VIRY.CZ

Dobrý den,

prosím o pomoc s odstraněním Backdoor viru SmadowGenB. Microsoft security essentials jej najde, odstraní, požaduje reset, po resetu se však vir objevuje stále znova a znova...

LOG přikládám. Díky Luk

Logfile of random's system information tool 1.09 (written by random/random)
Run by Luk at 2011-10-01 21:39:12
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 76 GB (35%) free of 221 GB
Total RAM: 1903 MB (29% free)


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\Luk\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2010-10-12 149968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-05-16 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-22 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0BF43445-2F28-4351-9252-17FE6E806AA0}
{D4027C7F-154A-4066-A1AD-4243D8127440} - Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-08-25 186904]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-06-04 1791272]
"File Sanitizer"=C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe []
"IgfxTray"=C:\windows\system32\igfxtray.exe [2009-12-17 141848]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2009-12-17 175640]
"Persistence"=C:\windows\system32\igfxpers.exe [2009-12-17 166936]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-12-03 495711]
"QLBController"=C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe [2010-01-04 254520]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-09-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"Nero MediaHome 4"=C:\Program Files\Nero\Nero MediaHome 4\NeroMediaHome.exe [2010-03-08 5174568]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2011-06-15 997920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HPADVISOR"=C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN []
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-06-17 2363392]
"QIP Internet Guardian"=C:\Users\Luk\AppData\Roaming\QipGuard\QipGuard.exe /p []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []
"Infium"=C:\Program Files\QIP 2010\qip.exe [2011-07-18 6812032]
""= []
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
C:\windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE [2007-03-01 180736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
C:\Program Files\Free Desktop Clock\DesktopClock.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Users\Luk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
JDownloader.lnk - C:\Program Files\JDownloader\JDownloader.exe
Microsoft Office Outlook 2007.lnk - C:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2009-11-21 226304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90070948.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\90070948.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.txt - open - "C:\Program Files\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 1 month======

2011-10-01 21:39:13 ----D---- C:\Program Files\trend micro
2011-10-01 21:39:12 ----D---- C:\rsit
2011-10-01 21:25:34 ----A---- C:\windows\system32\drivers\bimfqvxj.sys
2011-10-01 21:16:26 ----D---- C:\ProgramData\Spybot - Search & Destroy
2011-10-01 21:16:26 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-10-01 21:05:55 ----A---- C:\TDSSKiller.2.6.2.0_01.10.2011_21.05.55_log.txt
2011-10-01 19:08:43 ----A---- C:\windows\system32\drivers\13424537.sys
2011-10-01 19:05:23 ----D---- C:\windows\Minidump
2011-10-01 18:49:10 ----D---- C:\a
2011-09-16 07:29:03 ----SHD---- C:\Config.Msi

======List of files/folders modified in the last 1 month======

2011-10-01 21:39:13 ----RD---- C:\Program Files
2011-10-01 21:29:49 ----D---- C:\windows\Temp
2011-10-01 21:29:22 ----D---- C:\windows\system32\config
2011-10-01 21:25:34 ----D---- C:\windows\system32\drivers
2011-10-01 21:20:19 ----D---- C:\Users\Luk\AppData\Roaming\QipGuard
2011-10-01 21:16:26 ----HD---- C:\ProgramData
2011-10-01 21:15:52 ----D---- C:\Program Files\QIP 2010
2011-10-01 21:15:05 ----A---- C:\windows\system32\log.txt
2011-10-01 21:12:32 ----D---- C:\Downloads
2011-10-01 20:58:24 ----D---- C:\Windows
2011-10-01 20:43:36 ----SHD---- C:\System Volume Information
2011-10-01 20:09:59 ----D---- C:\windows\System32
2011-10-01 19:25:03 ----D---- C:\windows\Prefetch
2011-10-01 19:00:23 ----A---- C:\windows\ntbtlog.txt
2011-10-01 17:35:37 ----D---- C:\Program Files\Fingerprint Sensor
2011-10-01 17:35:37 ----D---- C:\Program Files\Common Files\LightScribe
2011-10-01 17:35:37 ----D---- C:\Program Files\CDBurnerXP
2011-10-01 17:08:26 ----D---- C:\Program Files\Opera
2011-10-01 13:01:33 ----D---- C:\MP3
2011-09-29 18:32:20 ----D---- C:\Program Files\JDownloader
2011-09-28 18:08:25 ----A---- C:\windows\system32\MRT.exe
2011-09-26 19:26:14 ----D---- C:\Users\Luk\AppData\Roaming\Skype
2011-09-16 07:30:32 ----D---- C:\windows\inf
2011-09-16 07:30:32 ----A---- C:\windows\system32\PerfStringBackup.INI
2011-09-16 07:29:43 ----SHD---- C:\windows\Installer
2011-09-16 07:28:57 ----D---- C:\Program Files\PokerStars.NET
2011-09-14 07:41:08 ----D---- C:\ProgramData\Microsoft Help
2011-09-14 07:35:34 ----D---- C:\windows\winsxs
2011-09-14 07:34:00 ----D---- C:\windows\system32\catroot
2011-09-14 07:09:01 ----D---- C:\windows\system32\catroot2
2011-09-08 17:58:56 ----RSD---- C:\windows\assembly
2011-09-08 17:58:56 ----D---- C:\windows\Microsoft.NET
2011-09-07 20:20:39 ----D---- C:\windows\system32\DriverStore

Zdravím!
Nejdříve odinstalujte AskToolbar. Pak dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

odinstalovano NERO ask toolbar.

Log z combofix přikládám:

ComboFix 11-10-01.03 - Luk 01.10.2011 22:44:06.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.1903.912 [GMT 2:00]
SpuÜtýnř z: c:\users\Luk\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( OstatnÝ vřmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\QIP 2010\Core\MousePhone.dll
C:\Thumbs.db
c:\windows\$NtUninstallKB46685$
c:\windows\$NtUninstallKB46685$\1017923068
c:\windows\$NtUninstallKB46685$\1379343253\@
c:\windows\$NtUninstallKB46685$\1379343253\click.tlb
c:\windows\$NtUninstallKB46685$\1379343253\L\xadqgnnk
c:\windows\$NtUninstallKB46685$\1379343253\loader.tlb
c:\windows\$NtUninstallKB46685$\1379343253\U\@00000001
c:\windows\$NtUninstallKB46685$\1379343253\U\@000000c0
c:\windows\$NtUninstallKB46685$\1379343253\U\@000000cb
c:\windows\$NtUninstallKB46685$\1379343253\U\@000000cf
c:\windows\$NtUninstallKB46685$\1379343253\U\@80000000
c:\windows\$NtUninstallKB46685$\1379343253\U\@800000c0
c:\windows\$NtUninstallKB46685$\1379343253\U\@800000cb
c:\windows\$NtUninstallKB46685$\1379343253\U\@800000cf
c:\windows\iun6002.exe
c:\windows\system32\
c:\windows\system32\c_13930.nls
.
Naka×enß kopie c:\windows\system32\drivers\cdrom.sys byla nalezena a vylÚŔena.
Obnovena kopie z - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.sys
.
.
((((((((((((((((((((((((((((((((((((((( OvladaŔe/Slu×by )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_52371b95
.
.
((((((((((((((((((((((((( Soubory vytvo°enÚ od 2011-09-01 do 2011-10-01 )))))))))))))))))))))))))))))))
.
.
2011-10-01 20:58 . 2011-10-01 20:58 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl73377441.sys
2011-10-01 20:57 . 2011-10-01 20:58 -------- d-----w- c:\users\Luk\AppData\Local\temp
2011-10-01 20:57 . 2011-10-01 20:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-01 20:41 . 2011-10-01 20:41 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl0191fdf7.sys
2011-10-01 20:41 . 2011-10-01 20:58 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\offreg.dll
2011-10-01 20:40 . 2009-07-13 23:11 80896 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- c:\program files\trend micro
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- C:\rsit
2011-10-01 19:16 . 2011-10-01 20:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-10-01 19:16 . 2011-10-01 20:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-10-01 18:43 . 2011-09-12 23:14 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\mpengine.dll
2011-10-01 17:08 . 2011-10-01 17:17 133208 ----a-w- c:\windows\system32\drivers\13424537.sys
2011-10-01 16:49 . 2011-10-01 16:49 -------- d-----w- C:\a
2011-09-09 17:30 . 2011-01-31 15:32 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FBF4D1E-1244-448B-B448-C597AA4C7F0A}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M vřpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-29 16:30 . 2011-05-17 17:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-07-24 08:21 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-22 02:54 . 2011-08-10 21:04 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-07-22 02:48 . 2011-08-10 21:04 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-07-22 02:44 . 2011-08-10 21:04 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-16 04:27 . 2011-08-10 15:48 290816 ----a-w- c:\windows\system32\KernelBase.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-13 03:39 . 2011-08-02 05:55 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-09 04:29 . 2011-08-24 19:43 2048 ----a-w- c:\windows\system32\tzres.dll
2011-07-09 02:30 . 2011-08-10 15:48 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
.
.
(((((((((((((((((((((((((((((((((( SpouÜtýcÝ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznßmka* prßzdnÚ zßznamy a legitimnÝ vřchozÝ ˙daje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Infium"="c:\program files\QIP 2010\qip.exe" [2011-07-18 6812032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 166936]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-12-03 495711]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-01-04 254520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
c:\users\Luk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
JDownloader.lnk - c:\program files\JDownloader\JDownloader.exe [2009-10-26 214528]
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2010-7-22 845584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 04:01 180736 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE
.
R1 MpKsl04894cf5;MpKsl04894cf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5262A559-7F03-479A-96A0-F3C66AE34590}\MpKsl04894cf5.sys [x]
R1 MpKsl05ec6e77;MpKsl05ec6e77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D2633B9-3662-4856-91F8-57E56FDFB552}\MpKsl05ec6e77.sys [x]
R1 MpKsl0f8111ff;MpKsl0f8111ff;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6344FB45-D76E-4647-B97A-62F2BDED8A79}\MpKsl0f8111ff.sys [x]
R1 MpKsl1802e8bd;MpKsl1802e8bd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F1626873-FFF3-4D29-B601-F7B84A264FD3}\MpKsl1802e8bd.sys [x]
R1 MpKsl1fa80422;MpKsl1fa80422;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D156222-CC8A-4EDE-8171-9C5D5E19AAF1}\MpKsl1fa80422.sys [x]
R1 MpKsl3613ea25;MpKsl3613ea25;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{11C9DBAF-EE91-4629-9CCC-987EAB6CAF9B}\MpKsl3613ea25.sys [x]
R1 MpKsl426f3ed5;MpKsl426f3ed5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{982141BF-A85F-4F00-8340-6B555F2A27ED}\MpKsl426f3ed5.sys [x]
R1 MpKsl4a10f19b;MpKsl4a10f19b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D1DAE0B1-B1CE-41AD-98E2-70CC267FA284}\MpKsl4a10f19b.sys [x]
