VIRY.CZ

Dobrý den. Na netbooku přitelkyně přestal fungovat internet. Vypadá to, že je blokovaný pouze HTTP protokol, protože ping i HTTPS mi fungují.
Bohužel jsem se již pokusil postupovat podle jednoho Vašeho návodu a postup zahrnoval i spuštění combofixu. Zkoušel jsem i instalaci AVG, ale nepomohl.
Prosím o radu, pokud je to možné... Děkuji

Přikládám log z RSIT:

Zdravim

Pouziti combofixu na vlastni pest je velka blbost. Krom toho, ze muze poskodit system a bez znalosti postupu se vam nemusi podarit ho znova nahodit, smaze veskere stopy haveti a log z RSIT je pak uplne k nicemu. Vzdy pak vypada cisty a lecba je daleko slozitejsi
To AVG taky nebyl nejstastnejsi vyber

Zkusime s tim neco udelat, ale za vysledek nerucim



Zkopirujte mi sem log combofixu. Je zde C:\ComboFix.txt

Zkuste pouzit WinsockFix http://www.softpedia.com/get/Tweak/Netw ... kFix.shtml
Pozor, program resetuje protokol tcp/ip. Jestli mate parametry site zadavany rucne, budete je muset znovu nastavit podle smlouvy s poskytovatelem.

Udelejte !!!uplnou!!! kontrolu s MBAM http://forum.viry.cz/viewtopic.php?f=29&t=115222 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

