VIRY.CZ

Počítač ide normálne ale zrazu sa prehreje na enormnú teplotu a vypne sa. Videa na počítači sekajú jak nikdy ale výkonom počítača to nieje. Asi včera mi za záhadných okolností zmizol obsah USB diskov,tajomný vír sa zameral iba na text a zanechal iba toto:
0#
Zároveň na druhej časti disku ak otvorím súbor hociaký textový zobrazí sa iný súbor vlnovka#názov suboru zasa vlnovka #look
Zároveň som zistil že vír zmenil práva k súborom na druhom disku všetky mal obmädzený účet Liongard ale za záhadných okolností teraz všetky súbory patria administrátorskému účtu Tomas. Učet Liongard s ktorého sa prihlasujem bol obmedzený včera sa z neho za záhadných okolností stal administrátorský. Prosím o kontrolu logu a zároveň o kontrolu mojich dôležitých odt súborov.

Log z RSIT:
Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-06-18 23:30:41
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 13 GB (43%) free of 30 GB
Total RAM: 1014 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:30:47, on 18.6.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Documents and Settings\Tomas\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Tomas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: _uninst_41460089.lnk = C:\Documents and Settings\Tomas\Local Settings\Temp\_uninst_41460089.bat
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 4424 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\avast! Emergency Update.job - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\cznc1nk8.default

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 13.0.0.214 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-05-07 436600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-05-10 16342528]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-07 102400]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2000-01-01 134656]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2000-01-01 166912]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2000-01-01 135680]
""= []
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-06-06 3890208]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2011-10-28 49208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
C:\PROGRA~1\OPENOF~1.4\program\QUICKS~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk]
C:\WINDOWS\system32\RunDll32.exe [2008-04-14 33280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk]
C:\WINDOWS\system32\RunDll32.exe [2008-04-14 33280]

C:\Documents and Settings\Tomas\Nabídka Start\Programy\Po spuštění
_uninst_41460089.lnk - C:\Documents and Settings\Tomas\Local Settings\Temp\_uninst_41460089.bat

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2000-01-01 205824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\Tomas\Plocha\Nová složka\mysql\bin\mysqld_usbwv8.exe"="C:\Documents and Settings\Tomas\Plocha\Nová složka\mysql\bin\mysqld_usbwv8.exe:*:Enabled:mysqld_usbwv8"
"F:\Moje_Stranky\mysql\bin\mysqld_usbwv8.exe"="F:\Moje_Stranky\mysql\bin\mysqld_usbwv8.exe:*:Enabled:mysqld_usbwv8"
"F:\Moje_Stranky\apache\bin\httpd_usbwv8.exe"="F:\Moje_Stranky\apache\bin\httpd_usbwv8.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe"="C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP (HP Deskjet 1050 J410 series)"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP (HP Deskjet 3520 series)"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:Síťový komunikační program HP (HP Deskjet 3520 series)"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Disabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\Moje_Stranky\mysql\bin\mysqld_usbwv8.exe"="D:\Moje_Stranky\mysql\bin\mysqld_usbwv8.exe:*:Enabled:mysqld_usbwv8"
"D:\Moje_Stranky\apache\bin\httpd_usbwv8.exe"="D:\Moje_Stranky\apache\bin\httpd_usbwv8.exe:*:Enabled:Apache HTTP Server"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-06-18 12:22:46 ----D---- C:\Program Files\Mozilla Firefox
2014-06-17 22:51:06 ----D---- C:\Program Files\Kernel for Writer Evaluation ver
2014-06-17 18:45:40 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-06-17 18:45:40 ----A---- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2014-06-17 08:54:33 ----D---- C:\Program Files\Recuva
2014-06-06 16:17:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\InstallMate
2014-06-05 10:45:39 ----A---- C:\WINDOWS\wcx_ftp.ini
2014-06-05 10:40:39 ----A---- C:\WINDOWS\WINCMD.INI
2014-05-26 23:10:04 ----D---- C:\Documents and Settings\Tomas\Data aplikací\OpenOffice
2014-05-26 23:06:13 ----D---- C:\Program Files\OpenOffice 4
2014-05-26 22:58:15 ----SHD---- C:\Config.Msi
2014-05-25 16:40:55 ----D---- C:\Program Files\Tropico

======List of files/folders modified in the last 1 month======

2014-06-18 23:30:44 ----D---- C:\WINDOWS\Prefetch
2014-06-18 23:30:43 ----D---- C:\Program Files\trend micro
2014-06-18 23:28:22 ----D---- C:\WINDOWS\Temp
2014-06-18 22:57:04 ----D---- C:\WINDOWS\system32
2014-06-18 22:57:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-06-18 17:15:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-06-18 12:45:14 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-06-18 12:45:13 ----RD---- C:\Program Files
2014-06-17 18:45:40 ----D---- C:\WINDOWS\system32\drivers
2014-06-17 18:45:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2014-06-17 08:49:17 ----D---- C:\WINDOWS
2014-06-16 19:24:04 ----D---- C:\WINDOWS\system32\CatRoot2
2014-06-13 11:14:22 ----D---- C:\Program Files\Battle for Wesnoth 1.10.7
2014-06-06 20:06:29 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2014-05-27 18:43:01 ----D---- C:\Documents and Settings\Tomas\Data aplikací\Notepad++
2014-05-26 23:08:28 ----SHD---- C:\WINDOWS\Installer
2014-05-26 23:07:57 ----D---- C:\WINDOWS\assembly
2014-05-26 23:06:34 ----RSD---- C:\WINDOWS\Fonts
2014-05-26 23:05:41 ----D---- C:\WINDOWS\WinSxS
2014-05-26 23:03:43 ----D---- C:\WINDOWS\Minidump
2014-05-26 22:54:17 ----D---- C:\Documents and Settings\Tomas\Data aplikací\OpenOffice.org2
2014-05-25 16:51:06 ----SD---- C:\Documents and Settings\Tomas\Data aplikací\Microsoft
2014-05-25 16:51:06 ----D---- C:\Documents and Settings\Tomas\Data aplikací\Adobe
2014-05-25 16:40:54 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 41460089;41460089; C:\WINDOWS\system32\DRIVERS\41460089.sys [2014-05-16 133208]
R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2014-05-07 49944]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2014-05-07 180632]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2014-05-15 54832]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2014-05-15 777488]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2014-05-15 411680]
R1 aswTdi;aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [2014-05-07 57672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2014-05-07 24184]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2014-05-07 67824]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2000-01-01 1202560]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-06-06 161792]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2000-01-01 1730272]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-05-10 4419584]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-09-07 215904]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2009-03-17 58208]
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-07-26 547904]
S3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2011-05-24 1979328]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2000-01-01 13312]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-05-07 50344]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14 257712]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-18 119408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-07-20 754856]

