VIRY.CZ

Prosím o kontrolu, mám pocit že se mi tam usídlil někde nějaký vir:)Děkuji


Logfile of random's system information tool 1.09 (written by random/random)
Run by Luciuska at 2011-12-28 11:31:18
Microsoft Windows 7 Ultimate
System drive C: has 4 GB (11%) free of 40 GB
Total RAM: 3068 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:33:00, on 28.12.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe
C:\Program Files\Lexmark S300-S400 Series\ezprint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Explorer.exe
C:\Users\Luciuska\Downloads\RSIT.exe
C:\Program Files\trend micro\Luciuska.exe

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [lxeamon.exe] "C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark S300-S400 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: lxeaCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxeaserv.exe
O23 - Service: lxea_device - - C:\Windows\system32\lxeacoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

--
End of file - 4150 bytes

======Scheduled tasks folder======

C:\Windows\tasks\AWC AutoSweep.job
C:\Windows\tasks\AWC Startup.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-07-02 2202704]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-07-06 9394792]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"IObit Security 360"=C:\Program Files\IObit\IObit Security 360\IS360tray.exe [2010-06-11 1280344]
"lxeamon.exe"=C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe [2011-01-24 770728]
"EzPrint"=C:\Program Files\Lexmark S300-S400 Series\ezprint.exe [2011-01-24 148280]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-04-29 1090952]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-26 2210608]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-12-28 11:15:13 ----ASH---- C:\pagefile.sys
2011-12-24 21:06:10 ----AH---- C:\Windows\system32\ezsidmv.dat
2011-12-24 09:14:23 ----D---- C:\Windows\Sun
2011-12-23 22:32:01 ----SHD---- C:\$RECYCLE.BIN
2011-12-23 22:31:55 ----A---- C:\ComboFix.txt
2011-12-23 22:19:36 ----D---- C:\ComboFix
2011-12-23 18:28:51 ----D---- C:\Program Files\Common Files\Java
2011-12-23 18:28:27 ----A---- C:\Windows\system32\javaws.exe
2011-12-23 18:28:27 ----A---- C:\Windows\system32\javaw.exe
2011-12-23 18:28:27 ----A---- C:\Windows\system32\java.exe
2011-12-13 20:32:52 ----D---- C:\Windows\system32\Logfiles
2011-12-13 20:32:03 ----N---- C:\bootsqm.dat
2011-12-13 20:30:05 ----D---- C:\found.001
2011-12-13 19:34:43 ----D---- C:\Lexmark ToolBar
2011-12-13 16:05:52 ----D---- C:\ProgramData\Ezprint
2011-12-12 13:31:48 ----D---- C:\ProgramData\Lx_cats
2011-12-12 13:28:46 ----A---- C:\Windows\system32\lxeavs.dll
2011-12-12 13:28:44 ----A---- C:\Windows\system32\lxeacoin.dll
2011-12-12 13:28:36 ----A---- C:\Windows\system32\lxk_gf.dll
2011-12-12 13:28:36 ----A---- C:\Windows\system32\lxeagcfg.dll
2011-12-12 13:28:35 ----A---- C:\Windows\system32\lxeacuir.dll
2011-12-12 13:28:35 ----A---- C:\Windows\system32\lxeacui.dll
2011-12-12 13:27:35 ----D---- C:\Program Files\Abbyy FineReader 6.0 Sprint
2011-12-12 13:27:19 ----A---- C:\Windows\system32\LXEAwupd.exe
2011-12-12 13:27:19 ----A---- C:\Windows\system32\LXEAwupd.dll
2011-12-12 13:26:28 ----D---- C:\Program Files\Lexmark
2011-12-12 13:26:07 ----D---- C:\Program Files\Lexmark Printable Web
2011-12-12 13:25:58 ----AH---- C:\Windows\system32\lxearwrd.ini
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeausb1.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\LXEAinst.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeainpa.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeaiesc.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\LXEAhcp.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeaserv.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeapmui.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxealmpm.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeajswr.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeainsb.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeainsr.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeains.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeaih.exe
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeahbn3.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeagrd.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeacur.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeacub.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacu.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacoms.exe
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacomm.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacomc.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacfg.exe
2011-12-12 13:25:40 ----A---- C:\Windows\system32\LXEAcfg.dll
2011-12-12 13:25:22 ----A---- C:\ProgramData\UpdaterLog.txt
2011-12-12 13:25:08 ----D---- C:\Program Files\Lexmark S300-S400 Series
2011-12-12 13:25:08 ----A---- C:\Windows\system32\LXEAsmr.dll
2011-12-12 13:25:08 ----A---- C:\Windows\system32\LXEAsm.dll
2011-12-04 15:51:19 ----D---- C:\Users\Luciuska\AppData\Roaming\Nero
2011-12-04 15:45:18 ----D---- C:\ProgramData\Nero
2011-12-04 15:38:33 ----D---- C:\Program Files\Microsoft Silverlight
2011-12-04 15:24:39 ----D---- C:\Program Files\Conduit
2011-12-04 15:24:24 ----D---- C:\Users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 14:58:41 ----D---- C:\Users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 14:58:28 ----D---- C:\ProgramData\ashampoo

