VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Preventivka

https://forum.viry.cz:443/viewtopic.php?t=124390

Stránka 1 z 1

Preventivka

Napsal: 19 zář 2012 06:30
od Kastab
Poprosím a zkontrolování mého logu, mockrát děkuji.


Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2012-09-19 07:29:15
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 245 GB (80%) free of 305 GB
Total RAM: 1023 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:29:28, on 19.9.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\windows\system32\msiexec.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\trend micro\Administrator.exe
C:\windows\system32\MsiExec.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe

--
End of file - 4774 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-08-13 4120256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-08-11 77824]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2012-08-30 15512424]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2012-08-30 1634112]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-08-21 4282728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe [2012-09-14 116648]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-09-14 895376]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2012-06-26 1516632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\Program Files\Garena Plus\Room\garena_room.exe"="C:\Program Files\Garena Plus\Room\garena_room.exe:*:Enabled:Garena"
"C:\Gamesy\killingfloor\System\KillingFloor.exe"="C:\Gamesy\killingfloor\System\KillingFloor.exe:*:Enabled:KillingFloor"
"C:\Gamesy\Killing Floor\KillingFloor\System\KillingFloor.exe"="C:\Gamesy\Killing Floor\KillingFloor\System\KillingFloor.exe:*:Enabled:KillingFloor"
"C:\Gamesy\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat"="C:\Gamesy\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Gamesy\Left4Dead\hl2.exe"="C:\Gamesy\Left4Dead\hl2.exe:*:Enabled:hl2"
"C:\Gamesy\Left4Dead\left4dead.exe"="C:\Gamesy\Left4Dead\left4dead.exe:*:Enabled:left4dead"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"midi"=wdmaud.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\windows\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\windows\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer4"=wdmaud.drv
"msacm.divxa32"=msaud32_divx.acm

