Podozrenie na "havěť", kleslo fps !!

Zpráva

srogi · #1 Příspěvek od **srogi** » 14 lis 2011 17:30

Zdravím, mám problém s tým, že keď hrám hru CS 1.6, kleslo mi fps zo 100 na 30 z ničoho nič... Pýtal som sa na to všade, čítal návody atď. a nakoniec mi kamarát poradil,že to bude tým,že mám nejakú havěť v pc. Vraj tomu naznačujú aj procesy, myslím že smss.exe

... Potrebujem rýchlu pomoc na odstánenie týchlo havěďí

... Ďakujem

#2 Příspěvek od **Rudy** » 14 lis 2011 18:12

Také zdravím!
Dejte log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 . Musím vás ale upozornit, že vám zde pouze zkontrolujeme a příp. vyčistíme od havěti. Problematiku her, jako takových, neřešíme.

srogi · #3 Příspěvek od **srogi** » 14 lis 2011 18:22

To mi je jasné, ja som dostal pokyn, že to fps bude hlavne tým že ten červ či čo to je,že to mi dačo žere a spomaľuje to..

srogi · #4 Příspěvek od **srogi** » 14 lis 2011 18:27

Logfile of random's system information tool 1.09 (written by random/random)
Run by Doma at 2011-11-14 18:25:12
Microsoft Windows 7 Home Premium
System drive C: has 11 GB (14%) free of 76 GB
Total RAM: 3583 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:25:25, on 14. 11. 2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Doma\Downloads\RSIT.exe
C:\Program Files\trend micro\Doma.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SFT_eng7 Toolbar - {08d6b0b4-c132-470d-a8e2-aa2e9c3851c9} - C:\Program Files\SFT_eng7\prxtbSFT0.dll
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (file missing)
R3 - URLSearchHook: BrotherSoft Extreme Toolbar - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\prxtbBrot.dll (file missing)
O2 - BHO: SFT_eng7 - {08d6b0b4-c132-470d-a8e2-aa2e9c3851c9} - C:\Program Files\SFT_eng7\prxtbSFT0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: BrotherSoft Extreme - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\prxtbBrot.dll (file missing)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: uTorrentBar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (file missing)
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: SFT_eng7 Toolbar - {08d6b0b4-c132-470d-a8e2-aa2e9c3851c9} - C:\Program Files\SFT_eng7\prxtbSFT0.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (file missing)
O3 - Toolbar: BrotherSoft Extreme Toolbar - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\prxtbBrot.dll (file missing)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Standby] "C:\Program Files\Common Files\Corel\Standby\Standby.exe" -START
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LightShot] C:\Users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Virtuální klávesnice - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: K&ontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Jewelry%20Secret%20-%20Mystery%20Stones/Images/stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/The%20Mysterious%20City%20-%20Cairo/Images/armhelper.ocx
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\sims2\PB\PnkBstrA.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 11397 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\update-S-1-5-21-2482014332-175635240-3155644157-1000.job
C:\Windows\tasks\update-sys.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... ource=2&q="