Jo a nedavejte logy do code, spatne se to cte

Prvni krok.
Prikladam Combofix.txt:
=============================================================================
ComboFix 12-07-30.03 - Administrator 31.07.2012 23:58:39.2.2 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.696 [GMT 2:00]
Spuštěný z: c:\temp\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-06-28 do 2012-07-31 )))))))))))))))))))))))))))))))
.
.
2012-07-31 20:44 . 2012-07-31 20:44 -------- d-----w- c:\documents and settings\Danulka\Data aplikací\AVG2012
2012-07-31 20:39 . 2012-07-31 20:39 -------- d-----w- c:\documents and settings\All Users\AVG Secure Search
2012-07-31 20:37 . 2012-07-31 20:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2012
2012-07-31 20:37 . 2012-07-31 20:38 -------- d-----w- c:\windows\system32\drivers\AVG
2012-07-31 20:37 . 2012-07-31 20:37 -------- d-----w- C:\$AVG
2012-07-31 20:36 . 2012-07-31 20:36 -------- d-----w- c:\program files\AVG
2012-07-31 20:23 . 2012-07-31 21:51 -------- d-----w- C:\temp
2012-07-31 19:52 . 2012-07-31 19:52 35888 ----a-r- c:\windows\system32\drivers\SymIM.sys
2012-07-31 19:52 . 2012-07-31 19:55 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-07-31 19:52 . 2012-07-31 19:52 -------- d-----w- c:\program files\Symantec
2012-07-31 19:52 . 2012-07-31 19:52 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2012-07-31 19:52 . 2012-07-31 19:52 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2012-07-31 19:51 . 2012-07-31 19:51 -------- d-----w- c:\windows\system32\drivers\NIS
2012-07-31 19:51 . 2012-07-31 19:51 -------- d-----w- c:\program files\Windows Sidebar
2012-07-31 19:51 . 2012-07-31 19:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Norton
2012-07-31 19:50 . 2012-07-31 19:50 -------- d-----w- c:\program files\NortonInstaller
2012-07-31 19:45 . 2012-07-31 19:45 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\Common Files
2012-07-31 19:43 . 2012-07-31 20:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\MFAData
2012-07-31 19:35 . 2012-07-31 19:36 -------- d-----w- c:\documents and settings\Administrator
2012-07-31 19:21 . 2012-07-31 19:21 -------- d-sh--w- c:\documents and settings\Danulka\IECompatCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-13 13:55 . 2009-06-16 16:09 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:49 . 2009-06-16 16:09 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:49 . 2009-06-16 16:09 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2009-06-16 16:09 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2009-08-06 18:24 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2009-08-06 18:24 22552 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2009-06-16 14:25 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2009-06-16 14:25 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2009-06-16 14:25 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2009-08-06 18:24 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2009-08-06 18:24 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-08-06 18:24 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2009-06-16 16:09 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2009-06-16 14:25 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2009-06-16 14:25 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2009-06-16 14:25 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2009-06-16 14:25 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2009-06-16 16:09 602112 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:09 . 2009-06-16 16:09 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-11 14:44 . 2009-06-16 16:09 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:44 . 2009-06-16 16:09 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-06-16 16:09 385024 ------w- c:\windows\system32\html.iec
2012-05-05 03:14 . 2008-04-14 08:06 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-05 03:14 . 2008-04-14 08:06 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension1]
@="{fe25455d-b4c2-4e32-97d2-92632ec1c224}"
[HKEY_CLASSES_ROOT\CLSID\{fe25455d-b4c2-4e32-97d2-92632ec1c224}]
2009-11-07 00:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension2]
@="{1fae2d88-a78e-4f03-909f-be818a3c1ce6}"
[HKEY_CLASSES_ROOT\CLSID\{1fae2d88-a78e-4f03-909f-be818a3c1ce6}]
2009-11-07 00:07 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2009-05-13 396800]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2009-05-19 3417336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-11 17881600]
"Parental Control"="c:\program files\Parental Control\bin\pcontrol.exe" [2009-03-20 1104384]
"LiveUpdate"="c:\program files\Asus\LiveUpdate\LiveUpdate.exe" [2009-06-01 712704]
"EasyMode"="c:\program files\\ASUS\\Easy Mode\\Easy Mode.exe" [2009-03-18 1249280]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2009-06-04 696320]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-05-08 98304]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-03-06 79144]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Danulka\Nabídka Start\Programy\Po spuštění\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-6-16 376832]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-12-5 604776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igdlogin]
2009-04-28 03:44 65536 ----a-w- c:\windows\system32\igdlogin.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-02-06 16:53 3885408 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ7.7\\ICQ.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19.4.2012 4:50 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [31.1.2012 4:46 31952]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1000000.07D\SymEFA.sys [31.7.2012 21:52 309296]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [22.2.2012 5:25 235216]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [19.3.2012 5:17 301248]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1000000.07D\BHDrvx86.sys [31.7.2012 21:52 254512]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1000000.07D\ccHPx86.sys [31.7.2012 21:52 362544]
S1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080826.006\IDSxpx86.sys [31.7.2012 21:52 274808]
S1 policyappblockservice;Parental Control Application Filter;c:\program files\Parental Control\bin\policyappblock.sys [2.2.2009 22:22 5120]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Guard-ICQ\GuardICQ.exe [26.2.2012 16:24 1564368]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [26.2.2012 16:23 247872]
S2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [31.7.2012 21:52 115560]
S2 privoxy;privoxy;c:\program files\Privoxy\privoxy.exe --service --> c:\program files\Privoxy\privoxy.exe --service [?]
S2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [19.5.2009 18:29 107744]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [16.6.2009 17:48 1684736]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23.12.2011 13:32 139856]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23.12.2011 13:32 24144]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23.12.2011 13:32 17232]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [31.7.2012 21:52 99376]
S3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [16.6.2009 17:47 5096544]
S3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [4.6.2009 3:54 38912]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [16.6.2009 20:20 233512]
S3 uvclf;uvclf;c:\windows\system32\drivers\uvclf.sys [4.6.2009 3:54 39040]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [3.5.2012 8:31 158856]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eeepc.asus.com/global
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
LSP: c:\windows\system32\PolicyLSP.dll
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-01 00:10
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3942723344-1541602582-529602982-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f3,30,6a,2f,3a,fd,07,4f,85,43,16,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f3,30,6a,2f,3a,fd,07,4f,85,43,16,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(148)
c:\windows\system32\PolicyLSP.dll
c:\program files\ASUS\Eee Storage\XPClient.dll
c:\program files\ASUS\Eee Storage\LogicNP.EZShellExtensions.dll
c:\program files\ASUS\Eee Storage\EcaremeDLL.dll
c:\windows\assembly\GAC_MSIL\SqliteShared\1.0.3390.31024__0d0f4b69e50e559b\SqliteShared.dll
c:\windows\assembly\GAC_32\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\ASUS\Eee Storage\LogicNP.EZNamespaceExtensions.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
Celkový čas: 2012-08-01 00:13:27
ComboFix-quarantined-files.txt 2012-07-31 22:13
ComboFix2.txt 2012-07-31 21:40
.
Před spuštěním: Volných bajtů: 51 199 205 376
Po spuštění: Volných bajtů: 51 318 439 936
.
- - End Of File - - 9AF2E7F5C892EC2CE36E8AB6731A941B

Druhy krok.
Winsockfix.exe jsem spustil a restartoval pocitac.
Po nabehnuti se jiz na web dostanu...
Zdá se tedy, že problém je vyřešen.

Mam presto spustit ještě MBAM ?

Urcite ho udelejte. Je treba najit i pricinu problemu, ktera tam mozna jeste je!

Dobrá, spustil jsem tedy třetí krok MBAM úplná kontrola. Vzhledem k tomu, že to asi poběží ještě dlouho se již dnes dál nedostanu. Budu pokračovat zítra.
Prozatím moc děkuju za velmi rychlou pomoc a rady.

Dobry napad, taky uz za chvili vypinam pc. Takze zitra to docistime

A nemate zac

Treti krok dokoncen.
MBAM nezjistil zadny malware:


Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.62.0.1300
www.malwarebytes.org

Verze databáze: v2012.08.07.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Danulka :: MAZEL [administrátor]

Ochrana: Povolena

7.8.2012 23:15:48
mbam-log-2012-08-07 (23-15-48).txt

Typ: Úplná kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 247416
Uplynulý čas: 57 minut, 12 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

OK

MBAM opet odinstalujte.

V pc vidim AVG, ale i Norton Internet Security. Jeden je treba vyhodit, jinak bude dochazet ke kolizim stitu. Na odstraneni pouzijte odinstalator http://forum.viry.cz/viewtopic.php?f=29&t=42886

Az se jednoho z nich zbavite, dejte sem aktualni log z RSIT a dorazime zbytek

omlouvám se za zpozdenou reakci...
MBAM odinstalovcan.
Norton i AVG removal tools spusteny.
Restart PC.
RSIT pusten:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Danulka at 2012-08-09 22:47:27
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 49 GB (58%) free of 85 GB
Total RAM: 1014 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:47:36, on 9.8.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Guard-ICQ\GuardICQ.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Danulka\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Documents and Settings\Danulka\Plocha\RSIT.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\trend micro\Danulka.exe
C:\WINDOWS\system32\dwwin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/#utm_source=icq&u ... um=generic
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto
O4 - HKLM\..\Run: [EasyMode] "%ProgramFiles%\\ASUS\\Easy Mode\\Easy Mode.exe" --limitedUserImportRegister
O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe
O4 - HKLM\..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Danulka\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: SuperHybridEngine.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igdlogin - igdlogin.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Guard.Mail.ru - Unknown owner - C:\Program Files\Guard-ICQ\GuardICQ.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: privoxy - Unknown owner - C:\Program Files\Privoxy\privoxy.exe (file missing)
O23 - Service: SRS Volume Sync Service (SRS_VolSync_Service) - SRS Labs, Inc. - C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe

--
End of file - 6814 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3942723344-1541602582-529602982-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3942723344-1541602582-529602982-1005UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}]
AVG Do Not Track - C:\Program Files\AVG\AVG2012\avgdtiex.dll [2012-06-13 937592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-05-11 17881600]
"LiveUpdate"=C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [2009-06-01 712704]
"EasyMode"=C:\Program Files\\ASUS\\Easy Mode\\Easy Mode.exe [2009-03-18 1249280]
"AsusACPIServer"=C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe [2009-06-04 696320]
"AsusEPCMonitor"=C:\Program Files\EeePC\ACPI\AsEPCMon.exe [2009-05-08 98304]
"SynAsusAcpi"=C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [2009-03-06 79144]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Danulka\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2012-08-08 116648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2009-02-06 3885408]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
SuperHybridEngine.lnk - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Documents and Settings\Danulka\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igdlogin]
C:\WINDOWS\system32\igdlogin.dll [2009-04-28 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ7.7\ICQ.exe"="C:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"C:\WINDOWS\system32\usmt\migwiz.exe"="C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Průvodce přenesením souborů a nastavení"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
"C:\Documents and Settings\Danulka\Local Settings\temp\7zS66.tmp\SymNRT.exe"="C:\Documents and Settings\Danulka\Local Settings\temp\7zS66.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\ICQ7.7\ICQ.exe"="C:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-08-09 22:38:09 ----SHD---- C:\RECYCLER
2012-08-07 23:00:13 ----A---- C:\WINDOWS\resetlog.txt
2012-08-07 22:08:42 ----D---- C:\Program Files\trend micro
2012-08-07 22:08:41 ----D---- C:\rsit
2012-08-07 20:20:32 ----HD---- C:\$AVG
2012-08-01 00:13:30 ----D---- C:\WINDOWS\temp
2012-08-01 00:13:28 ----A---- C:\ComboFix.txt
2012-07-31 23:24:00 ----A---- C:\WINDOWS\zip.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\SWSC.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\SWREG.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\sed.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\PEV.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\NIRCMD.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\MBR.exe
2012-07-31 23:24:00 ----A---- C:\WINDOWS\grep.exe
2012-07-31 22:57:05 ----D---- C:\Qoobox
2012-07-31 22:56:14 ----D---- C:\WINDOWS\erdnt
2012-07-31 22:44:03 ----D---- C:\Documents and Settings\Danulka\Data aplikací\AVG2012
2012-07-31 22:37:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2012
2012-07-31 22:36:28 ----D---- C:\Program Files\AVG
2012-07-31 22:23:23 ----D---- C:\temp
2012-07-31 21:51:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2012-07-31 21:48:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\NortonInstaller
2012-07-31 21:45:38 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2012-07-31 21:43:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2012-07-31 21:37:57 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2012-07-31 21:35:23 ----A---- C:\WINDOWS\ntbtlog.txt
2012-07-13 16:56:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2691442$
2012-07-13 16:56:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2718523$
2012-07-13 16:55:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2655992$
2012-07-13 16:55:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2719985$
2012-07-13 16:52:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2698365$

======List of files/folders modified in the last 1 month======

2012-08-09 22:47:36 ----D---- C:\WINDOWS\Prefetch
2012-08-09 22:42:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-08-09 22:26:06 ----RD---- C:\Program Files
2012-08-09 22:25:01 ----D---- C:\WINDOWS\system32\drivers
2012-08-09 22:21:49 ----SHD---- C:\WINDOWS\Installer
2012-08-09 22:15:16 ----D---- C:\Documents and Settings\Danulka\Data aplikací\Skype
2012-08-08 17:28:30 ----SD---- C:\WINDOWS\Tasks
2012-08-08 17:18:20 ----D---- C:\WINDOWS\system32
2012-08-08 17:18:20 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-08-08 17:14:02 ----D---- C:\WINDOWS\system32\CatRoot2
2012-08-07 23:00:16 ----D---- C:\WINDOWS\system32\drivers\etc
2012-08-07 23:00:13 ----D---- C:\WINDOWS
2012-08-07 20:55:23 ----SHD---- C:\System Volume Information
2012-08-07 20:55:22 ----D---- C:\Program Files\Common Files
2012-08-07 20:50:16 ----HD---- C:\WINDOWS\inf
2012-08-07 20:19:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-08-01 00:10:14 ----A---- C:\WINDOWS\system.ini
2012-08-01 00:03:38 ----D---- C:\WINDOWS\AppPatch
2012-07-31 22:58:52 ----D---- C:\WINDOWS\Minidump
2012-07-31 22:36:10 ----D---- C:\WINDOWS\WinSxS
2012-07-31 21:51:09 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-07-31 21:35:44 ----D---- C:\Documents and Settings
2012-07-31 21:29:36 ----D---- C:\WINDOWS\Network Diagnostic
2012-07-17 20:47:59 ----D---- C:\Documents and Settings\Danulka\Data aplikací\ICQ
2012-07-13 16:56:10 ----A---- C:\WINDOWS\imsins.BAK
2012-07-13 16:56:03 ----HD---- C:\WINDOWS\$hf_mig$
2012-07-13 16:52:13 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-02-06 55152]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2009-03-27 1529600]
R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2008-04-08 10752]
R3 btaudio;Zvukové zařízení Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2008-12-30 534568]
R3 BTDriver;Ovladač virtuálních komunikací Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-12-30 37160]
R3 BTKRNL;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-12-30 991656]
R3 BTWDNDIS;Server pro přístup k síti LAN Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-12-30 156816]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-12-30 47272]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 igd;igd; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-04-28 5096544]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-05-12 5080064]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-03-02 38912]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound; C:\WINDOWS\system32\drivers\srs_PremiumSound_i386.sys [2009-05-18 233512]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-03-06 208304]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 usbvideo;USB µř°T¸Ë¸m (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 uvclf;uvclf; C:\WINDOWS\system32\DRIVERS\uvclf.sys [2008-11-19 39040]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S0 AVGIDSHX;AVGIDSHX; C:\WINDOWS\system32\DRIVERS\avgidshx.sys []
S1 policyappblockservice;Parental Control Application Filter; \??\C:\Program Files\Parental Control\bin\policyappblock.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-12-05 346720]
R2 Guard.Mail.ru;Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [2012-02-26 1564368]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2011-08-17 247872]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 SRS_VolSync_Service;SRS Volume Sync Service; C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [2009-05-19 107744]
S2 privoxy;privoxy; C:\Program Files\Privoxy\privoxy.exe --service []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-05-03 158856]

-----------------EOF-----------------

Najdete tento soubor C:\Program Files\trend micro\Danulka.exe a spustte ho.
Kliknete na Main menu a na Do a system scan only
U techto radku dejte vlevo zatrzitko Kliknete na nápis Fix checked a potvrdte




Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe , ulozte nejlepe na plochu a spustte.
Do leveho okna zkopirujte tento skript (vcetne te dvojtecky pred slovem commands) Kliknete na MoveIt a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu sem dejte log, ktery na vas vyskoci, nebo bude zde C:\_OTM\MovedFiles\xxxxxxxx_xxxxxx (misto tech x budou cisla, predstavujici datum a cas spusteni)




Nainstalujte nejaky antivir, doporucuji Avast, Aviru, nebo MSE

Danulka.exe spusten a zaznamy fixed.

OTM spusten, log:


All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes
->Flash cache emptied: 621 bytes

User: All Users

User: Danulka
->Temp folder emptied: 25884219 bytes
->Temporary Internet Files folder emptied: 12247150 bytes
->Google Chrome cache emptied: 188079499 bytes
->Flash cache emptied: 8275 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 405 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 37074 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16494 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 10733981 bytes

Total Files Cleaned = 226,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Danulka
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
========== SERVICES/DRIVERS ==========
Service AVGIDSHX stopped successfully!
Service AVGIDSHX deleted successfully!
Service AVGIDSShim stopped successfully!
Service AVGIDSShim deleted successfully!
Service Guard.Mail.ru stopped successfully!
Service Guard.Mail.ru deleted successfully!
Service ICQ Service stopped successfully!
Service ICQ Service deleted successfully!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3942723344-1541602582-529602982-1005Core.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3942723344-1541602582-529602982-1005UA.job moved successfully.
c:\program files\ICQ6Toolbar folder moved successfully.
C:\$AVG\$VAULT folder moved successfully.
C:\$AVG\$CHJW folder moved successfully.
C:\$AVG folder moved successfully.
C:\Documents and Settings\Danulka\Data aplikací\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\Danulka\Data aplikací\AVG2012 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\update\prepare folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\update\download folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\update\backup folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\update folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Temp folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\SetupBackup folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\scanlogs folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\lsdb\prev folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\lsdb folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\log folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\profile folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\9 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\8 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\7 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\6 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\5 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\4 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\3 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\2 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\1 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox\0 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\outbox folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\malwareprofile folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\download folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS\config folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\IDS folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\fet folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\EMC folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Dumps folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Chjw\a000b2f200b2cf12 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Chjw\707c73367c72f666 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Chjw folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Cfg folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\avgam folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\Antispam folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012\admincli folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\AVG2012 folder moved successfully.
C:\Program Files\AVG\AVG2012\sounds folder moved successfully.
C:\Program Files\AVG\AVG2012\PCTuneup folder moved successfully.
C:\Program Files\AVG\AVG2012\Notification folder moved successfully.
C:\Program Files\AVG\AVG2012\myapps folder moved successfully.
C:\Program Files\AVG\AVG2012\Icons folder moved successfully.
C:\Program Files\AVG\AVG2012\html\reportcard folder moved successfully.
C:\Program Files\AVG\AVG2012\html folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\defaults\preferences folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\defaults folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\components folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\Chrome folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack folder moved successfully.
C:\Program Files\AVG\AVG2012\Firefox folder moved successfully.
C:\Program Files\AVG\AVG2012\Drivers folder moved successfully.
C:\Program Files\AVG\AVG2012\Content folder moved successfully.
C:\Program Files\AVG\AVG2012\Chrome folder moved successfully.
C:\Program Files\AVG\AVG2012\cfgall folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\pct\component folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\pct folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\obx\component folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\obx folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\fas\component folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\fas folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\dav\component folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs\dav folder moved successfully.
C:\Program Files\AVG\AVG2012\awacs folder moved successfully.
C:\Program Files\AVG\AVG2012\3rd_party\licenses folder moved successfully.
C:\Program Files\AVG\AVG2012\3rd_party folder moved successfully.
C:\Program Files\AVG\AVG2012 folder moved successfully.
C:\Program Files\AVG folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\Norton\00000082\000000fb\000002c3 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\Norton\00000082\000000fb folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\Norton\00000082 folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\Norton folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs\8-7-2012-20h54m27s folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs\8-7-2012-20h48m49s folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs\7-31-2012-21h50m18s folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs\7-31-2012-21h48m51s folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs\7-31-2012-21h48m22s folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller\Logs folder moved successfully.
C:\Documents and Settings\All Users\Data aplikací\NortonInstaller folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr\ deleted successfully.

OTM by OldTimer - Version 3.1.21.0 log created on 08102012_102302

Files moved on Reboot...

Registry entries deleted on Reboot...

OTM provedlo co melo.

Ted tam jeste hodte nejaky ten antivir. Jestli mate zakoupenou licenci na to AVG ci Norton, tak samozrejme tam dejte jeden z nich.
Pokud ne, dejte tam jeden z tech tri, co jsem vypsal. Vsechny jsou free.

Pak napiste, jak je na tom pc a bud uklidime, nebo budeme patrat dale

Nainstaloval jsem Avira Personal a po proscanovani tvrdi, ze No detection!.
Avira je aktivní v modu Realtime protection a Web protection. Widows Firewall je aktivní a Centrum Zabezpeceni hlasi, ze mám aktivní externí antivirový program.
Takže by to snad mělo být v pořádku. HTTP už mi funguje, píšu z toho pc.
Moc děkuju za rady a za rychlou pomoc !