R1 MpKsl611b781c;MpKsl611b781c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F92655F0-E950-41D2-9A69-16B9B0FE8DA2}\MpKsl611b781c.sys [x]
R1 MpKsl7ef7f136;MpKsl7ef7f136;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl7ef7f136.sys [x]
R1 MpKsl839f98c0;MpKsl839f98c0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDD07E11-D4FF-4FED-8216-F2E4D48BB796}\MpKsl839f98c0.sys [x]
R1 MpKsl8da3e58f;MpKsl8da3e58f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7ED5FEED-F0CF-46FB-81E6-BC3BC257B3F2}\MpKsl8da3e58f.sys [x]
R1 MpKsl96dbd9f4;MpKsl96dbd9f4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8C3C220E-0FA1-4F8F-AC7E-050E0B9D9842}\MpKsl96dbd9f4.sys [x]
R1 MpKslb25afb3e;MpKslb25afb3e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{066AB16D-592C-44FF-B844-DC92F0610FD9}\MpKslb25afb3e.sys [x]
R1 MpKslba588dc9;MpKslba588dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{323D5489-9767-4FB9-A682-E55818C461D5}\MpKslba588dc9.sys [x]
R1 MpKslc1001dc7;MpKslc1001dc7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8577FB7B-BB1E-433F-AF00-869FAAE2707E}\MpKslc1001dc7.sys [x]
R1 MpKslc5c6005e;MpKslc5c6005e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC50DEC2-39B7-4BCC-8D90-E31D01164CC8}\MpKslc5c6005e.sys [x]
R1 MpKslc9ece87f;MpKslc9ece87f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6DD39286-8E15-40FD-AE63-FDB221AFC30A}\MpKslc9ece87f.sys [x]
R1 MpKslcac9ff66;MpKslcac9ff66;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{886B2921-DE16-4BE2-A5C5-4E6AA5DF2BD8}\MpKslcac9ff66.sys [x]
R1 MpKslfb7619dc;MpKslfb7619dc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{963F00A0-2AA0-4308-A4D8-10DF1495480E}\MpKslfb7619dc.sys [x]
R1 mwvexreq;mwvexreq;c:\windows\system32\drivers\mwvexreq.sys [x]
R1 urdrjwgi;urdrjwgi;c:\windows\system32\drivers\urdrjwgi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 592596]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [2009-12-15 23424]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-12-15 101120]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vfs101x;vfs101x;c:\windows\system32\drivers\vfs101x.sys [2008-04-27 40752]
R3 WatAdminSvc;Slu×ba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-23 1343400]
S1 13424537;13424537;c:\windows\system32\DRIVERS\13424537.sys [2011-10-01 133208]
S1 MpKsl0191fdf7;MpKsl0191fdf7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl0191fdf7.sys [2011-10-01 28752]
S1 MpKsl73377441;MpKsl73377441;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl73377441.sys [2011-10-01 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [2009-03-03 79176]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-08-16 1798904]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-01-04 258180]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]
S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files\QUALCOMM\QDLService2k\QDLService2kHP.exe [2009-10-01 324688]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 495832]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2310612]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-01-07 1648188]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 qcfilterhp2k;Gobi 2000 USB Composite Device Filter Driver(03F0-251D);c:\windows\system32\DRIVERS\qcfilterhp2k.sys [2009-10-01 5248]
S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [2009-10-01 201728]
S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [2009-10-01 106368]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- OstatnÝ slu×by/ovladaŔe v pamýti ---
.
*NewlyCreated* - MPKSL73377441
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Dopl˛kovř sken -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.bing.com
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrßzek do za°ÝzenÝ &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat strßnku do za°ÝzenÝ &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
.
.
------- Asociace soubor¨ -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.
- - - - NEPLATN╔ POLOÄKY ODSTRAN╠N╔ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-HPADVISOR - c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKLM-Run-File Sanitizer - c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
SafeBoot-90070948.sys
MSConfigStartUp-SkinClock - c:\program files\Free Desktop Clock\DesktopClock.exe
MSConfigStartUp-TomTomHOME - c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
AddRemove-QipGuard - c:\users\Luk\AppData\Roaming\QipGuard\QipGuard.exe
.
.
.
--------------------- ZAMKNUT╔ KL═╚E V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navßzanÚ na bý×ÝcÝ procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(4920)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\program files\WIDCOMM\Bluetooth Software\btkeyind.dll
.
------------------------ JinÚ spuÜtenÚ procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero MediaHome 4\NMMediaServerService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Microsoft Office\Office12\OUTLOOK.EXE
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Java\jre6\bin\javaw.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe
c:\totalcmd\TOTALCMD.EXE
c:\program files\Opera\opera.exe
.
**************************************************************************
.
Celkovř Ŕas: 2011-10-01 23:05:57 - poŔÝtaŔ byl restartovßn
ComboFix-quarantined-files.txt 2011-10-01 21:05
.
P°ed spuÜtýnÝm: Volnřch bajt¨: 87á000á977á408
Po spuÜtýnÝ: Volnřch bajt¨: 86á706á343á936
.
- - End Of File - - CFE4BCA4BE0160603E411AEBA17AE9BD