"{4B3803EA-5230-4DC3-A7FC-33638F3D3542}"=C:\Program Files\Crawler\firefox\
"linkfilter@kaspersky.ru"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
"virtualKeyboard@kaspersky.ru"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
"KavAntiBanner@Kaspersky.ru"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
crawlersrch.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default\extensions\
{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}
{394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}
{51a86bb3-6602-4c85-92a5-130ee4864f13}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
SFT_eng7 Toolbar - C:\Program Files\SFT_eng7\prxtbSFT0.dll [2011-03-28 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
&Crawler Toolbar Helper - C:\PROGRA~1\Crawler\ctbr.dll [2011-07-13 1237128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-03-28 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51a86bb3-6602-4c85-92a5-130ee4864f13}]
BrotherSoft Extreme Toolbar - C:\Program Files\BrotherSoft_Extreme\prxtbBrot.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll [2011-04-24 86416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2011-05-13 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-08-16 3942048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
uTorrentBar Toolbar - C:\Program Files\uTorrentBar\prxtbuTor.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll [2011-04-24 229776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\ctbr.dll [2011-07-13 1237128]
{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9} - SFT_eng7 Toolbar - C:\Program Files\SFT_eng7\prxtbSFT0.dll [2011-03-28 176936]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-03-28 176936]
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - uTorrentBar Toolbar - C:\Program Files\uTorrentBar\prxtbuTor.dll []
{51a86bb3-6602-4c85-92a5-130ee4864f13} - BrotherSoft Extreme Toolbar - C:\Program Files\BrotherSoft_Extreme\prxtbBrot.dll []
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-05-20 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-05-20 174104]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-05-20 151064]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-11-19 9874024]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-08-18 2216960]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-09-08 343168]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Standby"=C:\Program Files\Common Files\Corel\Standby\Standby.exe [2009-12-17 105632]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [2011-04-24 202296]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-08-18 3318784]
"Steam"=C:\Program Files\Steam\steam.exe [2011-08-19 1242448]
"AdobeBridge"= []
"msnmsgr"=~C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background []
"LightShot"=C:\Users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe [2011-03-16 195072]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06 500208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe -launchedbylogin []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-15 1955208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nero DriveSpeed]
C:\PROGRA~1\Nero\NERO7~1\NEROTO~1\DRIVES~1.EXE [2007-07-03 1312040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2011-06-15 307200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2011-07-29 17361032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\SweetIM\Messenger\SweetIM.exe [2011-08-01 114992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2011-08-19 639864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
C:\PROGRA~1\MCAFEE~1\202B13~1.181\SSSCHE~1.EXE [2010-01-15 255536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-05-20 216576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\Windows\system32\klogon.dll [2011-04-24 229776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.l3fhg"=mp3fhg.acm
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"VIDC.FFDS"=ff_vfw.dll
"VIDC.FPS1"=frapsvid.dll
"vidc.VP60"=C:\Windows\system32\vp6vfw.dll
"vidc.VP61"=C:\Windows\system32\vp6vfw.dll
"msacm.siren"=sirenacm.dll
"vidc.mjpg"=bdmjpeg.dll
"vidc.mpeg"=bdmpegv.dll
"msacm.bdmpeg"=bdmpega.acm
"msacm.dvacm"=C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-11-14 18:25:13 ----D---- C:\Program Files\trend micro
2011-11-14 18:25:12 ----D---- C:\rsit
2011-11-14 15:57:32 ----D---- C:\Avenger
2011-11-14 15:57:32 ----A---- C:\avenger.txt
2011-11-13 17:50:06 ----A---- C:\Windows\system32\drivers\klin.dat
2011-11-13 17:50:06 ----A---- C:\Windows\system32\drivers\klick.dat
2011-11-13 17:47:19 ----D---- C:\Program Files\Kaspersky Lab
2011-11-13 17:47:18 ----D---- C:\ProgramData\Kaspersky Lab
2011-11-13 17:46:52 ----A---- C:\Windows\system32\drivers\klif.sys
2011-11-12 15:00:55 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2011-11-12 15:00:55 ----A---- C:\Windows\system32\PresentationHost.exe
2011-11-12 15:00:55 ----A---- C:\Windows\system32\netfxperf.dll
2011-11-12 15:00:54 ----A---- C:\Windows\system32\mscoree.dll
2011-11-12 15:00:54 ----A---- C:\Windows\system32\dfshim.dll
2011-11-12 13:33:38 ----D---- C:\Program Files\select_path_to_counter-strike
2011-11-08 16:23:40 ----D---- C:\Windows\pss
2011-10-31 17:08:16 ----D---- C:\Users\Doma\AppData\Roaming\Gold Casual Games
2011-10-31 17:08:16 ----D---- C:\ProgramData\Gold Casual Games
2011-10-31 17:03:28 ----D---- C:\Users\Doma\AppData\Roaming\SpinTop
2011-10-31 16:48:03 ----D---- C:\BigFishGamesCache
2011-10-30 10:45:29 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2011-10-30 10:39:58 ----D---- C:\Program Files\Adobe Media Player
2011-10-29 19:10:36 ----D---- C:\Program Files\LogMeIn Hamachi
2011-10-29 17:33:09 ----RSH---- C:\ProgramData\3A65BB9108.sys
2011-10-29 17:33:07 ----ASH---- C:\ProgramData\KGyGaAvL.sys
2011-10-29 17:24:11 ----D---- C:\Program Files\Corel
2011-10-27 07:48:38 ----D---- C:\Program Files\Common Files\Java
2011-10-27 07:48:12 ----A---- C:\Windows\system32\javaws.exe
2011-10-27 07:48:12 ----A---- C:\Windows\system32\javaw.exe
2011-10-27 07:48:12 ----A---- C:\Windows\system32\java.exe
2011-10-25 18:09:56 ----D---- C:\Program Files\FileZilla FTP Client
2011-10-23 18:14:41 ----D---- C:\Users\Doma\AppData\Roaming\Kastner software
2011-10-23 17:57:25 ----D---- C:\ProgramData\KASTNER software
2011-10-23 17:57:25 ----D---- C:\Program Files\KASTNER software
2011-10-16 11:09:59 ----D---- C:\ProgramData\Trymedia