======List of files/folders modified in the last 1 month======

2011-12-28 11:32:53 ----D---- C:\Windows\temp
2011-12-28 11:32:12 ----D---- C:\Program Files\trend micro
2011-12-28 11:23:15 ----D---- C:\Windows\System32
2011-12-28 11:23:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-12-28 11:23:13 ----D---- C:\Windows\inf
2011-12-28 11:20:24 ----D---- C:\Windows\system32\Tasks
2011-12-28 11:19:59 ----D---- C:\Windows\system32\drivers
2011-12-28 11:19:38 ----RD---- C:\Program Files
2011-12-28 11:19:06 ----SHD---- C:\Windows\Installer
2011-12-28 11:19:05 ----D---- C:\Windows
2011-12-28 11:19:05 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-12-28 11:19:05 ----D---- C:\Config.Msi
2011-12-28 11:18:59 ----D---- C:\Program Files\Zoner
2011-12-28 11:17:08 ----D---- C:\Windows\Prefetch
2011-12-28 11:01:04 ----D---- C:\Program Files\Common Files
2011-12-28 10:59:55 ----SHD---- C:\System Volume Information
2011-12-28 10:56:58 ----RSD---- C:\Windows\Fonts
2011-12-28 10:56:39 ----D---- C:\Windows\system32\DriverStore
2011-12-28 10:56:39 ----D---- C:\Windows\system32\catroot
2011-12-28 10:56:34 ----D---- C:\Windows\twain_32
2011-12-28 10:56:22 ----D---- C:\ProgramData
2011-12-28 09:00:34 ----D---- C:\Users\Luciuska\AppData\Roaming\uTorrent
2011-12-28 08:28:32 ----D---- C:\Windows\cs-CZ
2011-12-27 14:12:04 ----D---- C:\Users\Luciuska\AppData\Roaming\Skype
2011-12-27 13:48:39 ----D---- C:\Users\Luciuska\AppData\Roaming\skypePM
2011-12-27 12:00:35 ----D---- C:\Windows\Minidump
2011-12-25 16:25:19 ----D---- C:\Windows\system32\catroot2
2011-12-25 15:42:02 ----D---- C:\Users\Luciuska\AppData\Roaming\SMS posílač Treca
2011-12-25 15:27:45 ----D---- C:\Program Files\QIP
2011-12-25 15:27:38 ----D---- C:\Program Files\PhotoFiltre
2011-12-23 22:31:59 ----D---- C:\Qoobox
2011-12-23 22:29:31 ----A---- C:\Windows\system.ini
2011-12-23 22:29:21 ----D---- C:\Windows\system32\drivers\etc
2011-12-23 22:28:31 ----D---- C:\Program Files\Your Product
2011-12-23 22:25:06 ----D---- C:\Windows\AppPatch
2011-12-23 22:11:11 ----D---- C:\Windows\system32\NDF
2011-12-23 18:28:14 ----D---- C:\Program Files\Java
2011-12-23 08:41:14 ----D---- C:\Users\Luciuska\AppData\Roaming\vlc
2011-12-21 11:54:15 ----D---- C:\Program Files\SMS posílač Treca
2011-12-13 16:09:22 ----SD---- C:\Users\Luciuska\AppData\Roaming\Microsoft
2011-12-04 15:38:44 ----SD---- C:\ProgramData\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor32;nvstor32; C:\Windows\system32\DRIVERS\nvstor32.sys [2009-08-04 213024]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 16184]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-14 691696]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2009-06-28 59904]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-07-06 3132712]
R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2010-04-30 134256]
R3 netr28;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28.sys [2010-05-17 793440]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2010-06-21 105576]
R3 NVNET;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmf6232.sys [2010-08-12 298216]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2009-06-28 17920]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-07-13 1068032]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
R3 WSDPrintDevice;WSD Print Support via UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 aqkjcm43;aqkjcm43; C:\Windows\system32\drivers\aqkjcm43.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 catchme;catchme; \??\C:\Users\Luciuska\AppData\Local\Temp\catchme.sys []
S3 epmntdrv;epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [2010-07-15 14216]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [2010-07-15 8456]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\Windows\system32\DRIVERS\s115bus.sys [2007-04-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s115mdm.sys [2007-04-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s115obex.sys [2007-04-23 98568]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 84992]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2011-01-15 30208]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vpnva;Cisco AnyConnect VPN Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2011-02-11 19680]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
R2 IS360service;IS360service; C:\Program Files\IObit\IObit Security 360\IS360srv.exe [2010-06-11 312152]
R2 lxea_device;lxea_device; C:\Windows\system32\lxeacoms.exe [2010-04-14 598696]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 129640]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 vpnagent;Cisco AnyConnect VPN Agent; C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-02-11 603896]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 lxeaCATSCustConnectService;lxeaCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxeaserv.exe [2010-04-14 193192]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-07-02 33584]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-31 1343400]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