Ještě dočistíme. Otevřte poznámkový blůok a zkopírujte do něj:

Collect::
c:\windows\system32\drivers\13424537.sys

Driver::
13424537

DirLook::
C:\a

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Hotovo. Vše vypadá že už je ok. Funguje i sdílení souborů které nefungovalo asi rok a musel jsem používat Nero Media center....

LOG přikládám. Vše hotovo????

ComboFix 11-10-01.03 - Luk 01.10.2011 23:42:09.2.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.1903.835 [GMT 2:00]
Spuštěný z: c:\users\Luk\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Luk\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\system32\drivers\13424537.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\13424537.sys
D:\Autorun.inf
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_13424537
-------\Service_13424537
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-01 do 2011-10-01 )))))))))))))))))))))))))))))))
.
.
2011-10-01 21:55 . 2011-10-01 21:55 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKslae73ba6c.sys
2011-10-01 21:54 . 2011-10-01 21:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-01 21:08 . 2011-10-01 21:08 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl3853ea50.sys
2011-10-01 21:08 . 2011-10-01 21:55 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\offreg.dll
2011-10-01 20:57 . 2011-10-01 21:56 -------- d-----w- c:\users\Luk\AppData\Local\temp
2011-10-01 20:40 . 2009-07-13 23:11 80896 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- c:\program files\trend micro
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- C:\rsit
2011-10-01 19:16 . 2011-10-01 20:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-10-01 19:16 . 2011-10-01 20:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-10-01 18:43 . 2011-09-12 23:14 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\mpengine.dll
2011-10-01 16:49 . 2011-10-01 16:49 -------- d-----w- C:\a
2011-09-09 17:30 . 2011-01-31 15:32 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FBF4D1E-1244-448B-B448-C597AA4C7F0A}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-29 16:30 . 2011-05-17 17:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-07-24 08:21 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-22 02:54 . 2011-08-10 21:04 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-07-22 02:48 . 2011-08-10 21:04 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-07-22 02:44 . 2011-08-10 21:04 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-16 04:27 . 2011-08-10 15:48 290816 ----a-w- c:\windows\system32\KernelBase.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-07-16 04:15 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17 . 2011-08-10 15:48 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-07-13 03:39 . 2011-08-02 05:55 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-09 04:29 . 2011-08-24 19:43 2048 ----a-w- c:\windows\system32\tzres.dll
2011-07-09 02:30 . 2011-08-10 15:48 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\a ----
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Infium"="c:\program files\QIP 2010\qip.exe" [2011-07-18 6812032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 166936]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-12-03 495711]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-01-04 254520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
c:\users\Luk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
JDownloader.lnk - c:\program files\JDownloader\JDownloader.exe [2009-10-26 214528]
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2010-7-22 845584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 04:01 180736 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE
.
R1 MpKsl04894cf5;MpKsl04894cf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5262A559-7F03-479A-96A0-F3C66AE34590}\MpKsl04894cf5.sys [x]
R1 MpKsl05ec6e77;MpKsl05ec6e77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D2633B9-3662-4856-91F8-57E56FDFB552}\MpKsl05ec6e77.sys [x]
R1 MpKsl0f8111ff;MpKsl0f8111ff;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6344FB45-D76E-4647-B97A-62F2BDED8A79}\MpKsl0f8111ff.sys [x]
R1 MpKsl1802e8bd;MpKsl1802e8bd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F1626873-FFF3-4D29-B601-F7B84A264FD3}\MpKsl1802e8bd.sys [x]
R1 MpKsl1fa80422;MpKsl1fa80422;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D156222-CC8A-4EDE-8171-9C5D5E19AAF1}\MpKsl1fa80422.sys [x]
R1 MpKsl3613ea25;MpKsl3613ea25;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{11C9DBAF-EE91-4629-9CCC-987EAB6CAF9B}\MpKsl3613ea25.sys [x]
R1 MpKsl426f3ed5;MpKsl426f3ed5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{982141BF-A85F-4F00-8340-6B555F2A27ED}\MpKsl426f3ed5.sys [x]
R1 MpKsl4a10f19b;MpKsl4a10f19b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D1DAE0B1-B1CE-41AD-98E2-70CC267FA284}\MpKsl4a10f19b.sys [x]
R1 MpKsl611b781c;MpKsl611b781c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F92655F0-E950-41D2-9A69-16B9B0FE8DA2}\MpKsl611b781c.sys [x]
R1 MpKsl7ef7f136;MpKsl7ef7f136;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl7ef7f136.sys [x]
R1 MpKsl839f98c0;MpKsl839f98c0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDD07E11-D4FF-4FED-8216-F2E4D48BB796}\MpKsl839f98c0.sys [x]
R1 MpKsl8da3e58f;MpKsl8da3e58f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7ED5FEED-F0CF-46FB-81E6-BC3BC257B3F2}\MpKsl8da3e58f.sys [x]
R1 MpKsl96dbd9f4;MpKsl96dbd9f4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8C3C220E-0FA1-4F8F-AC7E-050E0B9D9842}\MpKsl96dbd9f4.sys [x]
R1 MpKslb25afb3e;MpKslb25afb3e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{066AB16D-592C-44FF-B844-DC92F0610FD9}\MpKslb25afb3e.sys [x]
R1 MpKslba588dc9;MpKslba588dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{323D5489-9767-4FB9-A682-E55818C461D5}\MpKslba588dc9.sys [x]
R1 MpKslc1001dc7;MpKslc1001dc7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8577FB7B-BB1E-433F-AF00-869FAAE2707E}\MpKslc1001dc7.sys [x]
R1 MpKslc5c6005e;MpKslc5c6005e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC50DEC2-39B7-4BCC-8D90-E31D01164CC8}\MpKslc5c6005e.sys [x]
R1 MpKslc9ece87f;MpKslc9ece87f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6DD39286-8E15-40FD-AE63-FDB221AFC30A}\MpKslc9ece87f.sys [x]
R1 MpKslcac9ff66;MpKslcac9ff66;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{886B2921-DE16-4BE2-A5C5-4E6AA5DF2BD8}\MpKslcac9ff66.sys [x]
R1 MpKslfb7619dc;MpKslfb7619dc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{963F00A0-2AA0-4308-A4D8-10DF1495480E}\MpKslfb7619dc.sys [x]
R1 mwvexreq;mwvexreq;c:\windows\system32\drivers\mwvexreq.sys [x]
R1 urdrjwgi;urdrjwgi;c:\windows\system32\drivers\urdrjwgi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 592596]
R3 CFcatchme;CFcatchme;c:\users\Luk\AppData\Local\Temp\CFcatchme.sys [x]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [2009-12-15 23424]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-12-15 101120]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vfs101x;vfs101x;c:\windows\system32\drivers\vfs101x.sys [2008-04-27 40752]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-23 1343400]
S1 MpKsl3853ea50;MpKsl3853ea50;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl3853ea50.sys [2011-10-01 28752]
S1 MpKslae73ba6c;MpKslae73ba6c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKslae73ba6c.sys [2011-10-01 28752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [2009-03-03 79176]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-08-16 1798904]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-01-04 258180]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]
S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files\QUALCOMM\QDLService2k\QDLService2kHP.exe [2009-10-01 324688]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 495832]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2310612]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-01-07 1648188]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 qcfilterhp2k;Gobi 2000 USB Composite Device Filter Driver(03F0-251D);c:\windows\system32\DRIVERS\qcfilterhp2k.sys [2009-10-01 5248]
S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [2009-10-01 201728]
S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [2009-10-01 106368]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSLAE73BA6C
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.bing.com
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5384)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero MediaHome 4\NMMediaServerService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\conhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Java\jre6\bin\javaw.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\Microsoft Office\Office12\OUTLOOK.EXE
c:\windows\system32\sppsvc.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Opera\opera.exe
c:\totalcmd\TOTALCMD.EXE
.
**************************************************************************
.
Celkový čas: 2011-10-02 00:03:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-10-01 22:03
ComboFix2.txt 2011-10-01 21:05
.
Před spuštěním: Volných bajtů: 87 171 276 800
Po spuštění: Volných bajtů: 86 894 919 680
.
- - End Of File - - E30F65073039E0C5282BF691D9CBB49A
Nahr nˇ probŘhlo ŁspŘçnŘ

Smazáno, log vypadá čistý. Ještě bych doporučil nahradit Spybot něčím modernějším (např. SpywareTerminatorem).

OK, nahradil jsem, vyzkouším. Každopádně moc díky za bleskovou pomoc!! Vše šlape jak má, dokonce lépe!!

Nemáte zač!

Zdravím po pár dnech... Obávám se, že naše předchozí "čištění" udělalo navíc i nějakou škodu, pře nyní mi wondows 7 každou chvíli hlásí že nejsou pravé, stažení ověřovacího SW nepomůže, neboť při instalaci vyhodí chybu...

Aktualizace win nefungují (chyba: 80096001) a nejde aktualizovat ani Micr. Security essentials...

Prosím o pomoc. Díky moc. Luk

Stáhněte nový Combofgix a dejte nový log.

Díky.. Log jsem udělal a přikládám.

ComboFix 11-10-23.01 - Luk 23.10.2011 19:56:52.3.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.1903.1027 [GMT 2:00]
Spuštěný z: c:\users\Luk\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-23 do 2011-10-23 )))))))))))))))))))))))))))))))
.
.
2011-10-23 18:09 . 2011-10-23 18:09 -------- d-----w- c:\users\NeroMediaHomeUser.4.Luk-HP\AppData\Local\temp
2011-10-23 18:09 . 2011-10-23 18:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-23 14:38 . 2011-10-23 14:38 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKsl8f48a2ec.sys
2011-10-23 14:38 . 2011-10-23 14:38 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\offreg.dll
2011-10-23 13:03 . 2011-10-04 15:22 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5F346E0A-EA62-4B81-8A8B-CB2C167B9BC1}\gapaengine.dll
2011-10-23 13:02 . 2011-10-18 00:28 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\mpengine.dll
2011-10-23 10:21 . 2011-10-23 13:22 -------- d-----w- c:\programdata\AVAST Software
2011-10-23 10:21 . 2011-10-23 10:21 -------- d-----w- c:\program files\AVAST Software
2011-10-20 17:11 . 2011-10-23 12:54 -------- d-----w- c:\program files\CDex
2011-10-10 17:06 . 2011-10-10 17:06 -------- d-----w- c:\users\Luk\AppData\Local\Google
2011-10-10 17:06 . 2011-10-11 05:28 -------- d-----w- c:\program files\Google
2011-10-02 09:28 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-10-02 09:28 . 2011-10-23 13:27 -------- d-----w- c:\programdata\Spyware Terminator
2011-10-02 09:27 . 2011-10-23 12:54 -------- d-----w- c:\program files\Spyware Terminator
2011-10-01 20:57 . 2011-10-23 18:09 -------- d-----w- c:\users\Luk\AppData\Local\temp
2011-10-01 20:40 . 2009-07-13 23:11 80896 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- c:\program files\trend micro
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- C:\rsit
2011-10-01 19:16 . 2011-10-01 20:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-10-01 19:16 . 2011-10-01 20:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-23 12:57 . 2011-05-17 17:42 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-04 15:22 . 2011-03-25 17:03 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-09-12 23:14 . 2010-07-24 08:21 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Infium"="c:\program files\QIP 2010\qip.exe" [2011-07-18 6812032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 166936]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-12-03 495711]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-01-04 254520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-09-28 2775728]
"SpywareTerminatorUpdater"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-09-28 3609776]
.
c:\users\Luk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
JDownloader.lnk - c:\program files\JDownloader\JDownloader.exe [2009-10-26 214528]
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2010-7-22 845584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 04:01 180736 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE
.
R1 MpKsl04894cf5;MpKsl04894cf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5262A559-7F03-479A-96A0-F3C66AE34590}\MpKsl04894cf5.sys [x]
R1 MpKsl05ec6e77;MpKsl05ec6e77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D2633B9-3662-4856-91F8-57E56FDFB552}\MpKsl05ec6e77.sys [x]
R1 MpKsl0f8111ff;MpKsl0f8111ff;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6344FB45-D76E-4647-B97A-62F2BDED8A79}\MpKsl0f8111ff.sys [x]
R1 MpKsl10994d7b;MpKsl10994d7b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1A275CC8-DE74-40CC-A6CD-D4486038F761}\MpKsl10994d7b.sys [x]
R1 MpKsl1802e8bd;MpKsl1802e8bd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F1626873-FFF3-4D29-B601-F7B84A264FD3}\MpKsl1802e8bd.sys [x]
R1 MpKsl1fa80422;MpKsl1fa80422;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D156222-CC8A-4EDE-8171-9C5D5E19AAF1}\MpKsl1fa80422.sys [x]
R1 MpKsl3613ea25;MpKsl3613ea25;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{11C9DBAF-EE91-4629-9CCC-987EAB6CAF9B}\MpKsl3613ea25.sys [x]
R1 MpKsl426f3ed5;MpKsl426f3ed5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{982141BF-A85F-4F00-8340-6B555F2A27ED}\MpKsl426f3ed5.sys [x]
R1 MpKsl4a10f19b;MpKsl4a10f19b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D1DAE0B1-B1CE-41AD-98E2-70CC267FA284}\MpKsl4a10f19b.sys [x]
R1 MpKsl611b781c;MpKsl611b781c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F92655F0-E950-41D2-9A69-16B9B0FE8DA2}\MpKsl611b781c.sys [x]
R1 MpKsl7ef7f136;MpKsl7ef7f136;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl7ef7f136.sys [x]
R1 MpKsl839f98c0;MpKsl839f98c0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDD07E11-D4FF-4FED-8216-F2E4D48BB796}\MpKsl839f98c0.sys [x]
R1 MpKsl8da3e58f;MpKsl8da3e58f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7ED5FEED-F0CF-46FB-81E6-BC3BC257B3F2}\MpKsl8da3e58f.sys [x]
R1 MpKsl96dbd9f4;MpKsl96dbd9f4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8C3C220E-0FA1-4F8F-AC7E-050E0B9D9842}\MpKsl96dbd9f4.sys [x]
R1 MpKsla55f557b;MpKsla55f557b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1A275CC8-DE74-40CC-A6CD-D4486038F761}\MpKsla55f557b.sys [x]
R1 MpKslb25afb3e;MpKslb25afb3e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{066AB16D-592C-44FF-B844-DC92F0610FD9}\MpKslb25afb3e.sys [x]
R1 MpKslba588dc9;MpKslba588dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{323D5489-9767-4FB9-A682-E55818C461D5}\MpKslba588dc9.sys [x]
R1 MpKslc1001dc7;MpKslc1001dc7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8577FB7B-BB1E-433F-AF00-869FAAE2707E}\MpKslc1001dc7.sys [x]
R1 MpKslc5c6005e;MpKslc5c6005e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC50DEC2-39B7-4BCC-8D90-E31D01164CC8}\MpKslc5c6005e.sys [x]
R1 MpKslc9ece87f;MpKslc9ece87f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6DD39286-8E15-40FD-AE63-FDB221AFC30A}\MpKslc9ece87f.sys [x]
R1 MpKslcac9ff66;MpKslcac9ff66;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{886B2921-DE16-4BE2-A5C5-4E6AA5DF2BD8}\MpKslcac9ff66.sys [x]
R1 MpKslfb7619dc;MpKslfb7619dc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{963F00A0-2AA0-4308-A4D8-10DF1495480E}\MpKslfb7619dc.sys [x]
R1 mwvexreq;mwvexreq;c:\windows\system32\drivers\mwvexreq.sys [x]
R1 urdrjwgi;urdrjwgi;c:\windows\system32\drivers\urdrjwgi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 592596]
R3 CFcatchme;CFcatchme;c:\users\Luk\AppData\Local\Temp\CFcatchme.sys [x]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [2009-12-15 23424]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-12-15 101120]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vfs101x;vfs101x;c:\windows\system32\drivers\vfs101x.sys [2008-04-27 40752]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-23 1343400]
S1 MpKsl8f48a2ec;MpKsl8f48a2ec;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKsl8f48a2ec.sys [2011-10-23 28752]
S1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-06-21 32768]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [2009-03-03 79176]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-08-16 1798904]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-01-04 258180]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]
S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files\QUALCOMM\QDLService2k\QDLService2kHP.exe [2009-10-01 324688]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\Spyware Terminator\st_rsser.exe [2011-09-28 482992]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 495832]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2310612]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-01-07 1648188]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 qcfilterhp2k;Gobi 2000 USB Composite Device Filter Driver(03F0-251D);c:\windows\system32\DRIVERS\qcfilterhp2k.sys [2009-10-01 5248]
S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [2009-10-01 201728]
S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [2009-10-01 106368]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL8F48A2EC
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.bing.com
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-10-23 20:12:41
ComboFix-quarantined-files.txt 2011-10-23 18:12
ComboFix2.txt 2011-10-01 22:03
ComboFix3.txt 2011-10-01 21:05
.
Před spuštěním: Volných bajtů: 89 869 463 552
Po spuštění: Volných bajtů: 89 759 285 248
.
- - End Of File - - 297DEBDEADB29ABDB7B19B53338B6365

Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\drivers\mwvexreq.sys
c:\windows\system32\drivers\urdrjwgi.sys

Driver::
mwvexreq
urdrjwgi

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Hotovo, co teď?

ComboFix 11-10-23.01 - Luk 23.10.2011 21:01:26.4.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.1903.646 [GMT 2:00]
Spuštěný z: c:\users\Luk\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Luk\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_mwvexreq
-------\Service_urdrjwgi
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-23 do 2011-10-23 )))))))))))))))))))))))))))))))
.
.
2011-10-23 19:14 . 2011-10-23 19:14 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKslb752f965.sys
2011-10-23 19:12 . 2011-10-23 19:17 -------- d-----w- c:\users\NeroMediaHomeUser.4.Luk-HP\AppData\Local\temp
2011-10-23 19:12 . 2011-10-23 19:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-23 14:38 . 2011-10-23 14:38 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKsl8f48a2ec.sys
2011-10-23 14:38 . 2011-10-23 19:14 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\offreg.dll
2011-10-23 13:03 . 2011-10-04 15:22 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5F346E0A-EA62-4B81-8A8B-CB2C167B9BC1}\gapaengine.dll
2011-10-23 13:02 . 2011-10-18 00:28 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\mpengine.dll
2011-10-23 10:21 . 2011-10-23 13:22 -------- d-----w- c:\programdata\AVAST Software
2011-10-23 10:21 . 2011-10-23 10:21 -------- d-----w- c:\program files\AVAST Software
2011-10-20 17:11 . 2011-10-23 12:54 -------- d-----w- c:\program files\CDex
2011-10-10 17:06 . 2011-10-10 17:06 -------- d-----w- c:\users\Luk\AppData\Local\Google
2011-10-10 17:06 . 2011-10-11 05:28 -------- d-----w- c:\program files\Google
2011-10-02 09:28 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-10-02 09:28 . 2011-10-23 13:27 -------- d-----w- c:\programdata\Spyware Terminator
2011-10-02 09:27 . 2011-10-23 12:54 -------- d-----w- c:\program files\Spyware Terminator
2011-10-01 20:57 . 2011-10-23 19:17 -------- d-----w- c:\users\Luk\AppData\Local\temp
2011-10-01 20:40 . 2009-07-13 23:11 80896 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- c:\program files\trend micro
2011-10-01 19:39 . 2011-10-01 19:39 -------- d-----w- C:\rsit
2011-10-01 19:16 . 2011-10-01 20:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-10-01 19:16 . 2011-10-01 20:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-23 12:57 . 2011-05-17 17:42 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-04 15:22 . 2011-03-25 17:03 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-09-12 23:14 . 2010-07-24 08:21 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Infium"="c:\program files\QIP 2010\qip.exe" [2011-07-18 6812032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 166936]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-12-03 495711]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-01-04 254520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-09-28 2775728]
"SpywareTerminatorUpdater"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-09-28 3609776]
.
c:\users\Luk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
JDownloader.lnk - c:\program files\JDownloader\JDownloader.exe [2009-10-26 214528]
Microsoft Office Outlook 2007.lnk - c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe [2010-7-22 845584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4400 Series]
2007-03-01 04:01 180736 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE
.
R1 MpKsl04894cf5;MpKsl04894cf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5262A559-7F03-479A-96A0-F3C66AE34590}\MpKsl04894cf5.sys [x]
R1 MpKsl05ec6e77;MpKsl05ec6e77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D2633B9-3662-4856-91F8-57E56FDFB552}\MpKsl05ec6e77.sys [x]
R1 MpKsl0f8111ff;MpKsl0f8111ff;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6344FB45-D76E-4647-B97A-62F2BDED8A79}\MpKsl0f8111ff.sys [x]
R1 MpKsl10994d7b;MpKsl10994d7b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1A275CC8-DE74-40CC-A6CD-D4486038F761}\MpKsl10994d7b.sys [x]
R1 MpKsl1802e8bd;MpKsl1802e8bd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F1626873-FFF3-4D29-B601-F7B84A264FD3}\MpKsl1802e8bd.sys [x]
R1 MpKsl1fa80422;MpKsl1fa80422;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D156222-CC8A-4EDE-8171-9C5D5E19AAF1}\MpKsl1fa80422.sys [x]
R1 MpKsl3613ea25;MpKsl3613ea25;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{11C9DBAF-EE91-4629-9CCC-987EAB6CAF9B}\MpKsl3613ea25.sys [x]
R1 MpKsl426f3ed5;MpKsl426f3ed5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{982141BF-A85F-4F00-8340-6B555F2A27ED}\MpKsl426f3ed5.sys [x]
R1 MpKsl4a10f19b;MpKsl4a10f19b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D1DAE0B1-B1CE-41AD-98E2-70CC267FA284}\MpKsl4a10f19b.sys [x]
R1 MpKsl611b781c;MpKsl611b781c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F92655F0-E950-41D2-9A69-16B9B0FE8DA2}\MpKsl611b781c.sys [x]
R1 MpKsl7ef7f136;MpKsl7ef7f136;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E55E1FB8-E64A-4C0E-BA90-3BADA19DDF86}\MpKsl7ef7f136.sys [x]
R1 MpKsl839f98c0;MpKsl839f98c0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDD07E11-D4FF-4FED-8216-F2E4D48BB796}\MpKsl839f98c0.sys [x]
R1 MpKsl8da3e58f;MpKsl8da3e58f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7ED5FEED-F0CF-46FB-81E6-BC3BC257B3F2}\MpKsl8da3e58f.sys [x]
R1 MpKsl96dbd9f4;MpKsl96dbd9f4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8C3C220E-0FA1-4F8F-AC7E-050E0B9D9842}\MpKsl96dbd9f4.sys [x]
R1 MpKsla55f557b;MpKsla55f557b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1A275CC8-DE74-40CC-A6CD-D4486038F761}\MpKsla55f557b.sys [x]
R1 MpKslb25afb3e;MpKslb25afb3e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{066AB16D-592C-44FF-B844-DC92F0610FD9}\MpKslb25afb3e.sys [x]
R1 MpKslba588dc9;MpKslba588dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{323D5489-9767-4FB9-A682-E55818C461D5}\MpKslba588dc9.sys [x]
R1 MpKslc1001dc7;MpKslc1001dc7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8577FB7B-BB1E-433F-AF00-869FAAE2707E}\MpKslc1001dc7.sys [x]
R1 MpKslc5c6005e;MpKslc5c6005e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC50DEC2-39B7-4BCC-8D90-E31D01164CC8}\MpKslc5c6005e.sys [x]
R1 MpKslc9ece87f;MpKslc9ece87f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6DD39286-8E15-40FD-AE63-FDB221AFC30A}\MpKslc9ece87f.sys [x]
R1 MpKslcac9ff66;MpKslcac9ff66;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{886B2921-DE16-4BE2-A5C5-4E6AA5DF2BD8}\MpKslcac9ff66.sys [x]
R1 MpKslfb7619dc;MpKslfb7619dc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{963F00A0-2AA0-4308-A4D8-10DF1495480E}\MpKslfb7619dc.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 592596]
R3 CFcatchme;CFcatchme;c:\users\Luk\AppData\Local\Temp\CFcatchme.sys [x]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [2009-12-15 23424]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-12-15 101120]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 vfs101x;vfs101x;c:\windows\system32\drivers\vfs101x.sys [2008-04-27 40752]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-23 1343400]
S1 MpKsl8f48a2ec;MpKsl8f48a2ec;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKsl8f48a2ec.sys [2011-10-23 28752]
S1 MpKslb752f965;MpKslb752f965;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F632EB04-0B45-4792-BDE9-27FABC6A58D1}\MpKslb752f965.sys [2011-10-23 28752]
S1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-06-21 32768]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [2009-03-03 79176]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-08-16 1798904]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-01-04 258180]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]
S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files\QUALCOMM\QDLService2k\QDLService2kHP.exe [2009-10-01 324688]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\Spyware Terminator\st_rsser.exe [2011-09-28 482992]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 495832]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2310612]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-01-07 1648188]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 qcfilterhp2k;Gobi 2000 USB Composite Device Filter Driver(03F0-251D);c:\windows\system32\DRIVERS\qcfilterhp2k.sys [2009-10-01 5248]
S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [2009-10-01 201728]
S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [2009-10-01 106368]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSLB752F965
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.bing.com
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(5468)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero MediaHome 4\NMMediaServerService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Java\jre6\bin\javaw.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\Microsoft Office\Office12\OUTLOOK.EXE
c:\windows\system32\sppsvc.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-10-23 21:22:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-10-23 19:22
ComboFix2.txt 2011-10-23 18:12
ComboFix3.txt 2011-10-01 22:03
ComboFix4.txt 2011-10-01 21:05
.
Před spuštěním: Volných bajtů: 89 899 532 288
Po spuštění: Volných bajtů: 89 624 911 872
.
- - End Of File - - 8F713ABE22E6BF425C3BFE8CF2CF529F

Tento log je již čistý. Ještě poprosím o log z Hijackthis: http://www.hijackthis.cz/download/hijackthis.exe .

přikládám log: (btw. zdá se mi že PC pořád něco dělá, chlazení hučí, hdd bliká a to jsem na tom hodinu nebyl u čuměl na tv)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:36:43, on 23.10.2011
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\QIP 2010\qip.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Spyware Terminator\st_rsser.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\windows\system32\SearchFilterHost.exe
C:\Users\Luk\AppData\Local\Opera\Opera\temporary_downloads\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Luk\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Luk\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [QLBController] C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe /start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Nero MediaHome 4] "C:\Program Files\Nero\Nero MediaHome 4\NeroMediaHome.exe" /AUTORUN
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SpywareTerminatorShield] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
O4 - HKLM\..\Run: [SpywareTerminatorUpdater] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Infium] "C:\Program Files\QIP 2010\qip.exe" /autorun
O4 - HKUS\S-1-5-21-3319436564-1632374057-2738735114-1007\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NeroMediaHomeUser.4')
O4 - HKUS\S-1-5-21-3319436564-1632374057-2738735114-1007\..\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN (User 'NeroMediaHomeUser.4')
O4 - HKUS\S-1-5-21-3319436564-1632374057-2738735114-1007\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NeroMediaHomeUser.4')
O4 - Startup: JDownloader.lnk = C:\Program Files\JDownloader\JDownloader.exe
O4 - Startup: Microsoft Office Outlook 2007.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zaøízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zaøízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.mcafee.com (HKLM)
O15 - Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://www.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://*.mcafee.com (HKLM)
O15 - ESC Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://www.mcafeeasap.com (HKLM)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Program Files\Fingerprint Sensor\AtService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: HP Health Check Service - Unknown owner - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (file missing)
O23 - Service: HP Hotkey Monitor (hpHotkeyMonitor) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
O23 - Service: hpqwmiex - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Nero MediaHome 4 Service (NeroMediaHomeService.4) - Nero AG - C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Qualcomm Gobi 2000 Download Service (HP) (QDLService2kHP) - QUALCOMM, Inc. - C:\Program Files\QUALCOMM\QDLService2k\QDLService2kHP.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files\Spyware Terminator\st_rsser.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe
O23 - Service: ArcCapture (uArcCapture) - ArcSoft, Inc. - C:\windows\system32\uArcCapture.exe
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: Validity VCS Fingerprint Service (vcsFPService) - Validity Sensors, Inc. - C:\windows\system32\vcsFPService.exe
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\windows\system32\vfsFPService.exe

--
End of file - 10463 bytes