======List of files/folders created in the last 1 month======

2012-09-19 07:29:16 ----D---- C:\Program Files\trend micro
2012-09-19 07:29:15 ----D---- C:\rsit
2012-09-18 20:05:47 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2012-09-18 20:05:36 ----RD---- C:\Program Files\Skype
2012-09-18 20:05:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2012-09-16 17:58:25 ----A---- C:\Documents and Settings\Administrator\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-16 13:54:32 ----D---- C:\Documents and Settings\Administrator\Data aplikací\My Battle for Middle-earth(tm) II Files
2012-09-16 13:28:10 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PhotoFiltre Studio X
2012-09-16 13:28:05 ----D---- C:\Program Files\PhotoFiltre Studio X
2012-09-16 13:23:14 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2012-09-16 13:23:10 ----HDC---- C:\WINDOWS\$NtUninstallWdf01009$
2012-09-16 13:22:35 ----A---- C:\WINDOWS\system32\ptpusb.dll
2012-09-16 13:22:34 ----A---- C:\WINDOWS\system32\ptpusd.dll
2012-09-16 13:22:34 ----A---- C:\WINDOWS\system32\drivers\usbscan.sys
2012-09-16 13:13:01 ----D---- C:\WINDOWS\system32\NtmsData
2012-09-16 12:56:58 ----A---- C:\WINDOWS\system32\btw_ci.dll
2012-09-16 11:43:22 ----D---- C:\WINDOWS\RegisteredPackages
2012-09-16 11:42:52 ----A---- C:\WINDOWS\system32\drivers\mstee.sys
2012-09-16 11:42:47 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2012-09-16 11:10:53 ----A---- C:\WINDOWS\ALCFDRTM.EXE
2012-09-16 11:10:48 ----D---- C:\WINDOWS\system32\Lang
2012-09-16 10:53:14 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Nokia
2012-09-16 10:53:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Suite
2012-09-16 10:53:13 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PC Suite
2012-09-16 10:50:56 ----D---- C:\Program Files\Common Files\PCSuite
2012-09-16 10:50:47 ----D---- C:\Program Files\Common Files\Nokia
2012-09-16 10:50:37 ----D---- C:\Program Files\DIFX
2012-09-16 10:50:35 ----A---- C:\WINDOWS\system32\drivers\pccsmcfd.sys
2012-09-16 10:50:24 ----D---- C:\Program Files\PC Connectivity Solution
2012-09-16 10:50:16 ----A---- C:\WINDOWS\system32\drivers\ccdcmbo.sys
2012-09-16 10:50:14 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-09-16 10:50:14 ----A---- C:\WINDOWS\system32\wdfcoinstaller01009.dll
2012-09-16 10:50:14 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2012-09-16 10:50:14 ----A---- C:\WINDOWS\system32\drivers\ccdcmb.sys
2012-09-16 10:50:14 ----A---- C:\WINDOWS\system32\ccdcmbwu.dll
2012-09-16 10:50:13 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2012-09-16 10:50:11 ----D---- C:\Program Files\Nokia
2012-09-16 10:49:24 ----D---- C:\Documents and Settings\All Users\Data aplikací\Installations
2012-09-15 13:15:49 ----D---- C:\WINDOWS\SxsCaPendDel
2012-09-15 12:44:04 ----A---- C:\WINDOWS\War3Unin.dat
2012-09-15 12:44:03 ----A---- C:\WINDOWS\War3Unin.pif
2012-09-15 12:44:03 ----A---- C:\WINDOWS\War3Unin.exe
2012-09-15 10:58:54 ----D---- C:\Documents and Settings\Administrator\Data aplikací\GRETECH
2012-09-15 10:56:26 ----D---- C:\Program Files\GRETECH
2012-09-15 10:02:03 ----A---- C:\Documents and Settings\Administrator\Data aplikací\room_v3.dat
2012-09-15 08:44:31 ----D---- C:\Documents and Settings\Administrator\Data aplikací\GarenaPlus
2012-09-15 08:41:34 ----D---- C:\Program Files\Garena Plus
2012-09-15 08:41:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\GarenaMessenger
2012-09-15 08:22:55 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2012-09-15 08:22:40 ----D---- C:\Documents and Settings\Administrator\Data aplikací\DAEMON Tools Lite
2012-09-15 08:22:30 ----D---- C:\Program Files\DAEMON Tools Lite
2012-09-15 08:21:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2012-09-15 08:20:11 ----D---- C:\Gamesy
2012-09-14 23:52:16 ----A---- C:\WINDOWS\system32\drivers\mouhid.sys
2012-09-14 23:50:58 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys
2012-09-14 23:50:56 ----A---- C:\WINDOWS\system32\drivers\hidusb.sys
2012-09-14 23:39:45 ----A---- C:\Documents and Settings\Administrator\Data aplikací\GDIPFONTCACHEV1.DAT
2012-09-14 23:36:49 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2012-09-14 23:34:08 ----D---- C:\Program Files\MSBuild
2012-09-14 23:34:03 ----D---- C:\WINDOWS\system32\XPSViewer
2012-09-14 23:33:58 ----D---- C:\WINDOWS\system32\en-us
2012-09-14 23:33:57 ----D---- C:\Program Files\Reference Assemblies
2012-09-14 23:29:49 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-09-14 23:29:48 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-09-14 23:29:46 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-09-14 23:29:46 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-09-14 23:29:45 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-09-14 23:29:44 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-09-14 23:29:44 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-09-14 23:29:43 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-09-14 23:29:19 ----A---- C:\WINDOWS\avastSS.scr
2012-09-14 23:29:18 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-09-14 23:28:58 ----D---- C:\Program Files\AVAST Software
2012-09-14 23:28:58 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-09-14 23:15:43 ----N---- C:\WINDOWS\system32\spmsg2.dll
2012-09-14 23:15:41 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2012-09-14 23:15:15 ----RSD---- C:\WINDOWS\assembly
2012-09-14 23:14:59 ----D---- C:\WINDOWS\Microsoft.NET
2012-09-14 23:11:14 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA
2012-09-14 23:10:25 ----D---- C:\temp
2012-09-14 23:09:56 ----A---- C:\WINDOWS\system32\nvhdap32.dll
2012-09-14 23:09:56 ----A---- C:\WINDOWS\system32\nvhdagenco3220103.dll
2012-09-14 23:09:56 ----A---- C:\WINDOWS\system32\drivers\nvhda32.sys
2012-09-14 23:09:54 ----A---- C:\WINDOWS\system32\nvopencl.dll
2012-09-14 23:09:54 ----A---- C:\WINDOWS\system32\nvdispgenco32.dll
2012-09-14 23:09:54 ----A---- C:\WINDOWS\system32\nvdispco32.dll
2012-09-14 23:09:52 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-09-14 23:09:52 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-09-14 23:09:52 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-09-14 23:09:52 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-09-14 23:09:51 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-09-14 23:09:51 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-09-14 23:09:51 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-09-14 23:09:50 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-09-14 23:09:49 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-09-14 23:09:49 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-09-14 23:09:49 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-09-14 23:09:48 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-09-14 23:09:48 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-09-14 23:09:47 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-09-14 23:09:08 ----D---- C:\NVIDIA
2012-09-14 23:05:01 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2012-09-14 23:02:45 ----D---- C:\Program Files\uTorrent
2012-09-14 23:02:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2012-09-14 23:01:58 ----D---- C:\Program Files\CCleaner
2012-09-14 23:01:35 ----D---- C:\Documents and Settings\Administrator\Data aplikací\WinRAR
2012-09-14 23:01:33 ----D---- C:\Program Files\WinRAR
2012-09-14 22:53:41 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Google
2012-09-14 22:52:46 ----A---- C:\WINDOWS\system32\hidserv.dll
2012-09-14 22:52:45 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys

======List of files/folders modified in the last 1 month======

2012-09-19 07:29:24 ----SHD---- C:\WINDOWS\Installer
2012-09-19 07:29:24 ----D---- C:\WINDOWS\Prefetch
2012-09-19 07:29:16 ----RD---- C:\Program Files
2012-09-19 07:27:19 ----D---- C:\WINDOWS\Temp
2012-09-18 20:05:37 ----D---- C:\Program Files\Common Files
2012-09-18 19:42:16 ----D---- C:\WINDOWS\system32
2012-09-18 19:42:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-09-18 12:14:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-09-18 12:14:02 ----D---- C:\WINDOWS
2012-09-18 08:50:04 ----D---- C:\WINDOWS\system32\CatRoot2
2012-09-16 21:01:49 ----D---- C:\WINDOWS\WinSxS
2012-09-16 21:01:46 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-09-16 13:24:11 ----D---- C:\WINDOWS\system32\CatRoot
2012-09-16 13:23:22 ----D---- C:\WINDOWS\system32\drivers
2012-09-16 13:23:18 ----HD---- C:\WINDOWS\inf
2012-09-16 13:22:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-09-16 11:42:32 ----D---- C:\WINDOWS\system32\DirectX
2012-09-16 11:21:08 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-09-15 19:48:31 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2012-09-15 08:20:24 ----D---- C:\Acpi
2012-09-14 23:44:23 ----D---- C:\WINDOWS\SoftwareDistribution
2012-09-14 23:44:23 ----D---- C:\WINDOWS\Minidump
2012-09-14 23:44:23 ----D---- C:\WINDOWS\Debug
2012-09-14 23:36:32 ----D---- C:\WINDOWS\system32\cs-cz
2012-09-14 23:36:16 ----D---- C:\WINDOWS\system32\mui
2012-09-14 23:34:06 ----RSD---- C:\WINDOWS\Fonts
2012-09-14 23:29:44 ----SD---- C:\WINDOWS\Tasks
2012-09-14 23:15:48 ----D---- C:\WINDOWS\system32\spool
2012-09-14 23:15:03 ----D---- C:\Program Files\Internet Explorer
2012-09-14 23:14:59 ----D---- C:\WINDOWS\pchealth
2012-09-14 23:12:07 ----D---- C:\WINDOWS\Help
2012-09-14 23:11:13 ----D---- C:\Documents and Settings
2012-09-14 23:11:11 ----D---- C:\Program Files\NVIDIA Corporation
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvcuda.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nvapi.dll
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2012-08-30 18:44:07 ----A---- C:\WINDOWS\system32\nvwddi.dll
2012-08-30 18:43:36 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2012-08-30 18:43:36 ----A---- C:\WINDOWS\system32\nvcpl.dll
2012-08-30 18:43:34 ----A---- C:\WINDOWS\system32\nvmctray.dll
2012-08-30 18:43:34 ----A---- C:\WINDOWS\system32\nvcolor.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 BtHidBus;Bluetooth HID Bus Service; C:\WINDOWS\System32\Drivers\BtHidBus.sys [2009-09-24 19592]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-08-21 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-08-21 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-08-21 729752]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-08-21 355632]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-08-21 54232]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2012-09-15 242240]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-08-21 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-08-21 97608]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-08-11 2324480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2012-08-30 12555680]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-01-13 33408]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2012-07-03 124264]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-01-13 12928]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 btkrnl;Enumenátor sběrnice Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys []
S3 btnetBUs;Bluetooth PAN Bus Service; C:\WINDOWS\System32\Drivers\btnetBus.sys [2009-09-24 22528]
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files\Garena Plus\Room\safedrv.sys []
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:\WINDOWS\System32\Drivers\IvtBtBus.sys [2009-06-17 25480]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2012-01-09 18176]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2012-01-09 23168]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-08-21 44808]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2012-08-30 164200]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-08-30 1258856]
R2 Skype C2C Service;Skype C2C Service; C:\Documents and Settings\All Users\Data aplikací\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