Zdravim a pekny den preji
Vas log se studuje a pracuje se na nem .
Prosim o strpeni!

Poprosim i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

Predpokladam, ze ten NOD32 mate legalni = zakoupena licence

ComboFix vam poradil kdo prosim vizte pravidla fora - bod 3 http://www.viry.cz/forum/viewtopic.php?f=12&t=5601

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Poprosim i o log z ComboFixu kdyz uz jej mate - je umisten v c:\combofix.txt

Perou se vam tam dva bezpecnostni softy - NOD a ten kram od IOBit, ktery dle meho nepatri do PC - vizte dale

Odinstalujte IObit Security 360 a nasledne i vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

info.txt logfile of random's system information tool 1.08 2010-10-28 12:00:12

======Uninstall list======

-->MsiExec /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe -maintain activex
Adobe Reader 8.2.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A82000000003}
Ape Ripper 5.2.2-->"C:\Program Files\Ape Ripper\unins000.exe"
ATI Catalyst Install Manager-->msiexec /q/x{FD1E62F4-33DC-87C5-8C4A-77D2D8D5ACB8} REBOOT=ReallySuppress
CDex - Open Source Digital Audio CD Extractor-->C:\Program Files\CDex\uninstall.exe
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
EASEUS Partition Master 6.1.1 Home Edition-->"C:\Program Files\EASEUS\EASEUS Partition Master 6.1.1 Home Edition\unins000.exe"
ENE CIR Receiver Driver-->C:\PROGRA~1\DIFX\198A84B0EB590201\DPInst.exe /u C:\Windows\System32\DriverStore\FileRepository\enecir.inf_x86_neutral_ccbb7e1951a44bab\enecir.inf
Flac Ripper 4.0.1-->"C:\Program Files\Flac Ripper\unins000.exe"
Java(TM) 6 Update 22-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022FF}
JMicron Flash Media Controller Driver-->"C:\Program Files\JMicron\JMCR_DIR\setup.exe" delpkg
Magic FLAC to MP3 Converter 3.72-->"C:\Program Files\FLAC to MP3 Converter\unins000.exe"
Microsoft Office Access MUI (Czech) 2007-->MsiExec.exe /X{90120000-0015-0405-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Czech) 2007-->MsiExec.exe /X{90120000-0016-0405-0000-0000000FF1CE}
Microsoft Office Groove MUI (Czech) 2007-->MsiExec.exe /X{90120000-00BA-0405-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Czech) 2007-->MsiExec.exe /X{90120000-0044-0405-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Czech) 2007-->MsiExec.exe /X{90120000-00A1-0405-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Czech) 2007-->MsiExec.exe /X{90120000-001A-0405-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Czech) 2007-->MsiExec.exe /X{90120000-0018-0405-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Czech) 2007-->MsiExec.exe /X{90120000-002C-0405-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Czech) 2007-->MsiExec.exe /X{90120000-0019-0405-0000-0000000FF1CE}
Microsoft Office Shared MUI (Czech) 2007-->MsiExec.exe /X{90120000-006E-0405-0000-0000000FF1CE}
Microsoft Office Word MUI (Czech) 2007-->MsiExec.exe /X{90120000-001B-0405-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
NVIDIA Display Control Panel-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Ralink RT2860 Wireless LAN Card-->C:\Program Files\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SMS posílač Treca-->"C:\Program Files\SMS posílač Treca\unins000.exe"
Sony Ericsson PC Suite 6.011.00-->"C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe" -runfromtemp -l0x0009 -removeonly
VLC media player 1.1.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vypalovač CD / DVD / Blu-ray / HD-DVD 1.25-->"C:\Program Files\Vypalovač\unins000.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Your Product-->"C:\Windows\Your Product\uninstall.exe" "/U:C:\Program Files\Your Product\Uninstall\uninstall.xml"

======System event log======

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Diagnostic Policy Service byl změněn na: stopped
Record Number: 5
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6005
Message: Služba Event Log byla spuštěna.
Record Number: 4
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.01. 7600 Multiprocessor Free.
Record Number: 3
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6011
Message: Název tohoto počítače v systémech DNS a NetBIOS byl změněn z 37L4247D28-05 na WIN-PQEFBV0KC8K.
Record Number: 2
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Microsoft Software Shadow Copy Provider byl změněn na: stopped
Record Number: 1
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: 37L4247D28-05
Event Code: 900
Message: Služba Ochrana softwaru se spouští.

Record Number: 5
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20100731151154.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20100731150936.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 3
Source Name: Microsoft-Windows-WMI
Time Written: 20100731150933.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.


Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20100731150928.570400-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: 37L4247D28-05
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 1
Source Name: Microsoft-Windows-EventSystem
Time Written: 20100731150928.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: 37L4247D28-05
Event Code: 4735
Message: Byla změněna zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Změněné atributy:
Název účtu SAM: -
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.983200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4731
Message: Byla vytvořena zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Nová skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Atributy:
Název účtu SAM: Backup Operators
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.983200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.

Počet prvků: 0
ID zásady: 0x32155
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.702400-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4624
Message: Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 0

Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x4
Název procesu:

Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150903.267200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4608
Message: Spouští se systém Windows.

Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150903.220400-000
Event Type: Úspěšný audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;c:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Common Files\Teleca Shared
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=17
"PROCESSOR_IDENTIFIER"=x86 Family 17 Model 3 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0301

-----------------EOF-----------------



ComboFix 11-12-23.01 - Luciuska 23.12.2011 22:21:03.13.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3068.2105 [GMT 1:00]
Spuštěný z: c:\users\Luciuska\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Your Product\Uninstall
c:\program files\Your Product\Uninstall\IRIMG1.JPG
c:\program files\Your Product\Uninstall\IRIMG2.JPG
c:\program files\Your Product\Uninstall\uninstall.dat
c:\program files\Your Product\Uninstall\uninstall.xml
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-23 do 2011-12-23 )))))))))))))))))))))))))))))))
.
.
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Luciuska\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-23 19:00 . 2011-12-23 19:00 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\offreg.dll
2011-12-23 17:28 . 2011-12-23 17:28 -------- d-----w- c:\program files\Common Files\Java
2011-12-13 19:32 . 2011-12-13 19:35 -------- d-----w- c:\windows\system32\Logfiles
2011-12-13 19:30 . 2011-12-13 19:30 -------- d-----w- C:\found.001
2011-12-13 18:34 . 2011-12-13 18:34 -------- d-----w- c:\users\Luciuska\AppData\Local\AskToolbar
2011-12-13 18:34 . 2011-12-13 18:34 -------- d-----w- C:\Lexmark ToolBar
2011-12-13 15:05 . 2011-12-13 15:05 -------- d-----w- c:\programdata\Ezprint
2011-12-13 12:53 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\mpengine.dll
2011-12-12 12:31 . 2011-12-19 09:11 -------- d-----w- c:\programdata\Lx_cats
2011-12-12 12:30 . 2009-11-04 13:14 157696 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxeadrpp.dll
2011-12-12 12:28 . 2008-03-05 02:55 40960 ----a-w- c:\windows\system32\lxeavs.dll
2011-12-12 12:28 . 2010-04-13 19:41 442368 ----a-w- c:\windows\system32\lxeacoin.dll
2011-12-12 12:28 . 2009-11-09 07:59 86016 ----a-w- c:\windows\system32\lxeagcfg.dll
2011-12-12 12:28 . 2008-04-30 06:32 983121 ----a-w- c:\windows\system32\lxk_gf.dll
2011-12-12 12:28 . 2009-10-21 10:06 110592 ----a-w- c:\windows\system32\lxeacuir.dll
2011-12-12 12:28 . 2009-10-21 10:06 294912 ----a-w- c:\windows\system32\lxeacui.dll
2011-12-12 12:27 . 2011-12-12 12:28 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2011-12-12 12:27 . 2010-04-14 20:45 213672 ----a-w- c:\windows\system32\LXEAwupd.exe
2011-12-12 12:27 . 2010-02-22 10:08 372736 ----a-w- c:\windows\system32\LXEAwupd.dll
2011-12-12 12:26 . 2011-12-12 12:28 -------- d-----w- c:\program files\Lexmark
2011-12-12 12:26 . 2011-12-13 18:34 -------- d-----w- c:\program files\Lexmark Toolbar
2011-12-12 12:26 . 2011-12-12 12:26 -------- d-----w- c:\program files\Lexmark Printable Web
2011-12-04 14:51 . 2011-12-04 14:51 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Nero