======List of files/folders modified in the last 1 month======

2011-11-14 18:25:18 ----D---- C:\Windows\Temp
2011-11-14 18:25:13 ----RD---- C:\Program Files
2011-11-14 18:12:39 ----D---- C:\Program Files\Steam
2011-11-14 18:03:01 ----D---- C:\Users\Doma\AppData\Roaming\TS3Client
2011-11-14 16:04:48 ----D---- C:\Windows\System32
2011-11-14 16:04:48 ----D---- C:\Windows\inf
2011-11-14 16:04:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-11-14 15:57:32 ----D---- C:\Windows\system32\drivers
2011-11-14 15:44:48 ----D---- C:\ProgramData\Spyware Terminator
2011-11-14 15:44:48 ----D---- C:\Program Files\WinClamAVShield
2011-11-14 15:40:37 ----D---- C:\Windows
2011-11-13 22:02:55 ----D---- C:\Users\Doma\AppData\Roaming\Skype
2011-11-13 20:45:14 ----SD---- C:\Users\Doma\AppData\Roaming\Microsoft
2011-11-13 19:34:12 ----SHD---- C:\System Volume Information
2011-11-13 17:59:53 ----D---- C:\Users\Doma\AppData\Roaming\Ventrilo
2011-11-13 17:59:53 ----D---- C:\Users\Doma\AppData\Roaming\uTorrent
2011-11-13 17:59:44 ----D---- C:\Users\Doma\AppData\Roaming\FileZilla
2011-11-13 17:58:37 ----D---- C:\Windows\Minidump
2011-11-13 17:58:37 ----D---- C:\Windows\Logs
2011-11-13 17:58:37 ----D---- C:\Windows\debug
2011-11-13 17:50:36 ----SHD---- C:\Windows\Installer
2011-11-13 17:49:00 ----D---- C:\Windows\system32\catroot
2011-11-13 17:48:36 ----D---- C:\Windows\system32\DriverStore
2011-11-13 17:47:18 ----HD---- C:\ProgramData
2011-11-13 16:26:36 ----D---- C:\Program Files\Common Files\Steam
2011-11-13 09:35:50 ----D---- C:\Windows\Prefetch
2011-11-13 08:10:02 ----RSD---- C:\Windows\assembly
2011-11-13 08:10:02 ----D---- C:\Windows\Microsoft.NET
2011-11-12 15:41:54 ----D---- C:\Program Files\Crawler
2011-11-12 15:26:34 ----D---- C:\Windows\system32\config
2011-11-12 15:10:46 ----D---- C:\Windows\winsxs
2011-11-12 15:05:02 ----D---- C:\Windows\system32\en-US
2011-11-12 15:04:52 ----D---- C:\Program Files\Microsoft.NET
2011-11-12 15:01:09 ----D---- C:\Windows\SoftwareDistribution
2011-11-09 19:14:18 ----D---- C:\ProgramData\Big Fish Games
2011-11-04 16:05:06 ----RSD---- C:\Windows\Fonts
2011-11-01 09:13:41 ----D---- C:\Windows\system32\catroot2
2011-10-31 20:08:46 ----D---- C:\Windows\Downloaded Program Files
2011-10-31 17:39:15 ----AD---- C:\ProgramData\TEMP
2011-10-31 08:47:26 ----D---- C:\ProgramData\Adobe
2011-10-30 10:57:25 ----D---- C:\Windows\system32\Tasks
2011-10-30 10:53:11 ----D---- C:\Users\Doma\AppData\Roaming\Adobe
2011-10-30 10:42:57 ----D---- C:\Program Files\Common Files\Adobe
2011-10-30 10:38:35 ----D---- C:\Program Files\Adobe
2011-10-30 08:08:53 ----D---- C:\Fraps
2011-10-29 17:51:54 ----D---- C:\Users\Doma\AppData\Roaming\Ulead Systems
2011-10-29 17:36:12 ----D---- C:\Users\Doma\AppData\Roaming\Corel
2011-10-29 17:25:11 ----HD---- C:\Windows\msdownld.tmp
2011-10-29 17:24:12 ----D---- C:\ProgramData\Ulead Systems
2011-10-29 17:23:22 ----D---- C:\ProgramData\Corel
2011-10-29 17:18:13 ----D---- C:\Program Files\Common Files\Corel
2011-10-27 07:48:38 ----D---- C:\Program Files\Common Files
2011-10-27 07:48:02 ----D---- C:\Program Files\Java
2011-10-23 19:25:48 ----D---- C:\Users\Doma\AppData\Roaming\.minecraft
2011-10-17 20:11:13 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 KL1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2011-03-04 133208]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 kl2;kl2; C:\Windows\system32\DRIVERS\kl2.sys [2011-03-04 11352]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2011-11-13 570160]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2011-03-10 23856]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2011-06-15 60156]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2011-08-18 142592]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-09-08 8606208]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-09-08 248832]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2011-06-06 211984]
R3 bbcap;bbcap; C:\Windows\system32\DRIVERS\bbcap.sys [2011-08-21 4096]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-11-23 3253352]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-07-13 50688]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2011-05-13 39272]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2010-05-20 5924864]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-09-08 176128]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 1361288]
R2 PnkBstrA;PunkBuster; D:\sims2\PB\PnkBstrA.exe [2008-10-23 63040]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2010-03-10 189728]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\BingBar\SeaPort.EXE [2011-03-28 249648]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-08-18 496128]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 1713536]
S2 AVP;Služba Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [2011-04-24 202296]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
S3 BBSvc;Bing Bar Update Service; C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2011-05-13 1492840]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-02-08 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2011-11-13 419624]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------

#5 Příspěvek od **Rudy** » 14 lis 2011 18:39

Něco tam je. Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

srogi · #6 Příspěvek od **srogi** » 14 lis 2011 21:11

Mal som trošku problém, ale nakoniec sa to podarilo

...

ComboFix 11-11-14.02 - Doma . 11. 2011 20:33:22.2.1 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3583.2787 [GMT 1:00]
Running from: c:\users\Doma\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue
.
---- Previous Run -------
.
c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue
.
.
((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))
.
.
2011-11-14 19:51 . 2011-11-14 19:55 -------- d-----w- c:\users\Doma\AppData\Local\temp
2011-11-14 19:51 . 2011-11-14 19:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-14 17:25 . 2011-11-14 17:25 -------- d-----w- c:\program files\trend micro
2011-11-14 17:25 . 2011-11-14 17:25 -------- d-----w- C:\rsit
2011-11-13 16:50 . 2011-11-13 20:44 97961 ----a-w- c:\windows\system32\drivers\klick.dat
2011-11-13 16:50 . 2011-11-13 20:44 115369 ----a-w- c:\windows\system32\drivers\klin.dat
2011-11-13 16:47 . 2011-11-13 16:47 -------- d-----w- c:\program files\Kaspersky Lab
2011-11-13 16:47 . 2011-11-14 19:55 -------- d-----w- c:\programdata\Kaspersky Lab
2011-11-12 14:00 . 2009-11-25 19:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-11-12 14:00 . 2009-11-25 19:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-11-12 14:00 . 2009-11-25 19:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-11-12 14:00 . 2009-11-25 19:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-11-12 14:00 . 2009-11-25 19:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-11-12 12:33 . 2011-11-12 12:33 -------- d-----w- c:\program files\select_path_to_counter-strike
2011-10-31 19:08 . 2011-10-31 19:08 -------- d-----w- c:\users\Doma\AppData\Local\Color-Brush
2011-10-31 16:08 . 2011-10-31 16:08 -------- d-----w- c:\users\Doma\AppData\Roaming\Gold Casual Games
2011-10-31 16:08 . 2011-10-31 16:08 -------- d-----w- c:\programdata\Gold Casual Games
2011-10-31 16:03 . 2011-10-31 16:03 -------- d-----w- c:\users\Doma\AppData\Roaming\SpinTop
2011-10-31 15:48 . 2011-11-09 18:14 -------- d-----w- C:\BigFishGamesCache
2011-10-30 09:53 . 2011-10-30 09:53 -------- d-----w- c:\users\Public\Roaming
2011-10-30 09:45 . 2011-10-30 09:45 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2011-10-30 09:39 . 2011-10-30 09:39 -------- d-----w- c:\program files\Adobe Media Player
2011-10-29 18:13 . 2011-11-08 15:19 -------- d-----w- c:\users\Doma\AppData\Local\LogMeIn Hamachi
2011-10-29 18:10 . 2011-10-29 18:10 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-10-29 16:33 . 2011-10-29 16:35 88 --sh--r- c:\programdata\3A65BB9108.sys
2011-10-29 16:33 . 2011-10-29 16:53 5018 --sha-w- c:\programdata\KGyGaAvL.sys
2011-10-29 16:24 . 2011-10-29 16:24 -------- d-----w- c:\program files\Corel
2011-10-29 15:08 . 2011-10-29 15:08 -------- d-----w- c:\users\Doma\AppData\Local\NOS
2011-10-27 06:48 . 2011-10-27 06:48 -------- d-----w- c:\program files\Common Files\Java
2011-10-25 17:09 . 2011-10-25 17:10 -------- d-----w- c:\program files\FileZilla FTP Client
2011-10-23 17:14 . 2011-10-23 17:14 -------- d-----w- c:\users\Doma\AppData\Roaming\Kastner software
2011-10-23 16:57 . 2011-10-23 16:57 -------- d-----w- c:\programdata\KASTNER software
2011-10-23 16:57 . 2011-10-23 16:57 -------- d-----w- c:\program files\KASTNER software
2011-10-17 19:11 . 2011-09-29 00:26 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-10-17 19:11 . 2011-09-29 00:26 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-10-16 10:09 . 2011-10-16 10:09 -------- d-----w- c:\programdata\Trymedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-01 19:14 . 2011-08-19 18:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 03:06 . 2011-08-19 11:03 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-02 15:00 . 2011-08-20 18:24 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2011-10-02 15:00 . 2011-08-20 18:24 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2011-10-01 14:30 . 2011-10-01 14:35 737280 ----a-w- c:\windows\iun6002.exe
2011-09-14 09:47 . 2011-09-14 09:47 53760 ----a-w- c:\windows\system32\OVDecode.dll
2011-09-14 09:47 . 2011-09-14 09:47 43520 ----a-w- c:\windows\system32\OpenCL.dll
2011-09-14 09:46 . 2011-09-14 09:46 13625856 ----a-w- c:\windows\system32\amdocl.dll
2011-09-14 09:38 . 2011-09-14 09:38 37376 ----a-w- c:\windows\system32\amdoclcl.dll
2011-09-12 13:39 . 2011-03-28 16:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-09-08 18:26 . 2011-09-08 18:26 8606208 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-09-08 17:39 . 2011-09-08 17:39 18534912 ----a-w- c:\windows\system32\atioglxx.dll
2011-09-08 17:34 . 2011-09-08 17:34 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-09-08 17:34 . 2011-03-10 02:54 732672 ----a-w- c:\windows\system32\aticfx32.dll
2011-09-08 17:30 . 2011-09-08 17:30 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-09-08 17:30 . 2011-09-08 17:30 401408 ----a-w- c:\windows\system32\atieclxx.exe
2011-09-08 17:29 . 2011-09-08 17:29 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2011-09-08 17:28 . 2011-09-08 17:28 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2011-09-08 17:28 . 2011-09-08 17:28 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2011-09-08 17:28 . 2011-09-08 17:28 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2011-09-08 17:28 . 2011-09-08 17:28 20992 ----a-w- c:\windows\system32\atimuixx.dll
2011-09-08 17:28 . 2011-09-08 17:28 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-09-08 17:24 . 2011-03-10 02:46 4204032 ----a-w- c:\windows\system32\atidxx32.dll
2011-09-08 17:18 . 2011-09-08 17:18 1828864 ----a-w- c:\windows\system32\atiumdmv.dll
2011-09-08 17:09 . 2011-09-08 17:09 46080 ----a-w- c:\windows\system32\aticalrt.dll
2011-09-08 17:09 . 2011-09-08 17:09 44032 ----a-w- c:\windows\system32\aticalcl.dll
2011-09-08 17:08 . 2011-03-10 02:21 4064768 ----a-w- c:\windows\system32\atiumdva.dll
2011-09-08 17:05 . 2011-09-08 17:05 7331840 ----a-w- c:\windows\system32\aticaldd.dll
2011-09-08 17:05 . 2011-03-10 02:28 4289024 ----a-w- c:\windows\system32\atiumdag.dll
2011-09-08 16:59 . 2011-08-18 20:29 52736 ----a-w- c:\windows\system32\coinst.dll
2011-09-08 16:53 . 2011-09-08 16:53 270336 ----a-w- c:\windows\system32\atiadlxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 13312 ----a-w- c:\windows\system32\atiglpxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 32768 ----a-w- c:\windows\system32\atigktxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 248832 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-09-08 16:51 . 2011-03-10 02:14 31744 ----a-w- c:\windows\system32\atiuxpag.dll
2011-09-08 16:51 . 2011-03-10 02:14 29184 ----a-w- c:\windows\system32\atiu9pag.dll
2011-09-08 16:51 . 2011-09-08 16:51 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\atimpc32.dll
2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2011-08-30 15:43 . 2011-08-30 15:43 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2011-08-30 13:55 . 2011-08-30 13:55 183112 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-30 13:50 . 2011-08-30 13:50 1174 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-21 18:23 . 2011-08-21 18:23 4608 ----a-w- c:\windows\system32\bbchlp.dll
2011-08-21 18:23 . 2011-08-21 18:23 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2011-08-21 18:23 . 2011-08-21 18:23 30720 ----a-w- c:\windows\system32\bbcap.dll
2011-08-20 10:19 . 2011-08-19 10:51 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-18 20:58 . 2011-08-18 20:58 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-29 07:32 . 2011-08-18 20:47 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
2011-03-28 16:22 176936 ----a-w- c:\program files\SFT_eng7\prxtbSFT0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{08D6B0B4-C132-470D-A8E2-AA2E9C3851C9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-08-18 3318784]
"Steam"="c:\program files\Steam\steam.exe" [2011-08-19 1242448]
"LightShot"="c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe" [2011-03-16 195072]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-20 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-20 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-20 151064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-19 9874024]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-08-18 2216960]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 343168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Standby"="c:\program files\Common Files\Corel\Standby\Standby.exe" [2009-12-17 105632]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 02:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-27 17:03 152872 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-08-15 14:18 1955208 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nero DriveSpeed]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2011-06-15 06:19 307200 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-07-29 10:31 17361032 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
2011-08-01 12:35 114992 ----a-r- c:\program files\SweetIM\Messenger\SweetIM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-08-19 11:40 639864 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 23856]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-08-18 142592]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-09-08 176128]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 1361288]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-09-08 8606208]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-09-08 248832]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-06-06 211984]
S3 bbcap;bbcap;c:\windows\system32\DRIVERS\bbcap.sys [2011-08-21 4096]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-13 50688]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 19:45]
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 19:45]
.
2011-11-14 c:\windows\Tasks\update-S-1-5-21-2482014332-175635240-3155644157-1000.job
- c:\program files\Skillbrains\Updater\Updater.exe [2011-10-09 20:09]
.
2011-11-14 c:\windows\Tasks\update-sys.job
- c:\program files\Skillbrains\Updater\Updater.exe [2011-10-09 20:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.sweetim.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Crawler Search - tbr:iemenu
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Přidat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
TCP: DhcpNameServer = 173.193.227.124 173.192.105.217
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
URLSearchHooks-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
BHO-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
BHO-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
Toolbar-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:\program files\uTorrentBar\prxtbuTor.dll
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2482014332-175635240-3155644157-1000\Software\SecuROM\License information*]
"datasecu"=hex:7c,9f,40,39,39,e5,28,89,9b,e7,12,2f,0e,0d,06,44,11,0c,dd,ae,2a,
44,1c,48,33,31,61,33,7f,23,33,35,2e,dc,2f,6f,cb,fc,23,4c,d1,b0,5a,3d,ac,94,\
"rkeysecu"=hex:8c,b4,f8,e8,10,1c,1f,92,f4,0f,ab,00,b6,e0,31,c0
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
d:\sims2\PB\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\users\Doma\AppData\Local\Skillbrains\lightshot\1.4.0.10\LightShot.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Completion time: 2011-11-14 21:12:16 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-14 20:12
.
Pre-Run: 11 040 350 208 bytes free
Post-Run: 10 933 325 824 bytes free
.
- - End Of File - - B2423686BC1F16A6CA6801392EF3F425