Re: Preventivka

Napsal: 19 zář 2012 07:22
od Márty84
Zdravim.

:???: Proc by to mel nekdo kontrolovat, kdyz se na to pak stejne vykaslete :evil:
http://forum.viry.cz/viewtopic.php?f=30&t=124311

Re: Preventivka

Napsal: 19 zář 2012 19:19
od Kastab
Jo omlouvám se, jsem zapoměl opomenout. Já znova reinstaloval windows, protože jsem měl problém se souborem pod názvem isas.exe po startu systému.

Re: Preventivka

Napsal: 20 zář 2012 09:11
od Márty84
Dobra tedy. Ale upozornuju, ze jestli to nedokoncite (aspon nedate vedet, ze uz to nehodlate resit), priste to nikdo kontrolovat nebude. Nebylo to totiz poprve. OK?



:!: Jestli bude Avast rvat, ze to chce otevrit v sandboxu, nedovolte to! Vyberte moznost Otevrit normalne
:arrow: Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe , ulozte nejlepe na plochu a spustte.
Do leveho okna zkopirujte tento skript (vcetne te dvojtecky pred slovem commands)

Kód: Vybrat vše

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[RESETHOSTS]
[Purity]

:services
Skype C2C Service

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500UA.job

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"=-
"NvMediaCenter"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
"uTorrent"=-
"DAEMON Tools Lite"=-
"PC Suite Tray"=-
Kliknete na MoveIt a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu sem dejte log, ktery na vas vyskoci, nebo bude zde C:\_OTM\MovedFiles\xxxxxxxx_xxxxxx (misto tech x budou cisla, predstavujici datum a cas spusteni)




:arrow: Udelejte !!!uplnou!!! kontrolu s MBAM http://forum.viry.cz/viewtopic.php?f=29&t=115222 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

Re: Preventivka

Napsal: 20 zář 2012 12:28
od Kastab
Udělal jsem vše co jste napsal.

Mbam log =


Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Verze databáze: v2012.09.07.13

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Administrator :: XXX-22E4A69236C [administrátor]

20.9.2012 12:48:25
mbam-log-2012-09-20 (12-48-25).txt

Typ: Úplná kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 233719
Uplynulý čas: 12 minut, 21 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Re: Preventivka

Napsal: 20 zář 2012 18:07
od Márty84
A kde mam ten log z OTM? :D

Edit by Motji//
Pro neaktivitu v tomto vlákně zamykám :closed: . Pro případné odemknutí topicu kontaktu některého z moderátorů na email.
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz