz/forum/viewforum.php?f=29 . Něco CF smazal, zbytek logu vypadá čistý. Nastala nějaká změna?

Díky moc..asi zkusím Aviru a Zone Alarm...zatím to už vypadá lépe..díky moc..

Nemáte zač!