VIRY.CZ

Zdravím jen prevemce děkuji..)))

Logfile of random's system information tool 1.08 (written by random/random)
Run by Libas at 2011-05-06 10:04:31
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 206 GB (88%) free of 234 GB
Total RAM: 1023 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:04:59, on 6.5.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Users\Libas\Desktop\RSIT.exe
C:\Program Files\trend micro\Libas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: IEH - Sysinternals - www.sysinternals.com - C:\Users\Libas\AppData\Local\Temp\IEH.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TZIXZ - Sysinternals - www.sysinternals.com - C:\Users\Libas\AppData\Local\Temp\TZIXZ.exe
O23 - Service: WDUGWPGAV - Sysinternals - www.sysinternals.com - C:\Users\Libas\AppData\Local\Temp\WDUGWPGAV.exe

--
End of file - 6327 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GlaryInitialize.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-27 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-05-09 142896]
{312105C4-2E13-4E10-AF72-F9D79BA077E6}
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-02-28 1089288]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenuEx"=C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [2010-04-02 1185112]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-04-18 3460784]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-05-02 2560840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoSecCpl"=0
"DisableChangePassword"=0
"DisableLockWorkstation"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=255
"NoStartMenuPinnedList"=0
"NoStartMenuMFUprogramsList"=0
"NoUserNameInStartMenu"=0
"NoStartMenuSubFolders"=0
"NoCommonGroups"=0
"NoPrinterTabs"=0
"NoDeletePrinter"=0
"NoAddPrinter"=0
"NoPrinters"=0
"NoFavoritesMenu"=0
"NoRecentDocsNetHood"=0
"NoChangeAnimation"=0
"NoChangeKeyboardNavigationIndicators"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption"
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-05-06 10:04:31 ----D---- C:\rsit
2011-05-06 10:04:31 ----D---- C:\Program Files\trend micro
2011-05-06 09:58:27 ----A---- C:\msimg32.dll
2011-05-06 09:58:26 ----A---- C:\SensApi.dll
2011-05-05 19:03:26 ----D---- C:\Program Files\ESET
2011-05-05 17:45:47 ----HD---- C:\VritualRoot
2011-05-05 17:41:51 ----D---- C:\Program Files\COMODO
2011-05-05 17:39:59 ----D---- C:\ProgramData\Comodo
2011-05-05 17:39:06 ----D---- C:\ProgramData\Comodo Downloader
2011-05-05 15:31:00 ----D---- C:\Program Files\ATI Technologies
2011-05-05 15:30:58 ----D---- C:\Program Files\ATI
2011-05-05 13:11:16 ----A---- C:\RootRepeal report 05-05-11 (13-11-16).txt
2011-05-05 13:10:44 ----A---- C:\RootRepeal report 05-05-11 (13-10-44).txt
2011-05-05 12:41:57 ----D---- C:\ProgramData\SecTaskMan
2011-05-05 11:18:38 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-05-05 11:18:37 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-05-05 11:18:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-05-05 11:18:25 ----A---- C:\Windows\system32\aswBoot.exe
2011-05-05 11:18:22 ----D---- C:\ProgramData\AVAST Software
2011-05-05 11:18:22 ----D---- C:\Program Files\AVAST Software
2011-05-03 10:37:17 ----SHD---- C:\$RECYCLE.BIN
2011-05-02 20:36:36 ----A---- C:\Windows\system32\drivers\inspect.sys
2011-05-02 20:36:34 ----A---- C:\Windows\system32\drivers\cmdhlp.sys
2011-05-02 20:36:32 ----A---- C:\Windows\system32\drivers\cmdGuard.sys
2011-05-02 20:36:32 ----A---- C:\Windows\system32\drivers\cmderd.sys
2011-05-02 20:36:04 ----A---- C:\Windows\system32\guard32.dll
2011-04-30 09:04:08 ----D---- C:\Program Files\Plane Arcade
2011-04-27 09:54:48 ----D---- C:\Program Files\Common Files\Java
2011-04-27 09:54:33 ----A---- C:\Windows\system32\javaws.exe
2011-04-27 09:54:33 ----A---- C:\Windows\system32\javaw.exe
2011-04-27 09:54:32 ----A---- C:\Windows\system32\java.exe
2011-04-27 09:43:14 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2011-04-27 09:43:14 ----A---- C:\Windows\system32\Apphlpdm.dll
2011-04-27 09:43:11 ----A---- C:\Windows\system32\XpsPrint.dll
2011-04-13 13:59:36 ----A---- C:\Windows\system32\mfc42u.dll
2011-04-13 13:59:35 ----A---- C:\Windows\system32\mfc42.dll
2011-04-13 13:59:34 ----A---- C:\Windows\system32\atmfd.dll
2011-04-13 13:59:33 ----A---- C:\Windows\system32\atmlib.dll
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnsapi.dll
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srv.sys
2011-04-13 13:59:17 ----A---- C:\Windows\system32\win32k.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-04-13 13:59:14 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-04-13 13:59:12 ----A---- C:\Windows\system32\inetcomm.dll
2011-04-08 15:35:32 ----ASH---- C:\hiberfil.sys
2011-04-08 14:05:40 ----D---- C:\Users\Libas\AppData\Roaming\eSobi
2011-04-07 12:46:55 ----D---- C:\ProgramData\vsosdk

======List of files/folders modified in the last 1 months======

2011-05-06 10:04:35 ----D---- C:\Windows\temp
2011-05-06 10:04:31 ----RD---- C:\Program Files
2011-05-06 10:03:46 ----D---- C:\Windows\System32
2011-05-06 10:03:46 ----D---- C:\Windows\inf
2011-05-06 10:03:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-05-06 09:57:31 ----D---- C:\Windows
2011-05-06 09:48:50 ----SHD---- C:\Windows\Installer
2011-05-05 17:43:09 ----D---- C:\Windows\system32\drivers
2011-05-05 17:43:06 ----D---- C:\Windows\system32\catroot
2011-05-05 17:39:59 ----D---- C:\ProgramData
2011-05-05 15:33:18 ----RSD---- C:\Windows\assembly
2011-05-05 15:32:45 ----SD---- C:\Users\Libas\AppData\Roaming\Microsoft
2011-05-05 15:32:22 ----D---- C:\Windows\winsxs
2011-05-05 14:57:36 ----SD---- C:\ProgramData\Microsoft
2011-05-05 12:49:20 ----D---- C:\ProgramData\Adobe
2011-05-05 12:49:17 ----D---- C:\Program Files\Common Files\Adobe
2011-05-05 12:46:55 ----D---- C:\ProgramData\Microsoft Help
2011-05-05 12:45:15 ----D---- C:\Program Files\Canon
2011-05-05 12:38:42 ----D---- C:\Windows\Prefetch
2011-05-05 11:18:25 ----D---- C:\Program Files\Windows Sidebar
2011-05-05 09:35:16 ----D---- C:\Program Files\Mozilla Firefox
2011-05-03 11:12:45 ----D---- C:\ProgramData\CanonIJPLM
2011-04-27 09:55:13 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-04-27 09:54:48 ----D---- C:\Program Files\Common Files
2011-04-27 09:54:19 ----A---- C:\Windows\system32\deployJava1.dll
2011-04-27 09:49:55 ----D---- C:\Program Files\CCleaner
2011-04-27 09:47:57 ----D---- C:\Windows\Debug
2011-04-27 09:45:52 ----D---- C:\Windows\AppPatch
2011-04-27 09:43:00 ----D---- C:\Windows\system32\catroot2
2011-04-26 11:59:15 ----SHD---- C:\System Volume Information
2011-04-24 11:10:03 ----D---- C:\Users\Libas\AppData\Roaming\Vso
2011-04-23 18:43:54 ----D---- C:\Users\Libas\AppData\Roaming\Macromedia
2011-04-23 09:01:56 ----D---- C:\Program Files\Microsoft Silverlight
2011-04-20 16:34:47 ----D---- C:\Windows\ERDNT
2011-04-20 16:23:04 ----A---- C:\Windows\system.ini
2011-04-20 16:22:57 ----D---- C:\Windows\system32\drivers\etc
2011-04-20 16:20:49 ----D---- C:\Windows\system32\config
2011-04-18 15:46:44 ----A---- C:\Windows\system32\mrt.exe
2011-04-18 10:24:29 ----D---- C:\Users\Libas\AppData\Roaming\Canon
2011-04-13 17:29:33 ----D---- C:\Windows\Microsoft.NET
2011-04-13 14:14:51 ----D---- C:\Program Files\Windows Mail
2011-04-08 14:17:45 ----D---- C:\ProgramData\CyberLink
2011-04-08 14:17:45 ----D---- C:\Program Files\Windows Media Player
2011-04-08 14:17:45 ----D---- C:\Program Files\Microsoft Visual Studio 8
2011-04-08 14:17:45 ----D---- C:\Program Files\Acer Inc

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-24 14392]
R0 eLock2BurnerLockDriver;Disk Performance Monitor Filter Driver; C:\Windows\system32\DRIVERS\eLock2BurnerLockDriver.sys [2008-01-10 22048]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2008-05-09 18992]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-04-18 25432]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-04-18 441176]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-04-18 307288]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-04-18 49240]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-05-02 238960]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-05-02 36568]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-05-02 81888]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-04-18 19544]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver; C:\Windows\system32\DRIVERS\eLock2FSCTLDriver.sys [2008-01-23 86048]
R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2008-10-07 15392]
R2 PSDNServ;PSDNServ; C:\Windows\system32\drivers\PSDNServ.sys [2008-05-09 16944]
R2 psdvdisk;PSDVdisk; C:\Windows\system32\drivers\psdvdisk.sys [2008-05-09 60464]
R2 tvicport;tvicport; \??\C:\Windows\system32\drivers\tvicport.sys [2008-10-07 14544]
R2 zntport;zntport; \??\C:\Windows\system32\drivers\zntport.sys [2008-10-07 6080]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-14 2427392]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-11-30 3317800]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-06-22 47360]
R3 Ph3xIB32;Philips 713x VU PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2010-09-23 313632]
S1 MpKsl055b5493;MpKsl055b5493; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8F30275-5CD8-4AA4-97E7-97467FC33068}\MpKsl055b5493.sys []
S1 MpKsl18f03bab;MpKsl18f03bab; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9CF395F7-5850-4E34-8548-A908E399BE7D}\MpKsl18f03bab.sys []
S1 MpKsl30fafffe;MpKsl30fafffe; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4A01F54D-3544-45FB-835F-F7E106C54631}\MpKsl30fafffe.sys []
S1 MpKsl33b694c5;MpKsl33b694c5; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DC211060-5137-4660-8490-E02D5EDFF968}\MpKsl33b694c5.sys []
S1 MpKslab7dd8ea;MpKslab7dd8ea; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B81295AA-CE13-46BA-99DC-6F8480A1C67D}\MpKslab7dd8ea.sys []
S1 MpKsleae1866a;MpKsleae1866a; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4EED1F94-BCA3-429F-B617-0E34C1EF56EF}\MpKsleae1866a.sys []
S1 MpKslfe3959bf;MpKslfe3959bf; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{09D14A32-A911-458F-8763-80E2ED422F5C}\MpKslfe3959bf.sys []
S1 SuperMounter;SuperMounter; C:\Windows\system32\drivers\SuperMounter.sys []
S3 amdiox86;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox86.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-05-10 6144]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-03-14 569344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-04-18 42184]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-05-02 1779280]
R2 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-05-09 500784]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-04-09 24576]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2010-04-05 116104]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AcerMemUsageCheckService;ePerformance Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2007-10-17 28672]
S3 BBSvc;Bing Bar Update Service; C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
S3 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-09-10 57344]
S3 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2008-11-03 24576]
S3 IEH;IEH; C:\Users\Libas\AppData\Local\Temp\IEH.exe [2011-05-05 379776]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-04-09 143360]
S3 TZIXZ;TZIXZ; C:\Users\Libas\AppData\Local\Temp\TZIXZ.exe [2011-05-05 486272]
S3 WDUGWPGAV;WDUGWPGAV; C:\Users\Libas\AppData\Local\Temp\WDUGWPGAV.exe [2011-05-05 416640]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
S4 Acer TV Share Service;Acer TV Share Service; C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S4 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]

-----------------EOF-----------------

Zdravím, tyhle zbytečnosti fixni v HJT :

O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)

HJT najdeš zde :

C:\Program Files\trend micro\Libas.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

Cyberlink RichVideo Service

TZIXZ

WDUGWPGAV

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!

zdravím....))chtěl bych se zeptat,jak se dá vypnout zjišťování sítě a sdílení souborů v Comodo Firewall 5.4.189068.1354..když to vypnu tak se my zapne brána Windows firewall..viz příspěvek.. díky za rady..))

Malwarebytes' Anti-Malware 1.50.1.1100
http://www.malwarebytes.org

Verze databáze: 6524

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

7.5.2011 10:18:33
mbam-log-2011-05-07 (10-18-33).txt

Typ kontroly: Úplný test (A:\|C:\|D:\|E:\|G:\|H:\|I:\|J:\|)
Testované objekty: 348176
Uplynulý čas: 1 hodin, 13 minut, 49 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Proč to chceš vypnout ?


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

než jsem si nainstaloval Comodo firewall,tak to bylo vypnutý-jenom,kdybych věděl jak se to vypíná v cfw-byl bych moc vděčný...)))díky

ComboFix 11-05-06.04 - Libas 07.05.2011 11:26:23.1.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.1023.307 [GMT 2:00]
Spuštěný z: c:\users\Libas\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-07 do 2011-05-07 )))))))))))))))))))))))))))))))
.
.
2011-05-07 09:37 . 2011-05-07 09:37 -------- d-----w- c:\users\Libas\AppData\Local\temp
2011-05-07 09:15 . 2008-05-09 21:08 10752 ----a-w- C:\SensApi.dll
2011-05-07 09:15 . 2008-05-09 21:05 16384 ----a-w- C:\msimg32.dll
2011-05-06 11:14 . 2011-05-06 11:45 -------- d-----w- c:\programdata\Comodo
2011-05-06 10:01 . 2011-05-06 10:01 20922 ----a-w- c:\windows\cscmondump.bin
2011-05-06 08:59 . 2011-05-06 09:02 -------- d-----w- c:\program files\Wise Registry Cleaner
2011-05-06 08:04 . 2011-05-06 08:05 -------- d-----w- C:\rsit
2011-05-06 08:04 . 2011-05-06 08:04 -------- d-----w- c:\program files\trend micro
2011-05-06 07:45 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9BBB1F1E-A910-4553-903F-AAC2085DAD93}\mpengine.dll
2011-05-05 15:41 . 2011-05-06 11:15 -------- d-----w- c:\program files\COMODO
2011-05-05 13:31 . 2011-05-05 13:32 -------- d-----w- c:\program files\ATI Technologies
2011-05-05 13:30 . 2011-05-05 13:30 -------- d-----w- c:\program files\ATI
2011-05-05 13:26 . 2011-05-05 13:26 -------- d-----w- c:\users\Libas\AppData\Local\Apps
2011-05-05 10:41 . 2011-05-05 11:24 -------- d-----w- c:\programdata\SecTaskMan
2011-05-05 09:18 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-05 09:18 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-05 09:18 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-05 09:18 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-05 09:18 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-05 09:18 . 2011-04-18 17:13 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-05 09:18 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
2011-05-05 09:18 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-05 09:18 . 2011-05-05 09:18 -------- d-----w- c:\programdata\AVAST Software
2011-05-05 09:18 . 2011-05-05 09:18 -------- d-----w- c:\program files\AVAST Software
2011-05-02 18:36 . 2011-05-02 18:36 81888 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-05-02 18:36 . 2011-05-02 18:36 36568 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-02 18:36 . 2011-05-02 18:36 238960 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-02 18:36 . 2011-05-02 18:36 19088 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-02 18:36 . 2011-05-02 18:36 284744 ----a-w- c:\windows\system32\guard32.dll
2011-04-30 07:04 . 2011-04-30 07:04 -------- d-----w- c:\program files\Plane Arcade
2011-04-27 07:54 . 2011-04-27 07:54 -------- d-----w- c:\program files\Common Files\Java
2011-04-27 07:43 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-27 07:43 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-27 07:43 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-23 16:54 . 2011-05-06 08:29 -------- d-----w- c:\users\Libas\AppData\Local\VirtualStore
2011-04-15 11:58 . 2011-04-15 13:00 -------- d-----w- c:\users\Libas\AppData\Local\Canon Easy-PhotoPrint EX
2011-04-08 12:05 . 2011-04-08 12:05 -------- d-----w- c:\users\Libas\AppData\Roaming\eSobi
2011-04-07 10:46 . 2011-04-07 10:46 -------- d-----w- c:\programdata\vsosdk
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-27 07:54 . 2010-07-06 08:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-27 07:53 . 2011-03-17 10:23 404128 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-03-31 16:13 . 2011-03-31 16:13 161792 ----a-w- c:\windows\system32\msls31.dll
2011-03-31 16:13 . 2011-03-31 16:13 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-03-31 16:13 . 2011-03-31 16:13 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-03-31 16:13 . 2011-03-31 16:13 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-03-31 16:13 . 2011-03-31 16:13 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-03-31 16:13 . 2011-03-31 16:13 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-03-31 16:13 . 2011-03-31 16:13 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-03-31 16:13 . 2011-03-31 16:13 367104 ----a-w- c:\windows\system32\html.iec
2011-03-31 16:13 . 2011-03-31 16:13 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-03-31 16:13 . 2011-03-31 16:13 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-03-31 16:13 . 2011-03-31 16:13 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-31 16:13 . 2011-03-31 16:13 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-03-31 16:13 . 2011-03-31 16:13 152064 ----a-w- c:\windows\system32\wextract.exe
2011-03-31 16:13 . 2011-03-31 16:13 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-03-31 16:13 . 2011-03-31 16:13 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-03-31 16:13 . 2011-03-31 16:13 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-03-31 16:13 . 2011-03-31 16:13 11776 ----a-w- c:\windows\system32\mshta.exe
2011-03-31 16:13 . 2011-03-31 16:13 101888 ----a-w- c:\windows\system32\admparse.dll
2011-03-31 16:13 . 2011-03-31 16:13 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-03-31 16:13 . 2011-03-31 16:13 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-03-31 16:13 . 2011-03-31 16:13 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-03-21 17:56 . 2011-03-21 17:56 59904 ----a-w- c:\windows\system32\OVDecode.dll
2011-03-21 17:56 . 2011-03-21 17:56 51712 ----a-w- c:\windows\system32\OpenCL.dll
2011-03-21 17:55 . 2011-03-21 17:55 12385792 ----a-w- c:\windows\system32\amdocl.dll
2011-03-09 10:50 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-03 15:40 . 2011-04-27 07:43 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 07:43 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 07:43 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 07:43 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-22 14:13 . 2011-03-23 08:29 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-22 13:33 . 2011-03-23 08:29 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-22 13:33 . 2011-03-23 08:29 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-03-26 15:41 . 2011-03-26 15:41 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-09 21:13 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-05-02 2560840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3918826349-1499275919-3888381439-1000]
"EnableNotificationsRef"=dword:00000001
.
R1 MpKsl055b5493;MpKsl055b5493;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8F30275-5CD8-4AA4-97E7-97467FC33068}\MpKsl055b5493.sys [x]
R1 MpKsl18f03bab;MpKsl18f03bab;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9CF395F7-5850-4E34-8548-A908E399BE7D}\MpKsl18f03bab.sys [x]
R1 MpKsl30fafffe;MpKsl30fafffe;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A01F54D-3544-45FB-835F-F7E106C54631}\MpKsl30fafffe.sys [x]
R1 MpKsl33b694c5;MpKsl33b694c5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DC211060-5137-4660-8490-E02D5EDFF968}\MpKsl33b694c5.sys [x]
R1 MpKslab7dd8ea;MpKslab7dd8ea;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B81295AA-CE13-46BA-99DC-6F8480A1C67D}\MpKslab7dd8ea.sys [x]
R1 MpKsleae1866a;MpKsleae1866a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4EED1F94-BCA3-429F-B617-0E34C1EF56EF}\MpKsleae1866a.sys [x]
R1 MpKslfe3959bf;MpKslfe3959bf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09D14A32-A911-458F-8763-80E2ED422F5C}\MpKslfe3959bf.sys [x]
R1 SuperMounter;SuperMounter; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 IEH;IEH;c:\users\Libas\AppData\Local\Temp\IEH.exe [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744]
R4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
R4 Acer TV Share Service;Acer TV Share Service;c:\program files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
R4 TZIXZ;TZIXZ;c:\users\Libas\AppData\Local\Temp\TZIXZ.exe [x]
R4 WDUGWPGAV;WDUGWPGAV;c:\users\Libas\AppData\Local\Temp\WDUGWPGAV.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 eLock2BurnerLockDriver;Disk Performance Monitor Filter Driver;c:\windows\system32\DRIVERS\eLock2BurnerLockDriver.sys [2008-01-10 22048]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-05-02 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-05-02 36568]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
S2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-04-29 154424]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\DRIVERS\eLock2FSCTLDriver.sys [2008-01-23 86048]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-05-07 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-11-08 16:24]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A8FE5D7B-9DB3-4E2D-8CBB-6F6E5D7E35DF} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\Libas\AppData\Roaming\Mozilla\Firefox\Profiles\2f8a83c0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-07 11:37
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(3884)
c:\windows\system32\guard32.dll
c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\OneX.DLL
.
Celkový čas: 2011-05-07 11:42:07
ComboFix-quarantined-files.txt 2011-05-07 09:42
.
Před spuštěním: Volných bajtů: 215 972 122 624
Po spuštění: Volných bajtů: 215 951 343 616
.
- - End Of File - - DA4C926B60D9F601427C23A95D577FED

Tím že nainstaluješ jiný firewall než ten co je ve Windows tak ten nový ho automaticky vypne a hlídá vše za něj.

Ale jak to ve Vistě vypnout to fakt nevím.


Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:
ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

v poho.. nevadí... našel jsem si návod...))) ale dík..))

ComboFix 11-05-06.05 - Libas 07.05.2011 19:41:23.2.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.1023.401 [GMT 2:00]
Spuštěný z: c:\users\Libas\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Libas\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\users\Libas\AppData\Local\Temp\IEH.exe"
"c:\users\Libas\AppData\Local\Temp\TZIXZ.exe"
"c:\users\Libas\AppData\Local\Temp\WDUGWPGAV.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_TZIXZ
-------\Legacy_WDUGWPGAV
-------\Service_IEH
-------\Service_TZIXZ
-------\Service_WDUGWPGAV
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-07 do 2011-05-07 )))))))))))))))))))))))))))))))
.
.
2011-05-07 17:53 . 2008-05-09 21:08 10752 ----a-w- C:\SensApi.dll
2011-05-07 17:53 . 2008-05-09 21:05 16384 ----a-w- C:\msimg32.dll
2011-05-07 17:51 . 2011-05-07 17:55 -------- d-----w- c:\users\Libas\AppData\Local\temp
2011-05-07 17:51 . 2011-05-07 17:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-06 11:14 . 2011-05-06 11:45 -------- d-----w- c:\programdata\Comodo
2011-05-06 10:01 . 2011-05-06 10:01 20922 ----a-w- c:\windows\cscmondump.bin
2011-05-06 08:59 . 2011-05-06 09:02 -------- d-----w- c:\program files\Wise Registry Cleaner
2011-05-06 08:04 . 2011-05-06 08:05 -------- d-----w- C:\rsit
2011-05-06 08:04 . 2011-05-06 08:04 -------- d-----w- c:\program files\trend micro
2011-05-06 07:45 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9BBB1F1E-A910-4553-903F-AAC2085DAD93}\mpengine.dll
2011-05-05 15:41 . 2011-05-06 11:15 -------- d-----w- c:\program files\COMODO
2011-05-05 13:31 . 2011-05-05 13:32 -------- d-----w- c:\program files\ATI Technologies
2011-05-05 13:30 . 2011-05-05 13:30 -------- d-----w- c:\program files\ATI
2011-05-05 13:26 . 2011-05-05 13:26 -------- d-----w- c:\users\Libas\AppData\Local\Apps
2011-05-05 10:41 . 2011-05-05 11:24 -------- d-----w- c:\programdata\SecTaskMan
2011-05-05 09:18 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-05 09:18 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-05 09:18 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-05 09:18 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-05 09:18 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-05 09:18 . 2011-04-18 17:13 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-05 09:18 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
2011-05-05 09:18 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-05 09:18 . 2011-05-05 09:18 -------- d-----w- c:\programdata\AVAST Software
2011-05-05 09:18 . 2011-05-05 09:18 -------- d-----w- c:\program files\AVAST Software
2011-05-02 18:36 . 2011-05-02 18:36 81888 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-05-02 18:36 . 2011-05-02 18:36 36568 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-02 18:36 . 2011-05-02 18:36 238960 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-02 18:36 . 2011-05-02 18:36 19088 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-02 18:36 . 2011-05-02 18:36 284744 ----a-w- c:\windows\system32\guard32.dll
2011-04-30 07:04 . 2011-04-30 07:04 -------- d-----w- c:\program files\Plane Arcade
2011-04-27 07:54 . 2011-04-27 07:54 -------- d-----w- c:\program files\Common Files\Java
2011-04-27 07:43 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-27 07:43 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-27 07:43 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-23 16:54 . 2011-05-06 08:29 -------- d-----w- c:\users\Libas\AppData\Local\VirtualStore
2011-04-15 11:58 . 2011-04-15 13:00 -------- d-----w- c:\users\Libas\AppData\Local\Canon Easy-PhotoPrint EX
2011-04-08 12:05 . 2011-04-08 12:05 -------- d-----w- c:\users\Libas\AppData\Roaming\eSobi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-27 07:54 . 2010-07-06 08:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-27 07:53 . 2011-03-17 10:23 404128 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-03-31 16:13 . 2011-03-31 16:13 161792 ----a-w- c:\windows\system32\msls31.dll
2011-03-31 16:13 . 2011-03-31 16:13 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-03-31 16:13 . 2011-03-31 16:13 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-03-31 16:13 . 2011-03-31 16:13 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-03-31 16:13 . 2011-03-31 16:13 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-03-31 16:13 . 2011-03-31 16:13 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-03-31 16:13 . 2011-03-31 16:13 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-03-31 16:13 . 2011-03-31 16:13 367104 ----a-w- c:\windows\system32\html.iec
2011-03-31 16:13 . 2011-03-31 16:13 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-03-31 16:13 . 2011-03-31 16:13 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-03-31 16:13 . 2011-03-31 16:13 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-31 16:13 . 2011-03-31 16:13 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-03-31 16:13 . 2011-03-31 16:13 152064 ----a-w- c:\windows\system32\wextract.exe
2011-03-31 16:13 . 2011-03-31 16:13 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-03-31 16:13 . 2011-03-31 16:13 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-03-31 16:13 . 2011-03-31 16:13 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-03-31 16:13 . 2011-03-31 16:13 11776 ----a-w- c:\windows\system32\mshta.exe
2011-03-31 16:13 . 2011-03-31 16:13 101888 ----a-w- c:\windows\system32\admparse.dll
2011-03-31 16:13 . 2011-03-31 16:13 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-03-31 16:13 . 2011-03-31 16:13 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-03-31 16:13 . 2011-03-31 16:13 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-03-21 17:56 . 2011-03-21 17:56 59904 ----a-w- c:\windows\system32\OVDecode.dll
2011-03-21 17:56 . 2011-03-21 17:56 51712 ----a-w- c:\windows\system32\OpenCL.dll
2011-03-21 17:55 . 2011-03-21 17:55 12385792 ----a-w- c:\windows\system32\amdocl.dll
2011-03-09 10:50 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-03 15:40 . 2011-04-27 07:43 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 07:43 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 07:43 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 07:43 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-22 14:13 . 2011-03-23 08:29 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-22 13:33 . 2011-03-23 08:29 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-22 13:33 . 2011-03-23 08:29 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-03-26 15:41 . 2011-03-26 15:41 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-09 21:13 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-05-02 2560840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3918826349-1499275919-3888381439-1000]
"EnableNotificationsRef"=dword:00000001
.
R1 MpKsl055b5493;MpKsl055b5493;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8F30275-5CD8-4AA4-97E7-97467FC33068}\MpKsl055b5493.sys [x]
R1 MpKsl18f03bab;MpKsl18f03bab;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9CF395F7-5850-4E34-8548-A908E399BE7D}\MpKsl18f03bab.sys [x]
R1 MpKsl30fafffe;MpKsl30fafffe;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A01F54D-3544-45FB-835F-F7E106C54631}\MpKsl30fafffe.sys [x]
R1 MpKsl33b694c5;MpKsl33b694c5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DC211060-5137-4660-8490-E02D5EDFF968}\MpKsl33b694c5.sys [x]
R1 MpKslab7dd8ea;MpKslab7dd8ea;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B81295AA-CE13-46BA-99DC-6F8480A1C67D}\MpKslab7dd8ea.sys [x]
R1 MpKsleae1866a;MpKsleae1866a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4EED1F94-BCA3-429F-B617-0E34C1EF56EF}\MpKsleae1866a.sys [x]
R1 MpKslfe3959bf;MpKslfe3959bf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{09D14A32-A911-458F-8763-80E2ED422F5C}\MpKslfe3959bf.sys [x]
R1 SuperMounter;SuperMounter; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744]
R4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
R4 Acer TV Share Service;Acer TV Share Service;c:\program files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 eLock2BurnerLockDriver;Disk Performance Monitor Filter Driver;c:\windows\system32\DRIVERS\eLock2BurnerLockDriver.sys [2008-01-10 22048]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-05-02 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-05-02 36568]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
S2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-04-29 154424]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\DRIVERS\eLock2FSCTLDriver.sys [2008-01-23 86048]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-05-07 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-11-08 16:24]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A8FE5D7B-9DB3-4E2D-8CBB-6F6E5D7E35DF} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\Libas\AppData\Roaming\Mozilla\Firefox\Profiles\2f8a83c0.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - http://www.seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-07 19:54
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(3084)
c:\windows\system32\guard32.dll
c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\NaturalLanguage6.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2011-05-07 19:59:45 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-05-07 17:59
ComboFix2.txt 2011-05-07 09:42
.
Před spuštěním: Volných bajtů: 215 957 594 112
Po spuštění: Volných bajtů: 215 800 823 808
.
- - End Of File - - 8FACB6A706CC706D6F50E7986B0BA632

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Pak dej vědět jaký je stav PC.

mno na začátku byl trochu PC zpomalený,nevím jest-li to měl za následek Combofix,ale pak po restartu se vrátil PC do stavu-OK..tak že asi si myslím že šlape ako hodinky(pro zatím)..díky..

nový log z RSIT:

todle nejde fixnout:O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file) ,vždy po restartu se objeví znova...))

Logfile of random's system information tool 1.08 (written by random/random)
Run by Libas at 2011-05-08 13:43:23
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 206 GB (88%) free of 234 GB
Total RAM: 1023 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:43:48, on 8.5.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Libas\Desktop\RSIT.exe
C:\Program Files\trend micro\Libas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8FE5D7B-9DB3-4E2D-8CBB-6F6E5D7E35DF}: NameServer = 156.154.70.25,156.154.71.25
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\System32\guard32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 4297 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GlaryInitialize.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]
{312105C4-2E13-4E10-AF72-F9D79BA077E6}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenuEx"=C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [2010-04-02 1185112]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-04-18 3460784]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-05-02 2560840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CLPSLS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoSecCpl"=0
"DisableChangePassword"=0
"DisableLockWorkstation"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=255
"NoStartMenuPinnedList"=0
"NoStartMenuMFUprogramsList"=0
"NoUserNameInStartMenu"=0
"NoStartMenuSubFolders"=0
"NoCommonGroups"=0
"NoPrinterTabs"=0
"NoDeletePrinter"=0
"NoAddPrinter"=0
"NoPrinters"=0
"NoFavoritesMenu"=0
"NoRecentDocsNetHood"=0
"NoChangeAnimation"=0
"NoChangeKeyboardNavigationIndicators"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe"="C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu"
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption"
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe"="C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-05-08 13:43:24 ----D---- C:\Program Files\trend micro
2011-05-08 13:43:23 ----D---- C:\rsit
2011-05-08 13:38:53 ----A---- C:\SensApi.dll
2011-05-08 13:38:53 ----A---- C:\msimg32.dll
2011-05-07 20:15:26 ----SHD---- C:\$RECYCLE.BIN
2011-05-07 19:59:49 ----D---- C:\Windows\temp
2011-05-07 11:23:51 ----A---- C:\Windows\NIRCMD.exe
2011-05-06 13:14:29 ----D---- C:\ProgramData\Comodo
2011-05-06 10:59:47 ----D---- C:\Program Files\Wise Registry Cleaner
2011-05-06 10:58:26 ----A---- C:\Windows\CRC.INI
2011-05-05 17:41:51 ----D---- C:\Program Files\COMODO
2011-05-05 15:31:00 ----D---- C:\Program Files\ATI Technologies
2011-05-05 15:30:58 ----D---- C:\Program Files\ATI
2011-05-05 13:11:16 ----A---- C:\RootRepeal report 05-05-11 (13-11-16).txt
2011-05-05 13:10:44 ----A---- C:\RootRepeal report 05-05-11 (13-10-44).txt
2011-05-05 12:41:57 ----D---- C:\ProgramData\SecTaskMan
2011-05-05 11:18:38 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-05-05 11:18:37 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-05-05 11:18:35 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-05-05 11:18:34 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-05-05 11:18:25 ----A---- C:\Windows\system32\aswBoot.exe
2011-05-05 11:18:22 ----D---- C:\ProgramData\AVAST Software
2011-05-05 11:18:22 ----D---- C:\Program Files\AVAST Software
2011-05-02 20:36:36 ----A---- C:\Windows\system32\drivers\inspect.sys
2011-05-02 20:36:34 ----A---- C:\Windows\system32\drivers\cmdhlp.sys
2011-05-02 20:36:32 ----A---- C:\Windows\system32\drivers\cmdGuard.sys
2011-05-02 20:36:32 ----A---- C:\Windows\system32\drivers\cmderd.sys
2011-05-02 20:36:04 ----A---- C:\Windows\system32\guard32.dll
2011-04-30 09:04:08 ----D---- C:\Program Files\Plane Arcade
2011-04-27 09:54:48 ----D---- C:\Program Files\Common Files\Java
2011-04-27 09:54:33 ----A---- C:\Windows\system32\javaws.exe
2011-04-27 09:54:33 ----A---- C:\Windows\system32\javaw.exe
2011-04-27 09:54:32 ----A---- C:\Windows\system32\java.exe
2011-04-27 09:43:14 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2011-04-27 09:43:14 ----A---- C:\Windows\system32\Apphlpdm.dll
2011-04-27 09:43:11 ----A---- C:\Windows\system32\XpsPrint.dll
2011-04-13 13:59:36 ----A---- C:\Windows\system32\mfc42u.dll
2011-04-13 13:59:35 ----A---- C:\Windows\system32\mfc42.dll
2011-04-13 13:59:34 ----A---- C:\Windows\system32\atmfd.dll
2011-04-13 13:59:33 ----A---- C:\Windows\system32\atmlib.dll
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-04-13 13:59:22 ----A---- C:\Windows\system32\dnsapi.dll
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-04-13 13:59:18 ----A---- C:\Windows\system32\drivers\srv.sys
2011-04-13 13:59:17 ----A---- C:\Windows\system32\win32k.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-04-13 13:59:15 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-04-13 13:59:14 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-04-13 13:59:12 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 months======

2011-05-08 13:43:25 ----D---- C:\Windows\Prefetch
2011-05-08 13:43:24 ----RD---- C:\Program Files
2011-05-08 13:38:21 ----D---- C:\Windows
2011-05-08 10:49:40 ----SHD---- C:\System Volume Information
2011-05-08 10:48:00 ----D---- C:\Windows\System32
2011-05-08 10:48:00 ----D---- C:\Windows\inf
2011-05-08 10:48:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-05-08 10:38:01 ----D---- C:\Windows\ERDNT
2011-05-08 10:37:52 ----D---- C:\Windows\system32\drivers
2011-05-07 20:02:33 ----D---- C:\Windows\system32\catroot2
2011-05-07 19:55:01 ----A---- C:\Windows\system.ini
2011-05-07 19:54:36 ----D---- C:\Windows\system32\drivers\etc
2011-05-07 19:52:12 ----D---- C:\Windows\system32\config
2011-05-07 19:47:01 ----D---- C:\Windows\AppPatch
2011-05-07 19:46:59 ----D---- C:\Program Files\Common Files
2011-05-06 13:16:54 ----D---- C:\ProgramData
2011-05-06 13:16:46 ----SHD---- C:\Windows\Installer
2011-05-06 13:07:57 ----D---- C:\Windows\system32\Tasks
2011-05-06 12:01:05 ----D---- C:\Windows\Tasks
2011-05-05 17:43:06 ----D---- C:\Windows\system32\catroot
2011-05-05 15:33:18 ----RSD---- C:\Windows\assembly
2011-05-05 15:32:45 ----SD---- C:\Users\Libas\AppData\Roaming\Microsoft
2011-05-05 15:32:22 ----D---- C:\Windows\winsxs
2011-05-05 14:57:36 ----SD---- C:\ProgramData\Microsoft
2011-05-05 12:49:20 ----D---- C:\ProgramData\Adobe
2011-05-05 12:49:17 ----D---- C:\Program Files\Common Files\Adobe
2011-05-05 12:46:55 ----D---- C:\ProgramData\Microsoft Help
2011-05-05 12:45:15 ----D---- C:\Program Files\Canon
2011-05-05 11:18:25 ----D---- C:\Program Files\Windows Sidebar
2011-05-05 09:35:16 ----D---- C:\Program Files\Mozilla Firefox
2011-05-03 11:12:45 ----D---- C:\ProgramData\CanonIJPLM
2011-04-27 09:55:13 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-04-27 09:54:19 ----A---- C:\Windows\system32\deployJava1.dll
2011-04-27 09:49:55 ----D---- C:\Program Files\CCleaner
2011-04-27 09:47:57 ----D---- C:\Windows\Debug
2011-04-24 11:10:03 ----D---- C:\Users\Libas\AppData\Roaming\Vso
2011-04-23 18:43:54 ----D---- C:\Users\Libas\AppData\Roaming\Macromedia
2011-04-23 09:01:56 ----D---- C:\Program Files\Microsoft Silverlight
2011-04-18 15:46:44 ----A---- C:\Windows\system32\mrt.exe
2011-04-18 10:24:29 ----D---- C:\Users\Libas\AppData\Roaming\Canon
2011-04-13 17:29:33 ----D---- C:\Windows\Microsoft.NET
2011-04-13 14:14:51 ----D---- C:\Program Files\Windows Mail

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-24 14392]
R0 eLock2BurnerLockDriver;Disk Performance Monitor Filter Driver; C:\Windows\system32\DRIVERS\eLock2BurnerLockDriver.sys [2008-01-10 22048]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2008-05-09 18992]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-04-18 25432]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-04-18 441176]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-04-18 307288]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-04-18 49240]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-05-02 238960]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-05-02 36568]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-05-02 81888]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-04-18 19544]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver; C:\Windows\system32\DRIVERS\eLock2FSCTLDriver.sys [2008-01-23 86048]
R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2008-10-07 15392]
R2 PSDNServ;PSDNServ; C:\Windows\system32\drivers\PSDNServ.sys [2008-05-09 16944]
R2 psdvdisk;PSDVdisk; C:\Windows\system32\drivers\psdvdisk.sys [2008-05-09 60464]
R2 tvicport;tvicport; \??\C:\Windows\system32\drivers\tvicport.sys [2008-10-07 14544]
R2 zntport;zntport; \??\C:\Windows\system32\drivers\zntport.sys [2008-10-07 6080]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-14 2427392]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-11-30 3317800]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2010-06-22 47360]
R3 Ph3xIB32;Philips 713x VU PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2010-09-23 313632]
S1 MpKsl055b5493;MpKsl055b5493; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8F30275-5CD8-4AA4-97E7-97467FC33068}\MpKsl055b5493.sys []
S1 MpKsl18f03bab;MpKsl18f03bab; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9CF395F7-5850-4E34-8548-A908E399BE7D}\MpKsl18f03bab.sys []
S1 MpKsl30fafffe;MpKsl30fafffe; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4A01F54D-3544-45FB-835F-F7E106C54631}\MpKsl30fafffe.sys []
S1 MpKsl33b694c5;MpKsl33b694c5; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DC211060-5137-4660-8490-E02D5EDFF968}\MpKsl33b694c5.sys []
S1 MpKslab7dd8ea;MpKslab7dd8ea; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B81295AA-CE13-46BA-99DC-6F8480A1C67D}\MpKslab7dd8ea.sys []
S1 MpKsleae1866a;MpKsleae1866a; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4EED1F94-BCA3-429F-B617-0E34C1EF56EF}\MpKsleae1866a.sys []
S1 MpKslfe3959bf;MpKslfe3959bf; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{09D14A32-A911-458F-8763-80E2ED422F5C}\MpKslfe3959bf.sys []
S1 SuperMounter;SuperMounter; C:\Windows\system32\drivers\SuperMounter.sys []
S3 amdiox86;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox86.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 39272]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-05-10 6144]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-03-14 569344]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-04-18 42184]
R2 CLPSLS;COMODO livePCsupport Service; C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-04-29 154424]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-05-02 1779280]
R2 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-05-09 500784]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-04-09 24576]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2010-04-05 116104]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AcerMemUsageCheckService;ePerformance Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2007-10-17 28672]
S3 BBSvc;Bing Bar Update Service; C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
S3 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-09-10 57344]
S3 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2008-11-03 24576]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
S4 Acer TV Share Service;Acer TV Share Service; C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe [2007-04-04 269424]
S4 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-04-09 143360]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S4 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]

-----------------EOF-----------------

Tak že, pokud již s PC není žádný problém je to z mé strany vše.

P.S. to co nejde fixnout neřeš, je to jen malá zbytečnost

Výborně,děkuji za váš-čas a trpělivost..

Není zač.