-----------------EOF-----------------

Zdravím!
Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

ComboFix 14-06-19.01 - Tomas 20.06.2014 11:35:41.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.686 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Dokumenty\Sta×enÚ soubory\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Desktop_.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-05-20 do 2014-06-20 )))))))))))))))))))))))))))))))
.
.
2014-06-17 20:51 . 2014-06-17 21:00 -------- d-----w- c:\program files\Kernel for Writer Evaluation ver
2014-06-17 16:45 . 2014-06-17 16:45 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-06-17 16:45 . 2014-05-12 05:26 53208 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-17 06:54 . 2014-06-17 17:37 -------- d-----w- c:\program files\Recuva
2014-06-06 14:17 . 2014-06-06 14:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2014-06-05 08:55 . 2014-06-05 08:55 -------- d-----w- c:\documents and settings\Tomas\Nová složka
2014-05-26 21:10 . 2014-05-26 21:10 -------- d-----w- c:\documents and settings\Tomas\Data aplikací\OpenOffice
2014-05-26 21:06 . 2014-05-26 21:06 -------- d-----w- c:\program files\OpenOffice 4
2014-05-25 14:40 . 2014-05-25 14:53 -------- d-----w- c:\program files\Tropico
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-16 12:25 . 2014-05-16 12:21 133208 ----a-w- c:\windows\system32\drivers\41460089.sys
2014-05-15 14:29 . 2014-05-07 18:21 777488 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-15 14:29 . 2014-05-07 18:21 411680 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-05-15 14:29 . 2014-05-07 18:21 54832 ----a-w- c:\windows\system32\drivers\aswrdr.sys
2014-05-14 10:35 . 2014-01-12 16:53 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-14 10:35 . 2014-01-12 16:53 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-12 05:25 . 2014-01-10 09:31 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-07 18:21 . 2014-05-07 18:21 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400164167312
2014-05-07 18:21 . 2014-05-07 18:21 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2014-05-07 18:21 . 2014-05-07 18:21 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-05-07 18:21 . 2014-05-07 18:21 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-05-07 18:21 . 2014-05-07 18:21 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-05-07 18:21 . 2014-05-07 18:21 54832 ----a-w- c:\windows\system32\drivers\aswrdr.sys.1400164167312
2014-05-07 18:21 . 2014-05-07 18:21 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-05-07 18:21 . 2014-05-07 18:21 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-05-07 18:21 . 2014-05-07 18:21 43152 ----a-w- c:\windows\avastSS.scr
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-07 18:21 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-07 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 135680]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-06-06 3890208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk
backup=c:\windows\pss\Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk
backup=c:\windows\pss\Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-10-28 11:18 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
.
R0 41460089;41460089;c:\windows\system32\drivers\41460089.sys [16.5.2014 14:21 133208]
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [7.5.2014 20:21 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [7.5.2014 20:21 180632]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [7.5.2014 20:21 777488]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [7.5.2014 20:21 411680]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [7.5.2014 20:21 24184]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [7.5.2014 20:21 67824]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-06-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-12 10:35]
.
2014-06-20 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-07 18:21]
.
.
------- Doplňkový sken -------
.
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\cznc1nk8.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\_uninst_41460089.lnk - c:\documents and settings\Tomas\Local Settings\Temp\_uninst_41460089.bat
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-06-20 11:44
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\igfxdev.dll
.
Celkový čas: 2014-06-20 11:45:43
ComboFix-quarantined-files.txt 2014-06-20 09:45
.
Před spuštěním: Volných bajtů: 12 773 535 744
Po spuštění: Volných bajtů: 13 135 200 256
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0D2E1AE84A0D009295570F1E7981E562
413FC2A0C716421B3158746D63736515

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\system32\drivers\41460089.sys

Driver::
41460089

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Combofix objavil akýsi nový typ malaware a chcel ho poslať do akého si laboratória ale nedokázal naviazať spojenie zo serverom. A v zložke kde mal byť formulár žiaľ nič nebolo a i keby asi by som nevedel ako malaware odoslať.
ComboFix 14-06-19.01 - Tomas 20.06.2014 17:32:13.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.628 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Tomas\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
file zipped: c:\windows\system32\drivers\41460089.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\41460089.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_41460089
-------\Service_41460089
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-05-20 do 2014-06-20 )))))))))))))))))))))))))))))))
.
.
2014-06-17 20:51 . 2014-06-17 21:00 -------- d-----w- c:\program files\Kernel for Writer Evaluation ver
2014-06-17 16:45 . 2014-06-17 16:45 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-06-17 16:45 . 2014-05-12 05:26 53208 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-17 06:54 . 2014-06-17 17:37 -------- d-----w- c:\program files\Recuva
2014-06-06 14:17 . 2014-06-06 14:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2014-06-05 08:55 . 2014-06-05 08:55 -------- d-----w- c:\documents and settings\Tomas\Nová složka
2014-05-26 21:10 . 2014-05-26 21:10 -------- d-----w- c:\documents and settings\Tomas\Data aplikací\OpenOffice
2014-05-26 21:06 . 2014-05-26 21:06 -------- d-----w- c:\program files\OpenOffice 4
2014-05-25 14:40 . 2014-05-25 14:53 -------- d-----w- c:\program files\Tropico
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 14:29 . 2014-05-07 18:21 777488 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-15 14:29 . 2014-05-07 18:21 411680 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-05-15 14:29 . 2014-05-07 18:21 54832 ----a-w- c:\windows\system32\drivers\aswrdr.sys
2014-05-14 10:35 . 2014-01-12 16:53 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-14 10:35 . 2014-01-12 16:53 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-12 05:25 . 2014-01-10 09:31 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-07 18:21 . 2014-05-07 18:21 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400164167312
2014-05-07 18:21 . 2014-05-07 18:21 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2014-05-07 18:21 . 2014-05-07 18:21 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-05-07 18:21 . 2014-05-07 18:21 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-05-07 18:21 . 2014-05-07 18:21 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-05-07 18:21 . 2014-05-07 18:21 54832 ----a-w- c:\windows\system32\drivers\aswrdr.sys.1400164167312
2014-05-07 18:21 . 2014-05-07 18:21 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-05-07 18:21 . 2014-05-07 18:21 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-05-07 18:21 . 2014-05-07 18:21 43152 ----a-w- c:\windows\avastSS.scr
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-07 18:21 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-07 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2000-01-01 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2000-01-01 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2000-01-01 135680]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-06-06 3890208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk
backup=c:\windows\pss\Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk]
path=c:\documents and settings\Tomas\Nabídka Start\Programy\Po spuštění\Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk
backup=c:\windows\pss\Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-10-28 11:18 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
.
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [7.5.2014 20:21 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [7.5.2014 20:21 180632]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [7.5.2014 20:21 777488]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [7.5.2014 20:21 411680]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [7.5.2014 20:21 24184]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [7.5.2014 20:21 67824]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-06-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-12 10:35]
.
2014-06-20 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-07 18:21]
.
.
------- Doplňkový sken -------
.
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\cznc1nk8.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-06-20 17:42
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\adsldpc.dll
.
- - - - - - - > 'explorer.exe'(3452)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\agrsmsvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2014-06-20 17:44:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-06-20 15:44
ComboFix2.txt 2014-06-20 09:45
.
Před spuštěním: Volných bajtů: 13 151 674 368
Po spuštění: Volných bajtů: 13 096 316 928
.
- - End Of File - - AE233D93EA96E0C90E5CCF3DE6098F2C
413FC2A0C716421B3158746D63736515