#7 Příspěvek od **Rudy** » 14 lis 2011 21:26

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\programdata\3A65BB9108.sys

Folder::
c:\program files\SFT_eng7
c:\program files\ConduitEngine
c:\program files\SweetIM

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
[-HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{08D6B0B4-C132-470D-A8E2-AA2E9C3851C9}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]

Firefox::
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default\
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... ource=2&q=

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

http://img517.imageshack.us/img517/8662 ... t10uc2.gif

srogi · #8 Příspěvek od **srogi** » 14 lis 2011 21:30

To mám vytvoriť nový textový súbor ?? Alebo to mám dať do toho posledného logu, nakopírovať ??

Rudy píše:Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\programdata\3A65BB9108.sys

Folder::
c:\program files\SFT_eng7
c:\program files\ConduitEngine
c:\program files\SweetIM

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
[-HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{08D6B0B4-C132-470D-A8E2-AA2E9C3851C9}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]

Firefox::
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default\
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... ource=2&q=
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

http://img517.imageshack.us/img517/8662 ... t10uc2.gif

#9 Příspěvek od **Rudy** » 14 lis 2011 21:42

Otevřte poznámkový blok a zkopírujte do něj:

srogi · #10 Příspěvek od **srogi** » 15 lis 2011 16:06

To je už akože všetko??

#11 Příspěvek od **Rudy** » 15 lis 2011 18:47

Pokud jste ten soubor se skriptem přetáhl ned ikonu ComboFix a pustil, pak ano. CF se spustil, provedl výmaz a dal log. Ten bych teď potřeboval vidět.

srogi · #12 Příspěvek od **srogi** » 15 lis 2011 18:52

Len mám taký pocit, že mi žiaden log nespravil, spravil som to tak ako tak bolo uvedené... Skúsim to ešte raz

... Práve mám spustený antivírus, spustil som to preto, aby som vedel čo a koľko tam toho je aspoň približne.

Rudy píše:Pokud jste ten soubor se skriptem přetáhl ned ikonu ComboFix a pustil, pak ano. CF se spustil, provedl výmaz a dal log. Ten bych teď potřeboval vidět.

#13 Příspěvek od **Rudy** » 15 lis 2011 19:01

Log by měl být v c:\comobfix.txt.

srogi · #14 Příspěvek od **srogi** » 15 lis 2011 19:04

Ale podľa dátumov, to je zo včera !

ComboFix 11-11-14.02 - Doma . 11. 2011 20:33:22.2.1 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1051.18.3583.2787 [GMT 1:00]
Running from: c:\users\Doma\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue
.
---- Previous Run -------
.
c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue
.
.
((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))
.
.
2011-11-14 19:51 . 2011-11-14 19:55 -------- d-----w- c:\users\Doma\AppData\Local\temp
2011-11-14 19:51 . 2011-11-14 19:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-14 17:25 . 2011-11-14 17:25 -------- d-----w- c:\program files\trend micro
2011-11-14 17:25 . 2011-11-14 17:25 -------- d-----w- C:\rsit
2011-11-13 16:50 . 2011-11-13 20:44 97961 ----a-w- c:\windows\system32\drivers\klick.dat
2011-11-13 16:50 . 2011-11-13 20:44 115369 ----a-w- c:\windows\system32\drivers\klin.dat
2011-11-13 16:47 . 2011-11-13 16:47 -------- d-----w- c:\program files\Kaspersky Lab
2011-11-13 16:47 . 2011-11-14 19:55 -------- d-----w- c:\programdata\Kaspersky Lab
2011-11-12 14:00 . 2009-11-25 19:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-11-12 14:00 . 2009-11-25 19:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-11-12 14:00 . 2009-11-25 19:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-11-12 14:00 . 2009-11-25 19:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-11-12 14:00 . 2009-11-25 19:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-11-12 12:33 . 2011-11-12 12:33 -------- d-----w- c:\program files\select_path_to_counter-strike
2011-10-31 19:08 . 2011-10-31 19:08 -------- d-----w- c:\users\Doma\AppData\Local\Color-Brush
2011-10-31 16:08 . 2011-10-31 16:08 -------- d-----w- c:\users\Doma\AppData\Roaming\Gold Casual Games
2011-10-31 16:08 . 2011-10-31 16:08 -------- d-----w- c:\programdata\Gold Casual Games
2011-10-31 16:03 . 2011-10-31 16:03 -------- d-----w- c:\users\Doma\AppData\Roaming\SpinTop
2011-10-31 15:48 . 2011-11-09 18:14 -------- d-----w- C:\BigFishGamesCache
2011-10-30 09:53 . 2011-10-30 09:53 -------- d-----w- c:\users\Public\Roaming
2011-10-30 09:45 . 2011-10-30 09:45 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2011-10-30 09:39 . 2011-10-30 09:39 -------- d-----w- c:\program files\Adobe Media Player
2011-10-29 18:13 . 2011-11-08 15:19 -------- d-----w- c:\users\Doma\AppData\Local\LogMeIn Hamachi
2011-10-29 18:10 . 2011-10-29 18:10 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-10-29 16:33 . 2011-10-29 16:35 88 --sh--r- c:\programdata\3A65BB9108.sys
2011-10-29 16:33 . 2011-10-29 16:53 5018 --sha-w- c:\programdata\KGyGaAvL.sys
2011-10-29 16:24 . 2011-10-29 16:24 -------- d-----w- c:\program files\Corel
2011-10-29 15:08 . 2011-10-29 15:08 -------- d-----w- c:\users\Doma\AppData\Local\NOS
2011-10-27 06:48 . 2011-10-27 06:48 -------- d-----w- c:\program files\Common Files\Java
2011-10-25 17:09 . 2011-10-25 17:10 -------- d-----w- c:\program files\FileZilla FTP Client
2011-10-23 17:14 . 2011-10-23 17:14 -------- d-----w- c:\users\Doma\AppData\Roaming\Kastner software
2011-10-23 16:57 . 2011-10-23 16:57 -------- d-----w- c:\programdata\KASTNER software
2011-10-23 16:57 . 2011-10-23 16:57 -------- d-----w- c:\program files\KASTNER software
2011-10-17 19:11 . 2011-09-29 00:26 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-10-17 19:11 . 2011-09-29 00:26 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-10-16 10:09 . 2011-10-16 10:09 -------- d-----w- c:\programdata\Trymedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-01 19:14 . 2011-08-19 18:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 03:06 . 2011-08-19 11:03 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-02 15:00 . 2011-08-20 18:24 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2011-10-02 15:00 . 2011-08-20 18:24 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2011-10-01 14:30 . 2011-10-01 14:35 737280 ----a-w- c:\windows\iun6002.exe
2011-09-14 09:47 . 2011-09-14 09:47 53760 ----a-w- c:\windows\system32\OVDecode.dll
2011-09-14 09:47 . 2011-09-14 09:47 43520 ----a-w- c:\windows\system32\OpenCL.dll
2011-09-14 09:46 . 2011-09-14 09:46 13625856 ----a-w- c:\windows\system32\amdocl.dll
2011-09-14 09:38 . 2011-09-14 09:38 37376 ----a-w- c:\windows\system32\amdoclcl.dll
2011-09-12 13:39 . 2011-03-28 16:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-09-08 18:26 . 2011-09-08 18:26 8606208 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-09-08 17:39 . 2011-09-08 17:39 18534912 ----a-w- c:\windows\system32\atioglxx.dll
2011-09-08 17:34 . 2011-09-08 17:34 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-09-08 17:34 . 2011-03-10 02:54 732672 ----a-w- c:\windows\system32\aticfx32.dll
2011-09-08 17:30 . 2011-09-08 17:30 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-09-08 17:30 . 2011-09-08 17:30 401408 ----a-w- c:\windows\system32\atieclxx.exe
2011-09-08 17:29 . 2011-09-08 17:29 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2011-09-08 17:28 . 2011-09-08 17:28 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2011-09-08 17:28 . 2011-09-08 17:28 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2011-09-08 17:28 . 2011-09-08 17:28 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2011-09-08 17:28 . 2011-09-08 17:28 20992 ----a-w- c:\windows\system32\atimuixx.dll
2011-09-08 17:28 . 2011-09-08 17:28 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-09-08 17:24 . 2011-03-10 02:46 4204032 ----a-w- c:\windows\system32\atidxx32.dll
2011-09-08 17:18 . 2011-09-08 17:18 1828864 ----a-w- c:\windows\system32\atiumdmv.dll
2011-09-08 17:09 . 2011-09-08 17:09 46080 ----a-w- c:\windows\system32\aticalrt.dll
2011-09-08 17:09 . 2011-09-08 17:09 44032 ----a-w- c:\windows\system32\aticalcl.dll
2011-09-08 17:08 . 2011-03-10 02:21 4064768 ----a-w- c:\windows\system32\atiumdva.dll
2011-09-08 17:05 . 2011-09-08 17:05 7331840 ----a-w- c:\windows\system32\aticaldd.dll
2011-09-08 17:05 . 2011-03-10 02:28 4289024 ----a-w- c:\windows\system32\atiumdag.dll
2011-09-08 16:59 . 2011-08-18 20:29 52736 ----a-w- c:\windows\system32\coinst.dll
2011-09-08 16:53 . 2011-09-08 16:53 270336 ----a-w- c:\windows\system32\atiadlxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 13312 ----a-w- c:\windows\system32\atiglpxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 32768 ----a-w- c:\windows\system32\atigktxx.dll
2011-09-08 16:52 . 2011-09-08 16:52 248832 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-09-08 16:51 . 2011-03-10 02:14 31744 ----a-w- c:\windows\system32\atiuxpag.dll
2011-09-08 16:51 . 2011-03-10 02:14 29184 ----a-w- c:\windows\system32\atiu9pag.dll
2011-09-08 16:51 . 2011-09-08 16:51 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\atimpc32.dll
2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2011-08-30 15:43 . 2011-08-30 15:43 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2011-08-30 13:55 . 2011-08-30 13:55 183112 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-30 13:50 . 2011-08-30 13:50 1174 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-21 18:23 . 2011-08-21 18:23 4608 ----a-w- c:\windows\system32\bbchlp.dll
2011-08-21 18:23 . 2011-08-21 18:23 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2011-08-21 18:23 . 2011-08-21 18:23 30720 ----a-w- c:\windows\system32\bbcap.dll
2011-08-20 10:19 . 2011-08-19 10:51 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-18 20:58 . 2011-08-18 20:58 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-29 07:32 . 2011-08-18 20:47 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
2011-03-28 16:22 176936 ----a-w- c:\program files\SFT_eng7\prxtbSFT0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{08D6B0B4-C132-470D-A8E2-AA2E9C3851C9}"= "c:\program files\SFT_eng7\prxtbSFT0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{08d6b0b4-c132-470d-a8e2-aa2e9c3851c9}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-08-18 3318784]
"Steam"="c:\program files\Steam\steam.exe" [2011-08-19 1242448]
"LightShot"="c:\users\Doma\AppData\Local\Skillbrains\lightshot\LightShot.exe" [2011-03-16 195072]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-20 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-20 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-20 151064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-19 9874024]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-08-18 2216960]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 343168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Standby"="c:\program files\Common Files\Corel\Standby\Standby.exe" [2009-12-17 105632]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 02:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-27 17:03 152872 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-08-15 14:18 1955208 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nero DriveSpeed]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2011-06-15 06:19 307200 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-07-29 10:31 17361032 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
2011-08-01 12:35 114992 ----a-r- c:\program files\SweetIM\Messenger\SweetIM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-08-19 11:40 639864 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 136176]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 23856]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-08-18 142592]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-09-08 176128]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 1361288]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-09-08 8606208]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-09-08 248832]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-06-06 211984]
S3 bbcap;bbcap;c:\windows\system32\DRIVERS\bbcap.sys [2011-08-21 4096]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-13 50688]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 19:45]
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-19 19:45]
.
2011-11-14 c:\windows\Tasks\update-S-1-5-21-2482014332-175635240-3155644157-1000.job
- c:\program files\Skillbrains\Updater\Updater.exe [2011-10-09 20:09]
.
2011-11-14 c:\windows\Tasks\update-sys.job
- c:\program files\Skillbrains\Updater\Updater.exe [2011-10-09 20:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.sweetim.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Crawler Search - tbr:iemenu
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Přidat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
TCP: DhcpNameServer = 173.193.227.124 173.192.105.217
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\p52o0iwd.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
URLSearchHooks-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
BHO-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
BHO-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\prxtbuTor.dll
Toolbar-{51a86bb3-6602-4c85-92a5-130ee4864f13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:\program files\uTorrentBar\prxtbuTor.dll
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - c:\program files\BrotherSoft_Extreme\prxtbBrot.dll
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2482014332-175635240-3155644157-1000\Software\SecuROM\License information*]
"datasecu"=hex:7c,9f,40,39,39,e5,28,89,9b,e7,12,2f,0e,0d,06,44,11,0c,dd,ae,2a,
44,1c,48,33,31,61,33,7f,23,33,35,2e,dc,2f,6f,cb,fc,23,4c,d1,b0,5a,3d,ac,94,\
"rkeysecu"=hex:8c,b4,f8,e8,10,1c,1f,92,f4,0f,ab,00,b6,e0,31,c0
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
d:\sims2\PB\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\users\Doma\AppData\Local\Skillbrains\lightshot\1.4.0.10\LightShot.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Completion time: 2011-11-14 21:12:16 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-14 20:12
.
Pre-Run: 11 040 350 208 bytes free
Post-Run: 10 933 325 824 bytes free
.
- - End Of File - - B2423686BC1F16A6CA6801392EF3F425

#15 Příspěvek od **Rudy** » 15 lis 2011 19:05

OK. Zkuste ho tím skriptem spustit v nouz. režimu.

VIRY.CZ

Podozrenie na "havěť", kleslo fps !!

Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!

Re: Podozrenie na "havěť", kleslo fps !!