2011-12-04 14:45 . 2011-12-04 14:45 -------- d-----w- c:\programdata\Nero
2011-12-04 14:45 . 2011-12-04 14:45 -------- d-----w- c:\program files\Common Files\Nero
2011-12-04 14:44 . 2011-12-04 14:45 -------- d-----w- c:\program files\Nero
2011-12-04 14:38 . 2011-12-04 14:38 -------- d-----w- c:\program files\Microsoft Silverlight
2011-12-04 14:37 . 2011-12-04 14:37 -------- d-----w- c:\program files\Ask.com
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Local\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\FreeOnlineRadioPlayerRecorder
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 14:24 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2011-12-04 14:24 . 2005-02-24 10:51 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2011-12-04 14:24 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\All Free Disc Burner
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Local\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\programdata\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\program files\Ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 04:54 . 2010-10-21 10:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f999a48b-1950-4d81-9971-79018f807b4b}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-21 11:17 1233288 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f999a48b-1950-4d81-9971-79018f807b4b}]
2011-05-09 08:49 176936 ----a-w- c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f999a48b-1950-4d81-9971-79018f807b4b}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
"{F999A48B-1950-4D81-9971-79018F807B4B}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-07-06 9394792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2010-06-11 1280344]
"lxeamon.exe"="c:\program files\Lexmark S300-S400 Series\lxeamon.exe" [2011-01-24 770728]
"EzPrint"="c:\program files\Lexmark S300-S400 Series\ezprint.exe" [2011-01-24 148280]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-12-23 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2011-04-02 12:11]
.
2011-12-23 c:\windows\Tasks\AWC Startup.job
- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2011-04-02 08:38]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
- c:\users\Luciuska\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-31 15:34]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
- c:\users\Luciuska\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-31 15:34]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: vsb.cz\vpn
TCP: DhcpNameServer = 10.0.0.138
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,3e,2e,33,f1,c2,6e,4c,91,ef,e1,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,3e,2e,33,f1,c2,6e,4c,91,ef,e1,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2011-12-23 22:31:55
ComboFix-quarantined-files.txt 2011-12-23 21:31
ComboFix2.txt 2011-10-07 08:30
ComboFix3.txt 2011-08-20 09:27
ComboFix4.txt 2011-03-20 08:01
ComboFix5.txt 2011-12-23 21:19
.
Před spuštěním: 1 202 757 632
Po spuštění: 1 850 224 640
.
- - End Of File - - 04585B33AC6779282126E938F1517B5A



Combofix mi poradil kamarád co pracuje s počítači, ale jestli to byla chyba, tak se předem omlouvám. Jinak progamy odinstaluji.

Chyba je pokud s ComboFixem kamarad neumi = neumi precist log a napsat skript na docisteni

Predpokladam, ze ten NOD32 mate legalni = zakoupena licence

ano, legální. Chtěla bych se zeptat zda teda jsou zde nějaké problémy ohledně virů?

Hlidejte si volne misto na disku, pokud je pod 10 GB, system se dusi

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\users\Luciuska\AppData\Local\AskToolbar
  C:\Lexmark ToolBar
  c:\program files\IObit
  c:\program files\Ask.com
  
  RegLock::
  [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
  
  File::
  c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll
  C:\Windows\tasks\AWC AutoSweep.job
  C:\Windows\tasks\AWC Startup.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
  
  Driver::
  IS360service
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{f999a48b-1950-4d81-9971-79018f807b4b}"=-
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{f999a48b-1950-4d81-9971-79018f807b4b}"=-
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  "{F999A48B-1950-4D81-9971-79018F807B4B}"=-
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "IObit Security 360"=-
  "SunJavaUpdateSched"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
  
  ClearJavaCache::
  
  AtJob::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

ComboFix 11-12-28.02 - Luciuska 28.12.2011 12:05:28.14.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3068.2026 [GMT 1:00]
Spuštěný z: c:\users\Luciuska\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Luciuska\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll"
"c:\windows\tasks\AWC AutoSweep.job"
"c:\windows\tasks\AWC Startup.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Lexmark ToolBar
c:\lexmark toolbar\Apps\Toolbar\CZECH\resource.dll
c:\lexmark toolbar\Apps\Toolbar\CZECH\setupres.dll
c:\lexmark toolbar\Apps\Toolbar\CZECH\tbsched.exe
c:\lexmark toolbar\Apps\Toolbar\setup.exe
c:\lexmark toolbar\Apps\Toolbar\toolband.dll
c:\users\Luciuska\AppData\Local\AskToolbar
c:\users\Luciuska\AppData\Local\AskToolbar\Downloaded Program Files\Nero.dll
c:\users\Luciuska\AppData\Local\AskToolbar\Downloaded Program Files\Nero.inf
c:\windows\tasks\AWC AutoSweep.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-28 do 2011-12-28 )))))))))))))))))))))))))))))))
.
.
2011-12-28 11:23 . 2011-12-28 11:26 -------- d-----w- c:\users\Luciuska\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-28 10:19 . 2011-12-28 10:19 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\offreg.dll
2011-12-24 08:14 . 2011-12-24 08:14 -------- d-----w- c:\windows\Sun
2011-12-23 17:28 . 2011-12-23 17:28 -------- d-----w- c:\program files\Common Files\Java
2011-12-13 19:32 . 2011-12-13 19:35 -------- d-----w- c:\windows\system32\Logfiles
2011-12-13 19:30 . 2011-12-13 19:30 -------- d-----w- C:\found.001
2011-12-13 15:05 . 2011-12-13 15:05 -------- d-----w- c:\programdata\Ezprint
2011-12-13 12:53 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\mpengine.dll
2011-12-12 12:31 . 2011-12-19 09:11 -------- d-----w- c:\programdata\Lx_cats
2011-12-12 12:30 . 2009-11-04 13:14 157696 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxeadrpp.dll
2011-12-12 12:28 . 2008-03-05 02:55 40960 ----a-w- c:\windows\system32\lxeavs.dll
2011-12-12 12:28 . 2010-04-13 19:41 442368 ----a-w- c:\windows\system32\lxeacoin.dll
2011-12-12 12:28 . 2009-11-09 07:59 86016 ----a-w- c:\windows\system32\lxeagcfg.dll
2011-12-12 12:28 . 2008-04-30 06:32 983121 ----a-w- c:\windows\system32\lxk_gf.dll
2011-12-12 12:28 . 2009-10-21 10:06 110592 ----a-w- c:\windows\system32\lxeacuir.dll
2011-12-12 12:28 . 2009-10-21 10:06 294912 ----a-w- c:\windows\system32\lxeacui.dll
2011-12-12 12:27 . 2011-12-12 12:28 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2011-12-12 12:27 . 2010-04-14 20:45 213672 ----a-w- c:\windows\system32\LXEAwupd.exe
2011-12-12 12:27 . 2010-02-22 10:08 372736 ----a-w- c:\windows\system32\LXEAwupd.dll
2011-12-12 12:26 . 2011-12-12 12:28 -------- d-----w- c:\program files\Lexmark
2011-12-12 12:26 . 2011-12-28 09:51 -------- d-----w- c:\program files\Lexmark Printable Web
2011-12-04 14:51 . 2011-12-04 14:51 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Nero
2011-12-04 14:45 . 2011-12-28 10:00 -------- d-----w- c:\programdata\Nero
2011-12-04 14:38 . 2011-12-04 14:38 -------- d-----w- c:\program files\Microsoft Silverlight
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Local\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Local\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\programdata\ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 04:54 . 2010-10-21 10:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-07-06 9394792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"lxeamon.exe"="c:\program files\Lexmark S300-S400 Series\lxeamon.exe" [2011-01-24 770728]
"EzPrint"="c:\program files\Lexmark S300-S400 Series\ezprint.exe" [2011-01-24 148280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
.
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: vsb.cz\vpn
TCP: DhcpNameServer = 192.168.2.1
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\windows\system32\lxeacoms.exe
c:\windows\system32\nvvsvc.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2011-12-28 12:32:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-28 11:32
ComboFix2.txt 2011-12-23 21:31
ComboFix3.txt 2011-10-07 08:30
ComboFix4.txt 2011-08-20 09:27
ComboFix5.txt 2011-12-28 11:04
.
Před spuštěním: 5 384 237 056
Po spuštění: 5 248 057 344
.
- - End Of File - - 200A63734B01FAABEC0423C3DB2AE1D7



Vyskytla se chyba ohledně prohlížeče, že po kliknutí mi to ukazuje že je prohlížen v registrech klíče připravený k odstranění -> C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe Pokus použít neplatnou operaci na klíč egistru, který je označen pro odstranění.

Restartujte PC, melo by se to dat do kopy

Pak napiste co PC

Na disku mám již 11 gb volného, a vše funguje parádně. Děkuji za pomoc:) a přeji krásný den:)

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden