VIRY.CZ

Zdravím.

Můj počítač se poslední dobou velmi zpomalil a mám pocit, že na mém HDD se ubírají GB, a to nic neinstaluji. Mám Windows Vista 32Bit.
Děkuji za odpověď.

Nejprve dejte log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

Log: http://upload.wcentrum.cz/sgHupload/log.txt
Nevešel se sem.

Vir tam je. Poprosím ještě o log z ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Log:


ComboFix 11-07-12.09 - ondra 13.07.2011 18:48:46.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.420.1029.18.895.349 [GMT 2:00]
Spuštěný z: c:\users\ondra\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.crx
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.png
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe
c:\program files\Final Video Downloader FileBulldog Toolbar\tbHElper.dll
c:\windows\is-16B50.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-13 do 2011-07-13 )))))))))))))))))))))))))))))))
.
.
2011-07-13 17:04 . 2011-07-13 17:05 -------- d-----w- c:\users\ondra\AppData\Local\temp
2011-07-13 17:04 . 2011-07-13 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-13 16:41 . 2011-07-13 16:43 -------- d-----w- C:\32788R22FWJFW
2011-07-13 15:47 . 2011-07-13 15:48 -------- d-----w- c:\program files\trend micro
2011-07-13 15:47 . 2011-07-13 15:49 -------- d-----w- C:\rsit
2011-07-12 17:51 . 2004-05-25 14:06 417792 ----a-w- c:\windows\system32\ac3filter.cpl
2011-07-12 17:51 . 2011-07-12 17:52 -------- d-----w- c:\program files\ACE Mega CoDecS Pack
2011-07-12 17:22 . 2011-07-12 17:25 -------- d-----w- c:\program files\HyperCam 2
2011-07-12 15:39 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0CF7455C-2526-4D84-9002-FF0CF7E8ED50}\mpengine.dll
2011-07-10 16:16 . 2011-07-10 16:16 -------- d-----w- c:\program files\AviSynth 2.5
2011-07-10 16:15 . 2009-12-08 08:49 290816 ----a-w- c:\windows\system32\stFLVSource.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\Common Files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2011-07-10 16:15 . 2009-08-17 07:54 217088 ----a-w- c:\windows\system32\CoreFLACDecoder.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 438272 ----a-w- c:\windows\system32\Mpeg2DecFilter.ax
2011-07-10 15:42 . 2011-07-10 16:10 -------- d-----w- C:\Temp
2011-07-09 18:38 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2011-07-09 18:22 . 2011-07-09 18:22 -------- d-----w- c:\program files\Common Files\Pinnacle
2011-07-09 18:21 . 2011-07-10 09:08 -------- d-----w- c:\users\ondra\AppData\Local\Pinnacle
2011-07-09 18:20 . 2011-07-09 18:20 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate
2011-07-09 18:07 . 2011-07-09 18:07 -------- d-----w- c:\program files\Common Files\Pegasus Imaging
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\program files\Common Files\Yahoo!
2011-07-09 18:06 . 2011-07-09 18:36 -------- d-----w- c:\program files\Pinnacle
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Studio 15
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-07-09 17:56 . 2011-07-09 18:19 -------- d-----w- c:\programdata\Pinnacle
2011-07-09 17:04 . 2011-07-09 17:04 -------- d-----w- c:\users\ondra\.thumb
2011-07-09 17:03 . 2011-07-09 17:03 -------- d-----w- c:\program files\DVDStyler
2011-07-01 17:57 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-01 17:57 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-01 17:57 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-01 17:57 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-01 17:57 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-01 17:57 . 2011-07-01 17:57 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-01 17:57 . 2011-07-01 17:57 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-06-29 11:52 . 2011-04-29 14:54 276992 ----a-w- c:\windows\system32\schannel.dll
2011-06-28 15:44 . 2011-06-29 14:03 -------- d-----w- c:\users\ondra\AppData\Roaming\go
2011-06-28 15:44 . 2011-06-29 14:13 -------- d-----w- c:\programdata\Easybits GO
2011-06-28 15:37 . 2011-06-28 15:37 1556992 ----a-w- c:\windows\is-81F2U.exe
2011-06-27 12:19 . 2011-06-27 12:23 -------- d-----w- c:\program files\Multi Theft Auto
2011-06-26 16:40 . 2003-02-27 14:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-06-26 16:40 . 2002-12-05 12:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-06-26 16:40 . 2002-12-02 13:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-06-26 16:40 . 2002-12-02 11:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-06-26 16:40 . 2002-12-02 11:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-06-26 16:39 . 2011-06-26 16:39 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-06-26 16:39 . 2011-06-26 16:39 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-06-26 15:37 . 2011-06-26 16:09 -------- d-----w- c:\users\ondra\AppData\Local\Rockstar Games
2011-06-26 15:02 . 2011-06-26 15:02 -------- d--h--r- c:\users\ondra\AppData\Roaming\SecuROM
2011-06-26 11:59 . 2011-06-26 12:00 -------- d-----w- c:\users\UpdatusUser
2011-06-26 11:57 . 2011-05-25 07:24 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-06-26 11:57 . 2011-05-25 07:24 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-06-26 11:41 . 2011-05-25 07:24 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-06-26 11:41 . 2011-05-25 07:24 16456296 ----a-w- c:\windows\system32\nvoglv32.dll
2011-06-26 11:41 . 2011-05-25 07:24 10589800 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-06-26 11:41 . 2011-05-25 07:24 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-26 11:41 . 2011-05-25 07:24 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-26 11:41 . 2011-05-25 07:24 2804328 ----a-w- c:\windows\system32\nvcuvid.dll
2011-06-26 11:41 . 2011-05-25 07:24 5301352 ----a-w- c:\windows\system32\nvcuda.dll
2011-06-26 11:41 . 2011-05-25 07:24 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-06-26 11:41 . 2011-05-25 07:24 13011560 ----a-w- c:\windows\system32\nvcompiler.dll
2011-06-26 11:38 . 2011-06-26 11:40 -------- d-----w- C:\NVIDIA
2011-06-26 11:16 . 2011-06-26 11:16 -------- d-----w- c:\windows\system32\xlive
2011-06-26 11:16 . 2011-06-26 11:21 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2011-06-25 13:48 . 2011-06-25 14:38 -------- d-----w- c:\users\ondra\AppData\Local\Temporary Projects
2011-06-19 14:34 . 2011-06-22 05:27 193824 ----a-w- c:\programdata\Microsoft\VBExpress\9.0\1033\ResourceCache.dll
2011-06-18 18:44 . 2011-06-18 18:46 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
2011-06-18 18:41 . 2011-06-19 14:21 -------- d-----w- c:\program files\Microsoft Visual Studio 10.0
2011-06-18 18:41 . 2011-06-18 18:41 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-06-18 18:06 . 2008-11-13 02:28 2560 ----a-w- c:\windows\system32\msimsg.dll
2011-06-18 18:06 . 2008-11-13 04:50 16384 ----a-w- c:\windows\system32\msisip.dll
2011-06-18 18:06 . 2008-11-13 04:50 332800 ----a-w- c:\windows\system32\msihnd.dll
2011-06-18 18:06 . 2008-11-13 04:49 73216 ----a-w- c:\windows\system32\msiexec.exe
2011-06-18 18:06 . 2008-11-13 04:50 2241536 ----a-w- c:\windows\system32\msi.dll
2011-06-18 11:05 . 2011-06-18 11:05 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-06-18 10:42 . 2011-06-18 10:42 229208 ----a-w- c:\windows\system32\drivers\VMM.sys
2011-06-17 12:19 . 2011-04-14 14:24 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-17 12:19 . 2011-04-21 13:16 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-17 12:19 . 2011-04-29 12:49 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-17 12:19 . 2011-04-29 12:49 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-17 12:19 . 2010-12-20 15:39 563200 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-17 12:19 . 2011-05-02 15:58 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-17 12:19 . 2011-04-30 06:09 758784 ----a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2011-06-17 12:19 . 2011-04-29 12:49 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-17 12:19 . 2011-04-29 12:49 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-17 12:19 . 2011-04-29 12:49 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-17 12:14 . 2011-05-02 12:00 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-16 14:26 . 2011-06-16 14:26 -------- d-----w- c:\program files\Microsoft Virtual PC
2011-06-15 14:38 . 2011-06-15 14:51 -------- d-----w- c:\users\ondra\AppData\Roaming\Luxand
2011-06-15 14:11 . 2011-06-15 14:11 -------- d-----w- c:\programdata\Uniblue
2011-06-15 14:01 . 2011-06-15 14:01 -------- d-----w- c:\programdata\Ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-04 11:43 . 2010-11-15 19:36 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-11-15 19:36 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-05-01 12:28 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-11-15 19:37 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-11-15 19:37 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-11-15 19:37 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-11-15 19:37 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-11-15 19:37 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 11:18 . 2011-01-23 16:44 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-06-22 05:25 . 2011-02-13 17:04 416 ----a-w- c:\programdata\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-06-19 10:35 . 2010-11-18 09:08 165232 ---ha-w- c:\users\ondra\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2011-06-18 14:40 . 2011-02-18 15:00 187328 ----a-w- c:\programdata\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2011-06-08 11:33 . 2011-05-16 11:45 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\system32\frapsvid.dll
2011-05-25 07:24 . 2010-07-09 15:37 615528 ----a-w- c:\windows\system32\nvvsvc.exe
2011-05-25 07:24 . 2010-07-09 15:37 2557544 ----a-w- c:\windows\system32\nvsvc.dll
2011-05-25 07:24 . 2010-07-09 15:37 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-05-25 07:24 . 2010-07-09 15:37 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:24 . 2010-07-09 15:37 3693672 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:24 . 2006-11-02 10:25 11992680 ----a-w- c:\windows\system32\nvd3dum.dll
2011-05-25 07:24 . 2011-06-26 11:41 12392 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-05-25 07:24 . 2010-07-10 04:37 2335848 ----a-w- c:\windows\system32\nvapi.dll
2011-05-24 17:14 . 2010-11-15 16:22 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-14 17:31 . 2011-05-14 17:31 65536 ----a-w- c:\windows\IFinst27.exe
2011-05-13 16:16 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-05-13 16:16 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-05-13 15:36 . 2011-05-13 16:05 47560 ----a-w- c:\windows\system32\SPReview.exe
2011-05-13 15:36 . 2011-05-13 16:05 152576 ----a-w- c:\windows\system32\SPWizUI.dll
2011-05-08 09:31 . 2011-05-08 09:31 81920 ----a-w- c:\windows\system32\bsrgvas.dll
2011-05-08 09:31 . 2011-05-08 09:31 692224 ----a-w- c:\windows\system32\bsrmgcv.dll
2011-05-08 09:31 . 2011-05-08 09:31 192512 ----a-w- c:\windows\system32\bsrmgps.dll
2011-05-08 09:30 . 2011-05-08 09:30 147456 ----a-w- c:\windows\system32\bsratwmv.dll
2011-05-08 09:30 . 2011-05-08 09:30 585728 ----a-w- c:\windows\system32\bsratswf.dll
2010-11-26 18:10 . 2010-11-26 17:50 1386961224 ----a-w- c:\program files\Fiesta-10.0.0330.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-12-31 09:53 2349080 ----a-w- c:\program files\free-downloads.net\tbfree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-02 551800]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-01-12 405736]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2010-08-20 33120]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"iTV"="c:\program files\iTV\iTV.exe" [2011-06-02 628224]
"UIWatcher"="c:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2010-02-09 3509080]
"RGSC"="c:\program files\Rockstar Games\Social Club\Rockstar Games Social Club\RGSCLauncher.exe" [2008-11-14 305064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2006-10-10 270336]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-01 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"Ashampoo HDD Control Guard"="c:\program files\Ashampoo\Ashampoo HDD Control\HDDControlGuard.exe" [2011-01-28 4085080]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
.
c:\users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ondra\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo HDD Control\Dfsdks.exe [2009-08-24 406016]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 XDva344;XDva344;c:\windows\system32\XDva344.sys [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 Cerberus FTP Server;Cerberus FTP Server;c:\program files\Cerberus FTP Server\CerberusGUI.exe [2011-01-20 4994368]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S3 3xHybrid;SAA713x TV Card Service;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-07-06 906368]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - FSUSBEXDISK
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-10 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
.
2011-07-12 c:\windows\Tasks\User_Feed_Synchronization-{2D24E97D-488D-4BA7-AD78-2107C29D2F75}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
2011-07-13 c:\windows\Tasks\User_Feed_Synchronization-{CC25112D-6897-4EAE-96EA-0E49382D2AFF}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = *.local
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - free-downloads.net Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT1098640&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Mega Manager Integration: {40a1f5d7-afc2-498f-b264-02668d616ff6} - %profile%\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Page Hacker: pagehacker-nico@nc - %profile%\extensions\pagehacker-nico@nc
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\Alwil Software\Avast5\WebRep\FF
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll
Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll
HKCU-Run-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe
HKCU-Run-360desktop - c:\program files\360desktop\360desktop.exe
HKLM-Run-Super X Desktop Version 3.4.0730 - c:\program files\Super X Desktop\SXDesk.exe
HKLM-Run-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe
HKLM-RunOnce-InnoSetupRegFile.0000000001 - c:\windows\is-16B50.exe
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe
AddRemove-HyperCam - c:\program files\HyperCam\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-13 19:05
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
C:\## aswSnx private storage
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2011-07-13 19:13:49
ComboFix-quarantined-files.txt 2011-07-13 17:13
.
Před spuštěním: Volných bajtů: 62 921 154 560
Po spuštění: Volných bajtů: 67 348 172 800
.
Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5,6,7,8,9,10
- - End Of File - - CC7975E834D7188491B2B567920FCB51


Můžu se zeptat, virus byl ze složky Windows pod názvem is-1B650?
P.S. Běží mi proces PEV.exe a je ze složky Windows. Není to virus?

Ještě dočistíme. Otevřte poznámkový bblok a zkopírujte do něj:

Collect::
c:\windows\is-81F2U.exe
c:\windows\system32\XDva344.sys
C:\## aswSnx private storage

Driver::
XDva344

Reboot::

Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.



Pozn.: PEV.exe není virus, patří ComboFixu.

Asi jsem pochopil špatně že mám tento soubor přetáhnout na instalaci ComboFixu, že? Já jsem to tam přetáhnul a ComboFix udělal to stejné jako bez toho skriptu.

PontifexFairy píše:Asi jsem pochopil špatně že mám tento soubor přetáhnout na instalaci ComboFixu, že? Já jsem to tam přetáhnul a ComboFix udělal to stejné jako bez toho skriptu.

Jistěže. Jenže smazal minimálně to, co bylo ve skriptu. Postupoval jste správně, jen bych chtěl vidět log z posledního skenu.

Log:

ComboFix 11-07-13.01 - ondra 14.07.2011 17:38:59.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.420.1029.18.895.325 [GMT 2:00]
Spuštěný z: c:\users\ondra\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\ondra\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\is-81F2U.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\is-81F2U.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_XDVA344
-------\Service_XDva344
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-14 do 2011-07-14 )))))))))))))))))))))))))))))))
.
.
2011-07-14 15:54 . 2011-07-14 16:01 -------- d-----w- c:\users\ondra\AppData\Local\temp
2011-07-14 15:54 . 2011-07-14 15:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-14 14:59 . 2011-07-14 15:04 -------- d-----w- c:\program files\Metin2
2011-07-13 16:41 . 2011-07-14 15:35 -------- d-----w- C:\32788R22FWJFW
2011-07-13 15:47 . 2011-07-13 15:48 -------- d-----w- c:\program files\trend micro
2011-07-13 15:47 . 2011-07-13 15:49 -------- d-----w- C:\rsit
2011-07-12 17:51 . 2004-05-25 14:06 417792 ----a-w- c:\windows\system32\ac3filter.cpl
2011-07-12 17:51 . 2011-07-12 17:52 -------- d-----w- c:\program files\ACE Mega CoDecS Pack
2011-07-12 17:22 . 2011-07-12 17:25 -------- d-----w- c:\program files\HyperCam 2
2011-07-12 15:39 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0CF7455C-2526-4D84-9002-FF0CF7E8ED50}\mpengine.dll
2011-07-10 16:16 . 2011-07-10 16:16 -------- d-----w- c:\program files\AviSynth 2.5
2011-07-10 16:15 . 2009-12-08 08:49 290816 ----a-w- c:\windows\system32\stFLVSource.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\Common Files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2011-07-10 16:15 . 2009-08-17 07:54 217088 ----a-w- c:\windows\system32\CoreFLACDecoder.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 438272 ----a-w- c:\windows\system32\Mpeg2DecFilter.ax
2011-07-10 15:42 . 2011-07-10 16:10 -------- d-----w- C:\Temp
2011-07-09 18:38 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2011-07-09 18:22 . 2011-07-09 18:22 -------- d-----w- c:\program files\Common Files\Pinnacle
2011-07-09 18:21 . 2011-07-10 09:08 -------- d-----w- c:\users\ondra\AppData\Local\Pinnacle
2011-07-09 18:20 . 2011-07-09 18:20 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate
2011-07-09 18:07 . 2011-07-09 18:07 -------- d-----w- c:\program files\Common Files\Pegasus Imaging
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\program files\Common Files\Yahoo!
2011-07-09 18:06 . 2011-07-09 18:36 -------- d-----w- c:\program files\Pinnacle
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Studio 15
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-07-09 17:56 . 2011-07-09 18:19 -------- d-----w- c:\programdata\Pinnacle
2011-07-09 17:04 . 2011-07-09 17:04 -------- d-----w- c:\users\ondra\.thumb
2011-07-09 17:03 . 2011-07-09 17:03 -------- d-----w- c:\program files\DVDStyler
2011-07-01 17:57 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-01 17:57 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-01 17:57 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-01 17:57 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-01 17:57 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-01 17:57 . 2011-07-01 17:57 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-01 17:57 . 2011-07-01 17:57 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-06-29 11:52 . 2011-04-29 14:54 276992 ----a-w- c:\windows\system32\schannel.dll
2011-06-28 15:44 . 2011-06-29 14:03 -------- d-----w- c:\users\ondra\AppData\Roaming\go
2011-06-28 15:44 . 2011-06-29 14:13 -------- d-----w- c:\programdata\Easybits GO
2011-06-27 12:19 . 2011-06-27 12:23 -------- d-----w- c:\program files\Multi Theft Auto
2011-06-26 16:40 . 2003-02-27 14:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-06-26 16:40 . 2002-12-05 12:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-06-26 16:40 . 2002-12-02 13:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-06-26 16:40 . 2002-12-02 11:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-06-26 16:40 . 2002-12-02 11:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-06-26 16:39 . 2011-06-26 16:39 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-06-26 16:39 . 2011-06-26 16:39 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-06-26 15:37 . 2011-06-26 16:09 -------- d-----w- c:\users\ondra\AppData\Local\Rockstar Games
2011-06-26 15:02 . 2011-06-26 15:02 -------- d--h--r- c:\users\ondra\AppData\Roaming\SecuROM
2011-06-26 11:59 . 2011-06-26 12:00 -------- d-----w- c:\users\UpdatusUser
2011-06-26 11:57 . 2011-05-25 07:24 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-06-26 11:57 . 2011-05-25 07:24 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-06-26 11:41 . 2011-05-25 07:24 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-06-26 11:41 . 2011-05-25 07:24 16456296 ----a-w- c:\windows\system32\nvoglv32.dll
2011-06-26 11:41 . 2011-05-25 07:24 10589800 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-06-26 11:41 . 2011-05-25 07:24 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-26 11:41 . 2011-05-25 07:24 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-26 11:41 . 2011-05-25 07:24 2804328 ----a-w- c:\windows\system32\nvcuvid.dll
2011-06-26 11:41 . 2011-05-25 07:24 5301352 ----a-w- c:\windows\system32\nvcuda.dll
2011-06-26 11:41 . 2011-05-25 07:24 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-06-26 11:41 . 2011-05-25 07:24 13011560 ----a-w- c:\windows\system32\nvcompiler.dll
2011-06-26 11:38 . 2011-06-26 11:40 -------- d-----w- C:\NVIDIA
2011-06-26 11:16 . 2011-06-26 11:16 -------- d-----w- c:\windows\system32\xlive
2011-06-26 11:16 . 2011-06-26 11:21 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2011-06-25 13:48 . 2011-06-25 14:38 -------- d-----w- c:\users\ondra\AppData\Local\Temporary Projects
2011-06-19 14:34 . 2011-06-22 05:27 193824 ----a-w- c:\programdata\Microsoft\VBExpress\9.0\1033\ResourceCache.dll
2011-06-18 18:44 . 2011-06-18 18:46 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
2011-06-18 18:41 . 2011-06-19 14:21 -------- d-----w- c:\program files\Microsoft Visual Studio 10.0
2011-06-18 18:41 . 2011-06-18 18:41 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-06-18 18:06 . 2008-11-13 02:28 2560 ----a-w- c:\windows\system32\msimsg.dll
2011-06-18 18:06 . 2008-11-13 04:50 16384 ----a-w- c:\windows\system32\msisip.dll
2011-06-18 18:06 . 2008-11-13 04:50 332800 ----a-w- c:\windows\system32\msihnd.dll
2011-06-18 18:06 . 2008-11-13 04:49 73216 ----a-w- c:\windows\system32\msiexec.exe
2011-06-18 18:06 . 2008-11-13 04:50 2241536 ----a-w- c:\windows\system32\msi.dll
2011-06-18 11:05 . 2011-06-18 11:05 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-06-18 10:42 . 2011-06-18 10:42 229208 ----a-w- c:\windows\system32\drivers\VMM.sys
2011-06-17 12:19 . 2011-04-14 14:24 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-17 12:19 . 2011-04-21 13:16 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-17 12:19 . 2011-04-29 12:49 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-17 12:19 . 2011-04-29 12:49 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-17 12:19 . 2010-12-20 15:39 563200 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-17 12:19 . 2011-05-02 15:58 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-17 12:19 . 2011-04-30 06:09 758784 ----a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2011-06-17 12:19 . 2011-04-29 12:49 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-17 12:19 . 2011-04-29 12:49 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-17 12:19 . 2011-04-29 12:49 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-17 12:14 . 2011-05-02 12:00 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-16 14:26 . 2011-06-16 14:26 -------- d-----w- c:\program files\Microsoft Virtual PC
2011-06-15 14:38 . 2011-06-15 14:51 -------- d-----w- c:\users\ondra\AppData\Roaming\Luxand
2011-06-15 14:11 . 2011-06-15 14:11 -------- d-----w- c:\programdata\Uniblue
2011-06-15 14:01 . 2011-06-15 14:01 -------- d-----w- c:\programdata\Ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-04 11:43 . 2010-11-15 19:36 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-11-15 19:36 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-05-01 12:28 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-11-15 19:37 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-11-15 19:37 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-11-15 19:37 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-11-15 19:37 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-11-15 19:37 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 11:18 . 2011-01-23 16:44 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-06-22 05:25 . 2011-02-13 17:04 416 ----a-w- c:\programdata\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-06-19 10:35 . 2010-11-18 09:08 165232 ---ha-w- c:\users\ondra\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2011-06-18 14:40 . 2011-02-18 15:00 187328 ----a-w- c:\programdata\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2011-06-08 11:33 . 2011-05-16 11:45 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\system32\frapsvid.dll
2011-05-25 07:24 . 2010-07-09 15:37 615528 ----a-w- c:\windows\system32\nvvsvc.exe
2011-05-25 07:24 . 2010-07-09 15:37 2557544 ----a-w- c:\windows\system32\nvsvc.dll
2011-05-25 07:24 . 2010-07-09 15:37 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-05-25 07:24 . 2010-07-09 15:37 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:24 . 2010-07-09 15:37 3693672 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:24 . 2006-11-02 10:25 11992680 ----a-w- c:\windows\system32\nvd3dum.dll
2011-05-25 07:24 . 2011-06-26 11:41 12392 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-05-25 07:24 . 2010-07-10 04:37 2335848 ----a-w- c:\windows\system32\nvapi.dll
2011-05-24 17:14 . 2010-11-15 16:22 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-14 17:31 . 2011-05-14 17:31 65536 ----a-w- c:\windows\IFinst27.exe
2011-05-13 16:16 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-05-13 16:16 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-05-13 15:36 . 2011-05-13 16:05 47560 ----a-w- c:\windows\system32\SPReview.exe
2011-05-13 15:36 . 2011-05-13 16:05 152576 ----a-w- c:\windows\system32\SPWizUI.dll
2011-05-08 09:31 . 2011-05-08 09:31 81920 ----a-w- c:\windows\system32\bsrgvas.dll
2011-05-08 09:31 . 2011-05-08 09:31 692224 ----a-w- c:\windows\system32\bsrmgcv.dll
2011-05-08 09:31 . 2011-05-08 09:31 192512 ----a-w- c:\windows\system32\bsrmgps.dll
2011-05-08 09:30 . 2011-05-08 09:30 147456 ----a-w- c:\windows\system32\bsratwmv.dll
2011-05-08 09:30 . 2011-05-08 09:30 585728 ----a-w- c:\windows\system32\bsratswf.dll
2010-11-26 18:10 . 2010-11-26 17:50 1386961224 ----a-w- c:\program files\Fiesta-10.0.0330.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-12-31 09:53 2349080 ----a-w- c:\program files\free-downloads.net\tbfree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-02 551800]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-01-12 405736]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2010-08-20 33120]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"iTV"="c:\program files\iTV\iTV.exe" [2011-06-02 628224]
"UIWatcher"="c:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2010-02-09 3509080]
"RGSC"="c:\program files\Rockstar Games\Social Club\Rockstar Games Social Club\RGSCLauncher.exe" [2008-11-14 305064]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2006-10-10 270336]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-01 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"Ashampoo HDD Control Guard"="c:\program files\Ashampoo\Ashampoo HDD Control\HDDControlGuard.exe" [2011-01-28 4085080]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
.
c:\users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ondra\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 CFcatchme;CFcatchme;c:\users\ondra\AppData\Local\Temp\CFcatchme.sys [x]
R3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo HDD Control\Dfsdks.exe [2009-08-24 406016]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 Cerberus FTP Server;Cerberus FTP Server;c:\program files\Cerberus FTP Server\CerberusGUI.exe [2011-01-20 4994368]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S3 3xHybrid;SAA713x TV Card Service;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-07-06 906368]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-14 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
.
2011-07-13 c:\windows\Tasks\User_Feed_Synchronization-{2D24E97D-488D-4BA7-AD78-2107C29D2F75}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
2011-07-14 c:\windows\Tasks\User_Feed_Synchronization-{CC25112D-6897-4EAE-96EA-0E49382D2AFF}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = *.local
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - free-downloads.net Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT1098640&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Mega Manager Integration: {40a1f5d7-afc2-498f-b264-02668d616ff6} - %profile%\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Page Hacker: pagehacker-nico@nc - %profile%\extensions\pagehacker-nico@nc
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\Alwil Software\Avast5\WebRep\FF
.
.
**************************************************************************
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory:
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(4008)
c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\RacAgent.exe
.
**************************************************************************
.
Celkový čas: 2011-07-14 18:15:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-14 16:14
ComboFix2.txt 2011-07-13 17:13
.
Před spuštěním: Volných bajtů: 62 418 223 104
Po spuštění: Volných bajtů: 61 885 415 424
.
Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5,6,7,8,9,11
- - End Of File - - 8B693F3688D91CBC123F8FCD01EED850
Nahr nˇ probŘhlo ŁspŘçnŘ

Smazáno, log již vypadá čistý. Nastala nějaká změna?

PC je rychlejší ale ne zas tak moc. Ale jinak moc děkuji. Smím se zeptat, nevíte jak se ten vir jmenoval?

PontifexFairy píše:PC je rychlejší ale ne zas tak moc. Ale jinak moc děkuji. Smím se zeptat, nevíte jak se ten vir jmenoval?

Ono toho bylo více. 1. sken smazal tzv. facebook virus a jednoho trojana. 2. skenem jste smazal dalšího trojana a rootkit.

Je to zpátky. Počítač je zase pomalý.

Log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by ondra at 2011-07-15 16:41:04
Microsoft® Windows Vista™ Home Basic Service Pack 1
System drive C: has 58 GB (24%) free of 238 GB
Total RAM: 895 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:41:39, on 15.7.2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.19088)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\explorer.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\ondra\Documents\My Downloads\RSIT.exe
C:\Program Files\trend micro\ondra.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe
O4 - HKLM\..\Run: [tsnp325] C:\Windows\tsnp325.exe
O4 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Ashampoo HDD Control Guard] "C:\Program Files\Ashampoo\Ashampoo HDD Control\HDDControlGuard.exe"
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [iTV] C:\Program Files\iTV\iTV.exe
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Social Club\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [RegistryBooster] "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10s_Plugin.exe -update plugin
O4 - HKUS\S-1-5-21-1098977879-2126329400-2746128921-1009\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1098977879-2126329400-2746128921-1009\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'UpdatusUser')
O4 - Startup: Dropbox.lnk = C:\Users\ondra\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cerberus FTP Server - Cerberus, LLC - C:\Program Files\Cerberus FTP Server\CerberusGUI.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo HDD Control\Dfsdks.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 8876 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\RegistryBooster.job
C:\Windows\tasks\User_Feed_Synchronization-{2D24E97D-488D-4BA7-AD78-2107C29D2F75}.job
C:\Windows\tasks\User_Feed_Synchronization-{CC25112D-6897-4EAE-96EA-0E49382D2AFF}.job

=========Mozilla firefox=========

ProfilePath - C:\Users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT10986 ... hSource=13"
prefs.js - "extensions.enabledItems" - "{20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {40a1f5d7-afc2-498f-b264-02668d616ff6}:1.1, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3, wrc@avast.com:6.0.1203, pagehacker-nico@nc:1.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\Alwil Software\Avast5\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027]
"Description"=RealMedia Plugin
"Path"=C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040]
"Description"=6.0.12.1040
"Path"=C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npnul32.dll
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
fcmdSrchpiano.xml
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default\extensions\
pagehacker-nico@nc
{20a82645-c095-46ed-80e3-08825760534b}
{40a1f5d7-afc2-498f-b264-02668d616ff6}
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

C:\Users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf00e119-21a3-4fd1-b178-3b8537e75c92}]
IeMonitorBho Class - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2010-11-03 109568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfree.dll [2009-12-31 2349080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{ecdee021-0d17-467f-a1ff-c7a115230949} - free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfree.dll [2009-12-31 2349080]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2011-07-04 820864]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2006-12-01 4186112]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [2007-02-04 79400]
"FixCamera"=C:\Windows\FixCamera.exe [2007-02-12 20480]
"tsnp325"=C:\Windows\tsnp325.exe [2006-10-10 270336]
"snp325"=C:\Windows\vsnp325.exe [2006-10-10 827392]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-10-08 47904]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-11-29 421888]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2011-03-01 421160]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-01-30 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"Ashampoo HDD Control Guard"=C:\Program Files\Ashampoo\Ashampoo HDD Control\HDDControlGuard.exe [2011-01-28 4085080]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2011-06-02 551800]
"SandboxieControl"=C:\Program Files\Sandboxie\SbieCtrl.exe [2011-01-12 405736]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2010-08-20 33120]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-18 202240]
"iTV"=C:\Program Files\iTV\iTV.exe [2011-06-02 628224]
"UIWatcher"=C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe [2010-02-09 3509080]
"RGSC"=C:\Program Files\Rockstar Games\Social Club\Rockstar Games Social Club\RGSCLauncher.exe [2008-11-14 305064]
"RegistryBooster"=C:\Program Files\Uniblue\RegistryBooster\launcher.exe delay 20000 []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\Windows\system32\Macromed\Flash\FlashUtil10s_Plugin.exe [2011-06-08 238040]

C:\Users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\ondra\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.FPS1"=frapsvid.dll
"vidc.VP60"=C:\Windows\system32\vp6vfw.dll
"vidc.VP61"=C:\Windows\system32\vp6vfw.dll
"msacm.lhacm"=lhacm.acm
"wave1"=wdmaud.drv
"midi"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv
"wave"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-07-14 18:15:19 ----A---- C:\ComboFix.txt
2011-07-14 18:00:48 ----D---- C:\$RECYCLE.BIN
2011-07-14 16:59:01 ----D---- C:\Program Files\Metin2
2011-07-13 19:04:56 ----D---- C:\Windows\temp
2011-07-13 18:43:49 ----A---- C:\Windows\zip.exe
2011-07-13 18:43:49 ----A---- C:\Windows\SWSC.exe
2011-07-13 18:43:49 ----A---- C:\Windows\SWREG.exe
2011-07-13 18:43:49 ----A---- C:\Windows\sed.exe
2011-07-13 18:43:49 ----A---- C:\Windows\PEV.exe
2011-07-13 18:43:49 ----A---- C:\Windows\NIRCMD.exe
2011-07-13 18:43:49 ----A---- C:\Windows\MBR.exe
2011-07-13 18:43:49 ----A---- C:\Windows\grep.exe
2011-07-13 18:43:37 ----D---- C:\Windows\ERDNT
2011-07-13 18:42:30 ----D---- C:\Qoobox
2011-07-13 18:41:34 ----D---- C:\32788R22FWJFW
2011-07-13 17:47:42 ----D---- C:\Program Files\trend micro
2011-07-13 17:47:35 ----D---- C:\rsit
2011-07-12 19:52:30 ----A---- C:\Windows\system32\rmoc3260.dll
2011-07-12 19:52:30 ----A---- C:\Windows\system32\pndx5032.dll
2011-07-12 19:52:30 ----A---- C:\Windows\system32\pndx5016.dll
2011-07-12 19:52:22 ----D---- C:\Windows\system32\QuickTime
2011-07-12 19:52:16 ----A---- C:\Windows\mmtvmj.ini
2011-07-12 19:52:16 ----A---- C:\Windows\m3jp2k.ini
2011-07-12 19:52:15 ----A---- C:\Windows\m3jpeg.ini
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplvw7.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplvpx.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplvm6.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplva6.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplaw7.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplapx.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplam6.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\mplaa6.dll
2011-07-12 19:52:11 ----A---- C:\Windows\system32\cpuinf32.dll
2011-07-12 19:52:05 ----A---- C:\Windows\system32\xvidcore.dll
2011-07-12 19:51:46 ----D---- C:\Program Files\ACE Mega CoDecS Pack
2011-07-12 19:22:37 ----D---- C:\Program Files\HyperCam 2
2011-07-10 18:16:02 ----D---- C:\Program Files\AviSynth 2.5
2011-07-10 18:15:20 ----D---- C:\Program Files\Common Files\SourceTec
2011-07-10 18:15:20 ----A---- C:\Windows\system32\pncrt.dll
2011-07-10 18:15:18 ----A---- C:\Windows\system32\wvc1dmod.dll
2011-07-10 18:15:17 ----D---- C:\Program Files\SourceTec
2011-07-10 17:42:54 ----D---- C:\Temp
2011-07-09 20:38:14 ----A---- C:\Windows\unvise32.exe
2011-07-09 20:22:48 ----D---- C:\Program Files\Common Files\Pinnacle
2011-07-09 20:20:40 ----D---- C:\ProgramData\Pinnacle Studio Ultimate
2011-07-09 20:07:00 ----D---- C:\Program Files\Common Files\Pegasus Imaging
2011-07-09 20:06:56 ----D---- C:\Program Files\Common Files\Yahoo!
2011-07-09 20:06:55 ----D---- C:\ProgramData\Studio 15
2011-07-09 20:06:55 ----D---- C:\ProgramData\Pinnacle Studio Plus
2011-07-09 20:06:55 ----D---- C:\Program Files\Pinnacle
2011-07-09 19:56:28 ----D---- C:\ProgramData\Pinnacle
2011-07-09 19:03:31 ----D---- C:\Program Files\DVDStyler
2011-06-29 13:52:36 ----A---- C:\Windows\system32\schannel.dll
2011-06-28 17:44:35 ----D---- C:\Users\ondra\AppData\Roaming\go
2011-06-28 17:44:22 ----D---- C:\ProgramData\Easybits GO
2011-06-27 14:22:09 ----A---- C:\Users\ondra\AppData\Roaming\mta.ini.ini
2011-06-27 14:19:58 ----D---- C:\Program Files\Multi Theft Auto
2011-06-26 17:02:57 ----RHD---- C:\Users\ondra\AppData\Roaming\SecuROM
2011-06-26 13:57:29 ----A---- C:\Windows\system32\nvsvcr.dll
2011-06-26 13:57:10 ----A---- C:\Windows\system32\easyupdatusapiu.dll
2011-06-26 13:41:30 ----A---- C:\Windows\system32\OpenCL.dll
2011-06-26 13:41:28 ----A---- C:\Windows\system32\nvoglv32.dll
2011-06-26 13:41:28 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2011-06-26 13:41:27 ----A---- C:\Windows\system32\nvgenco322090.dll
2011-06-26 13:41:26 ----A---- C:\Windows\system32\nvdispco3220150.dll
2011-06-26 13:41:25 ----A---- C:\Windows\system32\nvcuvid.dll
2011-06-26 13:41:25 ----A---- C:\Windows\system32\nvcuvenc.dll
2011-06-26 13:41:25 ----A---- C:\Windows\system32\nvcuda.dll
2011-06-26 13:41:24 ----A---- C:\Windows\system32\nvcompiler.dll
2011-06-26 13:38:19 ----D---- C:\NVIDIA
2011-06-26 13:16:50 ----D---- C:\Windows\system32\xlive
2011-06-26 13:16:49 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE
2011-06-18 20:41:17 ----D---- C:\Program Files\Microsoft Visual Studio 10.0
2011-06-18 20:41:17 ----D---- C:\Program Files\Microsoft Help Viewer
2011-06-18 20:06:52 ----A---- C:\Windows\system32\msimsg.dll
2011-06-18 20:06:47 ----A---- C:\Windows\system32\msisip.dll
2011-06-18 20:06:46 ----A---- C:\Windows\system32\msihnd.dll
2011-06-18 20:06:46 ----A---- C:\Windows\system32\msiexec.exe
2011-06-18 20:06:45 ----A---- C:\Windows\system32\msi.dll
2011-06-18 12:42:29 ----A---- C:\Windows\system32\drivers\VMM.sys
2011-06-17 14:20:38 ----A---- C:\Windows\system32\wininet.dll
2011-06-17 14:20:38 ----A---- C:\Windows\system32\urlmon.dll
2011-06-17 14:20:37 ----A---- C:\Windows\system32\jsproxy.dll
2011-06-17 14:20:36 ----A---- C:\Windows\system32\mshtml.dll
2011-06-17 14:20:34 ----A---- C:\Windows\system32\ieframe.dll
2011-06-17 14:20:32 ----A---- C:\Windows\system32\msfeeds.dll
2011-06-17 14:20:32 ----A---- C:\Windows\system32\iertutil.dll
2011-06-17 14:20:26 ----A---- C:\Windows\system32\mstime.dll
2011-06-17 14:20:25 ----A---- C:\Windows\system32\ieui.dll
2011-06-17 14:20:25 ----A---- C:\Windows\system32\iedkcs32.dll
2011-06-17 14:20:24 ----A---- C:\Windows\system32\occache.dll
2011-06-17 14:20:24 ----A---- C:\Windows\system32\ieUnatt.exe
2011-06-17 14:20:24 ----A---- C:\Windows\system32\iepeers.dll
2011-06-17 14:20:23 ----A---- C:\Windows\system32\iesysprep.dll
2011-06-17 14:20:22 ----A---- C:\Windows\system32\mshtmled.dll
2011-06-17 14:20:21 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-06-17 14:20:21 ----A---- C:\Windows\system32\iesetup.dll
2011-06-17 14:20:21 ----A---- C:\Windows\system32\iernonce.dll
2011-06-17 14:20:20 ----A---- C:\Windows\system32\licmgr10.dll
2011-06-17 14:20:09 ----A---- C:\Windows\system32\ie4uinit.exe
2011-06-17 14:20:08 ----A---- C:\Windows\system32\msfeedssync.exe
2011-06-17 14:19:58 ----A---- C:\Windows\system32\drivers\dfsc.sys
2011-06-17 14:19:48 ----A---- C:\Windows\system32\drivers\afd.sys
2011-06-17 14:19:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-06-17 14:19:38 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-06-17 14:19:32 ----A---- C:\Windows\system32\oleaut32.dll
2011-06-17 14:19:25 ----A---- C:\Windows\system32\inetcomm.dll
2011-06-17 14:19:10 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-06-17 14:19:07 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-06-17 14:19:03 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-06-16 16:26:12 ----D---- C:\Program Files\Microsoft Virtual PC

======List of files/folders modified in the last 1 month======

2011-07-15 16:20:05 ----SHD---- C:\System Volume Information
2011-07-14 18:16:24 ----D---- C:\Windows\system32\drivers
2011-07-14 18:00:59 ----D---- C:\Windows
2011-07-14 18:00:59 ----A---- C:\Windows\system.ini
2011-07-14 18:00:44 ----D---- C:\Windows\system32\drivers\etc
2011-07-14 17:54:37 ----D---- C:\Windows\system32\config
2011-07-14 17:45:52 ----D---- C:\Windows\System32
2011-07-14 17:45:52 ----D---- C:\Windows\AppPatch
2011-07-14 17:45:50 ----D---- C:\Program Files\Common Files
2011-07-14 16:59:01 ----RD---- C:\Program Files
2011-07-14 16:52:18 ----D---- C:\Windows\winsxs
2011-07-14 16:41:40 ----A---- C:\Windows\system32\mrt.exe
2011-07-13 19:03:34 ----D---- C:\Program Files\Final Video Downloader FileBulldog Toolbar
2011-07-13 17:51:08 ----D---- C:\Windows\system32\catroot
2011-07-13 17:48:50 ----D---- C:\Windows\system32\catroot2
2011-07-12 19:35:12 ----D---- C:\Program Files\K-Lite Codec Pack
2011-07-10 13:59:40 ----D---- C:\ProgramData\DAEMON Tools Lite
2011-07-10 09:52:12 ----D---- C:\Program Files\iTV
2011-07-10 09:51:16 ----D---- C:\Users\ondra\AppData\Roaming\uTorrent
2011-07-09 20:49:40 ----RSD---- C:\Windows\assembly
2011-07-09 20:49:40 ----D---- C:\Windows\Microsoft.NET
2011-07-09 20:39:07 ----SHD---- C:\Windows\Installer
2011-07-09 20:28:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-09 20:28:01 ----D---- C:\Windows\inf
2011-07-09 20:20:40 ----D---- C:\ProgramData
2011-07-09 20:16:41 ----RSD---- C:\Windows\Fonts
2011-07-04 13:43:51 ----A---- C:\Windows\system32\aswBoot.exe
2011-07-01 22:04:54 ----D---- C:\Program Files\Sony
2011-07-01 22:01:40 ----D---- C:\Users\ondra\AppData\Roaming\Sony
2011-07-01 19:57:40 ----HD---- C:\Program Files\InstallShield Installation Information
2011-06-29 20:11:54 ----A---- C:\Windows\Sandboxie.ini
2011-06-29 20:07:31 ----D---- C:\Program Files\Rockstar Games
2011-06-29 20:07:31 ----D---- C:\Program Files\CDBurnerXP
2011-06-29 13:15:47 ----D---- C:\Users\ondra\AppData\Roaming\Skype
2011-06-28 17:43:37 ----D---- C:\Users\ondra\AppData\Roaming\skypePM
2011-06-27 13:14:59 ----D---- C:\ProgramData\CanonIJPLM
2011-06-26 14:01:16 ----D---- C:\Program Files\NVIDIA Corporation
2011-06-26 13:59:46 ----RD---- C:\Users
2011-06-26 13:59:44 ----D---- C:\ProgramData\NVIDIA
2011-06-26 13:59:27 ----D---- C:\Windows\Prefetch
2011-06-26 13:21:26 ----D---- C:\Program Files\Common Files\microsoft shared
2011-06-26 13:21:06 ----SD---- C:\ProgramData\Microsoft
2011-06-26 13:18:37 ----A---- C:\Windows\system32\CmdLineExt.dll
2011-06-24 17:35:01 ----D---- C:\Windows\system32\Tasks
2011-06-22 07:27:06 ----D---- C:\ProgramData\Microsoft Help
2011-06-19 16:30:55 ----D---- C:\Program Files\Microsoft Visual Studio 9.0
2011-06-19 16:29:40 ----D---- C:\Program Files\Microsoft.NET
2011-06-18 20:52:52 ----D---- C:\Windows\rescache
2011-06-18 20:44:01 ----SD---- C:\Users\ondra\AppData\Roaming\Microsoft
2011-06-18 20:33:33 ----D---- C:\Windows\system32\uk-UA
2011-06-18 20:33:33 ----D---- C:\Windows\system32\sl-SI
2011-06-18 20:33:33 ----D---- C:\Windows\system32\pt-PT
2011-06-18 20:33:33 ----D---- C:\Windows\system32\pt-BR
2011-06-18 20:33:33 ----D---- C:\Windows\system32\pl-PL
2011-06-18 20:33:33 ----D---- C:\Windows\system32\ko-KR
2011-06-18 20:33:33 ----D---- C:\Windows\system32\it-IT
2011-06-18 20:33:33 ----D---- C:\Windows\system32\hu-HU
2011-06-18 20:33:33 ----D---- C:\Windows\system32\hr-HR
2011-06-18 20:33:33 ----D---- C:\Windows\system32\he-IL
2011-06-18 20:33:33 ----D---- C:\Windows\system32\bg-BG
2011-06-18 20:33:32 ----D---- C:\Windows\system32\zh-TW
2011-06-18 20:33:32 ----D---- C:\Windows\system32\zh-CN
2011-06-18 20:33:32 ----D---- C:\Windows\system32\tr-TR
2011-06-18 20:33:32 ----D---- C:\Windows\system32\th-TH
2011-06-18 20:33:32 ----D---- C:\Windows\system32\sv-SE
2011-06-18 20:33:32 ----D---- C:\Windows\system32\sr-Latn-CS
2011-06-18 20:33:32 ----D---- C:\Windows\system32\sk-SK
2011-06-18 20:33:32 ----D---- C:\Windows\system32\ru-RU
2011-06-18 20:33:32 ----D---- C:\Windows\system32\ro-RO
2011-06-18 20:33:32 ----D---- C:\Windows\system32\nl-NL
2011-06-18 20:33:32 ----D---- C:\Windows\system32\nb-NO
2011-06-18 20:33:32 ----D---- C:\Windows\system32\lv-LV
2011-06-18 20:33:32 ----D---- C:\Windows\system32\lt-LT
2011-06-18 20:33:32 ----D---- C:\Windows\system32\ja-JP
2011-06-18 20:33:32 ----D---- C:\Windows\system32\fr-FR
2011-06-18 20:33:32 ----D---- C:\Windows\system32\fi-FI
2011-06-18 20:33:32 ----D---- C:\Windows\system32\et-EE
2011-06-18 20:33:32 ----D---- C:\Windows\system32\es-ES
2011-06-18 20:33:32 ----D---- C:\Windows\system32\en-US
2011-06-18 20:33:32 ----D---- C:\Windows\system32\el-GR
2011-06-18 20:33:32 ----D---- C:\Windows\system32\de-DE
2011-06-18 20:33:32 ----D---- C:\Windows\system32\da-DK
2011-06-18 20:33:32 ----D---- C:\Windows\system32\cs-CZ
2011-06-18 20:33:32 ----D---- C:\Windows\system32\ar-SA
2011-06-18 17:00:17 ----D---- C:\Program Files\Microsoft Silverlight
2011-06-18 16:58:00 ----D---- C:\Windows\system32\migration
2011-06-18 16:58:00 ----D---- C:\Program Files\Internet Explorer
2011-06-18 12:42:44 ----D---- C:\Program Files\Windows Mail

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor32;nvstor32; C:\Windows\system32\DRIVERS\nvstor32.sys [2008-08-18 145952]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-03-30 431672]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-07-04 25432]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-07-04 441176]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-07-04 309848]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-07-04 43608]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 vmm;Virtual Machine Monitor; \??\C:\Windows\system32\Drivers\vmm.sys [2011-06-18 229208]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-07-04 19544]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
R2 RMCAST;Ovladač protokolu RMCAST (Pgm); C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-15 113664]
R3 3xHybrid;SAA713x TV Card Service; C:\Windows\system32\DRIVERS\3xHybrid.sys [2007-07-06 906368]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 ElbyDelay;ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [2007-02-16 11984]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2006-12-01 1655464]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 NVENETFD;NVIDIA nForce 10/100 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-08-01 1052704]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2011-05-25 10589800]
R3 SbieDrv;SbieDrv; \??\C:\Program Files\Sandboxie\SbieDrv.sys [2011-01-12 125672]
R3 SNP325;USB PC Camera (SNPSTD325); C:\Windows\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
R3 VPCNetS2;Virtual Machine Network Services Driver; C:\Windows\system32\DRIVERS\VMNetSrv.sys [2007-01-29 59280]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]
S3 aebml672;aebml672; C:\Windows\system32\drivers\aebml672.sys []
S3 apo782gw;apo782gw; C:\Windows\system32\drivers\apo782gw.sys []
S3 CFcatchme;CFcatchme; \??\C:\Users\ondra\AppData\Local\Temp\CFcatchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 EagleXNt;EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 NVNET;NVIDIA nForce Ethernet Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-08-01 1052704]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-09-28 41984]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-18 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936]
S4 RsFx0102;RsFx0102 Driver; C:\Windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-02-18 37664]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-07-04 42184]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-10-07 345376]
R2 Cerberus FTP Server;Cerberus FTP Server; C:\Program Files\Cerberus FTP Server\CerberusGUI.exe [2011-01-20 4994368]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-03-31 233472]
R2 IJPLMSVC;PIXMA Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 99936]
R2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [2008-07-11 40999448]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-05-25 615528]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
R2 SbieSvc;Sandboxie Service; C:\Program Files\Sandboxie\SbieSvc.exe [2011-01-12 69864]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-07-10 98840]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2010-11-15 34312]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo HDD Control\Dfsdks.exe [2009-08-24 406016]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-03-01 820520]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WPFFontCache_v0400;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-07-10 258072]

-----------------EOF-----------------

Proveďte ještě jeden ComboFix. Stáhněte ale nový, má krátkou expiraci.

Log:
ComboFix 11-07-23.01 - ondra 23.07.2011 13:53:31.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.420.1029.18.895.282 [GMT 2:00]
Spuštěný z: c:\users\ondra\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-23 do 2011-07-23 )))))))))))))))))))))))))))))))
.
.
2011-07-23 12:11 . 2011-07-23 12:11 -------- d-----w- c:\users\ondra\AppData\Local\temp
2011-07-23 12:11 . 2011-07-23 12:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-23 11:41 . 2011-07-13 03:39 6881616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB3A1424-BD1F-4F6D-891E-BA87178465E1}\mpengine.dll
2011-07-16 07:36 . 2011-07-16 07:36 -------- d-----w- c:\program files\ABC
2011-07-15 15:07 . 2011-07-08 07:29 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-07-15 15:07 . 2011-07-08 07:29 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-07-15 15:07 . 2011-07-08 07:29 1850328 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-07-15 15:07 . 2011-07-08 07:29 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-07-15 15:07 . 2011-07-08 07:29 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-07-15 15:07 . 2011-07-08 07:29 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-07-15 15:07 . 2010-01-01 08:00 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-15 15:07 . 2010-01-01 08:00 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-07-14 14:59 . 2011-07-14 15:04 -------- d-----w- c:\program files\Metin2
2011-07-13 15:47 . 2011-07-15 14:41 -------- d-----w- c:\program files\trend micro
2011-07-13 15:47 . 2011-07-13 15:49 -------- d-----w- C:\rsit
2011-07-12 17:51 . 2004-05-25 14:06 417792 ----a-w- c:\windows\system32\ac3filter.cpl
2011-07-12 17:51 . 2011-07-12 17:52 -------- d-----w- c:\program files\ACE Mega CoDecS Pack
2011-07-12 17:22 . 2011-07-12 17:25 -------- d-----w- c:\program files\HyperCam 2
2011-07-10 16:16 . 2011-07-10 16:16 -------- d-----w- c:\program files\AviSynth 2.5
2011-07-10 16:15 . 2009-12-08 08:49 290816 ----a-w- c:\windows\system32\stFLVSource.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\Common Files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2011-07-10 16:15 . 2009-08-17 07:54 217088 ----a-w- c:\windows\system32\CoreFLACDecoder.ax
2011-07-10 16:15 . 2011-07-10 16:15 -------- d-----w- c:\program files\SourceTec
2011-07-10 16:15 . 2009-08-17 07:54 438272 ----a-w- c:\windows\system32\Mpeg2DecFilter.ax
2011-07-10 15:42 . 2011-07-10 16:10 -------- d-----w- C:\Temp
2011-07-09 18:38 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2011-07-09 18:22 . 2011-07-09 18:22 -------- d-----w- c:\program files\Common Files\Pinnacle
2011-07-09 18:21 . 2011-07-10 09:08 -------- d-----w- c:\users\ondra\AppData\Local\Pinnacle
2011-07-09 18:20 . 2011-07-09 18:20 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate
2011-07-09 18:07 . 2011-07-09 18:07 -------- d-----w- c:\program files\Common Files\Pegasus Imaging
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\program files\Common Files\Yahoo!
2011-07-09 18:06 . 2011-07-09 18:36 -------- d-----w- c:\program files\Pinnacle
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Studio 15
2011-07-09 18:06 . 2011-07-09 18:06 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2011-07-09 17:56 . 2011-07-09 18:19 -------- d-----w- c:\programdata\Pinnacle
2011-07-09 17:04 . 2011-07-09 17:04 -------- d-----w- c:\users\ondra\.thumb
2011-07-09 17:03 . 2011-07-09 17:03 -------- d-----w- c:\program files\DVDStyler
2011-07-01 17:57 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-07-01 17:57 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-07-01 17:57 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-07-01 17:57 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-07-01 17:57 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-07-01 17:57 . 2011-07-01 17:57 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-07-01 17:57 . 2011-07-01 17:57 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-06-29 11:52 . 2011-04-29 14:54 276992 ----a-w- c:\windows\system32\schannel.dll
2011-06-28 15:44 . 2011-06-29 14:03 -------- d-----w- c:\users\ondra\AppData\Roaming\go
2011-06-28 15:44 . 2011-06-29 14:13 -------- d-----w- c:\programdata\Easybits GO
2011-06-27 12:19 . 2011-06-27 12:23 -------- d-----w- c:\program files\Multi Theft Auto
2011-06-26 16:40 . 2003-02-27 14:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-06-26 16:40 . 2002-12-05 12:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-06-26 16:40 . 2002-12-02 13:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-06-26 16:40 . 2002-12-02 11:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-06-26 16:40 . 2002-12-02 11:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-06-26 16:39 . 2011-06-26 16:39 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-06-26 16:39 . 2011-06-26 16:39 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-06-26 15:37 . 2011-06-26 16:09 -------- d-----w- c:\users\ondra\AppData\Local\Rockstar Games
2011-06-26 15:02 . 2011-06-26 15:02 -------- d--h--r- c:\users\ondra\AppData\Roaming\SecuROM
2011-06-26 11:59 . 2011-06-26 12:00 -------- d-----w- c:\users\UpdatusUser
2011-06-26 11:57 . 2011-05-25 07:24 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-06-26 11:57 . 2011-05-25 07:24 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-06-26 11:41 . 2011-05-25 07:24 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-06-26 11:41 . 2011-05-25 07:24 16456296 ----a-w- c:\windows\system32\nvoglv32.dll
2011-06-26 11:41 . 2011-05-25 07:24 10589800 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-06-26 11:41 . 2011-05-25 07:24 865896 ----a-w- c:\windows\system32\nvgenco322090.dll
2011-06-26 11:41 . 2011-05-25 07:24 899688 ----a-w- c:\windows\system32\nvdispco3220150.dll
2011-06-26 11:41 . 2011-05-25 07:24 2804328 ----a-w- c:\windows\system32\nvcuvid.dll
2011-06-26 11:41 . 2011-05-25 07:24 5301352 ----a-w- c:\windows\system32\nvcuda.dll
2011-06-26 11:41 . 2011-05-25 07:24 2082408 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-06-26 11:41 . 2011-05-25 07:24 13011560 ----a-w- c:\windows\system32\nvcompiler.dll
2011-06-26 11:38 . 2011-06-26 11:40 -------- d-----w- C:\NVIDIA
2011-06-26 11:16 . 2011-06-26 11:16 -------- d-----w- c:\windows\system32\xlive
2011-06-26 11:16 . 2011-06-26 11:21 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2011-06-25 13:48 . 2011-06-25 14:38 -------- d-----w- c:\users\ondra\AppData\Local\Temporary Projects
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 15:15 . 2011-05-16 11:45 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-04 11:43 . 2010-11-15 19:36 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2010-11-15 19:36 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-05-01 12:28 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-11-15 19:37 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-11-15 19:37 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:32 . 2010-11-15 19:37 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-11-15 19:37 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-04 11:32 . 2010-11-15 19:37 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 11:18 . 2011-01-23 16:44 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-06-22 05:27 . 2011-06-19 14:34 193824 ----a-w- c:\programdata\Microsoft\VBExpress\9.0\1033\ResourceCache.dll
2011-06-22 05:25 . 2011-02-13 17:04 416 ----a-w- c:\programdata\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-06-19 10:35 . 2010-11-18 09:08 165232 ---ha-w- c:\users\ondra\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2011-06-18 18:46 . 2011-06-18 18:44 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
2011-06-18 14:40 . 2011-02-18 15:00 187328 ----a-w- c:\programdata\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2011-06-18 10:42 . 2011-06-18 10:42 229208 ----a-w- c:\windows\system32\drivers\VMM.sys
2011-05-28 12:56 . 2011-05-28 12:56 65536 ----a-w- c:\windows\system32\frapsvid.dll
2011-05-28 06:08 . 2011-06-17 12:20 916480 ----a-w- c:\windows\system32\wininet.dll
2011-05-28 06:04 . 2011-06-17 12:20 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-05-28 06:04 . 2011-06-17 12:20 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-05-28 06:04 . 2011-06-17 12:20 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-05-28 06:04 . 2011-06-17 12:20 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-05-28 05:10 . 2011-06-17 12:20 385024 ----a-w- c:\windows\system32\html.iec
2011-05-28 04:33 . 2011-06-17 12:20 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-05-28 04:31 . 2011-06-17 12:20 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-05-25 07:24 . 2010-07-09 15:37 615528 ----a-w- c:\windows\system32\nvvsvc.exe
2011-05-25 07:24 . 2010-07-09 15:37 2557544 ----a-w- c:\windows\system32\nvsvc.dll
2011-05-25 07:24 . 2010-07-09 15:37 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-05-25 07:24 . 2010-07-09 15:37 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:24 . 2010-07-09 15:37 3693672 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:24 . 2006-11-02 10:25 11992680 ----a-w- c:\windows\system32\nvd3dum.dll
2011-05-25 07:24 . 2011-06-26 11:41 12392 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-05-25 07:24 . 2010-07-10 04:37 2335848 ----a-w- c:\windows\system32\nvapi.dll
2011-05-24 17:14 . 2010-11-15 16:22 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-14 17:31 . 2011-05-14 17:31 65536 ----a-w- c:\windows\IFinst27.exe
2011-05-13 16:16 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-05-13 16:16 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-05-13 15:36 . 2011-05-13 16:05 47560 ----a-w- c:\windows\system32\SPReview.exe
2011-05-13 15:36 . 2011-05-13 16:05 152576 ----a-w- c:\windows\system32\SPWizUI.dll
2011-05-08 09:31 . 2011-05-08 09:31 81920 ----a-w- c:\windows\system32\bsrgvas.dll
2011-05-08 09:31 . 2011-05-08 09:31 692224 ----a-w- c:\windows\system32\bsrmgcv.dll
2011-05-08 09:31 . 2011-05-08 09:31 192512 ----a-w- c:\windows\system32\bsrmgps.dll
2011-05-08 09:30 . 2011-05-08 09:30 147456 ----a-w- c:\windows\system32\bsratwmv.dll
2011-05-08 09:30 . 2011-05-08 09:30 585728 ----a-w- c:\windows\system32\bsratswf.dll
2011-05-02 15:58 . 2011-06-17 12:19 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 12:49 . 2011-06-17 12:19 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-29 12:49 . 2011-06-17 12:19 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-29 12:49 . 2011-06-17 12:19 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-04-29 12:49 . 2011-06-17 12:19 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-04-29 12:49 . 2011-06-17 12:19 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-11-26 18:10 . 2010-11-26 17:50 1386961224 ----a-w- c:\program files\Fiesta-10.0.0330.exe
2011-07-08 07:29 . 2011-07-15 15:07 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-12-31 09:53 2349080 ----a-w- c:\program files\free-downloads.net\tbfree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2009-12-31 2349080]
.
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-02 551800]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-01-12 405736]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2010-08-20 33120]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"iTV"="c:\program files\iTV\iTV.exe" [2011-06-02 628224]
"UIWatcher"="c:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2010-02-09 3509080]
"RGSC"="c:\program files\Rockstar Games\Social Club\Rockstar Games Social Club\RGSCLauncher.exe" [2008-11-14 305064]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2006-10-10 270336]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-01 421160]
"Ashampoo HDD Control Guard"="c:\program files\Ashampoo\Ashampoo HDD Control\HDDControlGuard.exe" [2011-01-28 4085080]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
c:\users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ondra\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 CFcatchme;CFcatchme;c:\users\ondra\AppData\Local\Temp\CFcatchme.sys [x]
R3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo HDD Control\Dfsdks.exe [2009-08-24 406016]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 136176]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 Cerberus FTP Server;Cerberus FTP Server;c:\program files\Cerberus FTP Server\CerberusGUI.exe [2011-01-20 4994368]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S3 3xHybrid;SAA713x TV Card Service;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-07-06 906368]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-03 13:04]
.
2011-07-15 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
.
2011-07-23 c:\windows\Tasks\User_Feed_Synchronization-{2D24E97D-488D-4BA7-AD78-2107C29D2F75}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
2011-07-23 c:\windows\Tasks\User_Feed_Synchronization-{CC25112D-6897-4EAE-96EA-0E49382D2AFF}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyOverride = *.local
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\ondra\AppData\Roaming\Mozilla\Firefox\Profiles\cun05hn2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-23 14:11
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
C:\## aswSnx private storage
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(3568)
c:\users\ondra\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Celkový čas: 2011-07-23 14:23:53
ComboFix-quarantined-files.txt 2011-07-23 12:23
ComboFix2.txt 2011-07-14 16:16
ComboFix3.txt 2011-07-13 17:13
.
Před spuštěním: Volných bajtů: 59 131 555 840
Po spuštění: Volných bajtů: 59 098 550 272
.
Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5,6,7,8,9,11
- - End Of File - - 7FF9DA7864D811781E99A970F5C400C5