CF s,azal to, co jsem mu přikázal. Měl poslat vzorek autorovi, ale spojení se nezdařilo, což se někdy stává. Fakt je, že rootkit byl smazán a PC by již měl být čistý. CF odinstalujte pomocí T-Cleaneru: http://vyosek.tym.cz/pro_usery/T-Cleaner.exe .

Prosím ešte niečo pre kontrolu súborv na usbčkách a potom sem nahrajem súbory .odt ktoré by som chcel zkontrolovať na prítomnosť vírov a vedeli by ste mi pomôcť zo zakódovanými súbormy.

Zkuste USBFix: http://forum.viry.cz/viewtopic.php?f=24&t=102308 .

############################## | UsbFix V 7.171 | [Research]

User: Tomas (Administrator) # TOMAS-E8CB3E5CF
Updated 18/05/2014 by El Desaparecido - SosVirus
Started at 18:48:16 | 20/06/2014

Website : http://www.en.usbfix.net/
Changelog : http://www.en.usbfix.net/changelog/
Support : http://en.kioskea.net/forum/viruses-security-7
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.en.usbfix.net/contact/

PC: Acer (Acadia )
CPU: Procesor Intel Pentium II
RAM -> [Total : 1014 Mo| Free : 373 Mo]
Bios: Acer
Boot: Normal boot

OS: Microsoft Windows XP Home Edition (5.1.2600 32-Bit) Service Pack 3
WB: Windows Internet Explorer : 8.0.6001.18702
WB: Mozilla Firefox : 30.0

SC: Security Center [Enabled]
WU: Windows Update [Enabled]

FW: Windows FireWall [Enabled]

C:\ (%SystemDrive%) -> Fixed drive # 29 Gb (12 Mb free - 42%) [] # NTFS
D:\ -> Fixed drive # 45 Gb (45 Mb free - 100%) [] # NTFS
E:\ -> CD-ROM
F:\ -> Removable drive # 15 Gb (2 Mb free - 13%) [KINGSTON] # FAT32

################## | Active Processes |

C:\WINDOWS\system32\smss.exe (ID: 492|ParentID: 4|SYSTEM)
C:\WINDOWS\system32\csrss.exe (ID: 688|ParentID: 492|SYSTEM)
C:\WINDOWS\system32\winlogon.exe (ID: 712|ParentID: 492|SYSTEM)
C:\WINDOWS\system32\services.exe (ID: 756|ParentID: 712|SYSTEM)
C:\WINDOWS\system32\lsass.exe (ID: 768|ParentID: 712|SYSTEM)
C:\WINDOWS\system32\svchost.exe (ID: 944|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\svchost.exe (ID: 1016|ParentID: 756|NETWORK SERVICE)
C:\WINDOWS\system32\svchost.exe (ID: 1112|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\svchost.exe (ID: 1196|ParentID: 756|NETWORK SERVICE)
C:\WINDOWS\system32\svchost.exe (ID: 1316|ParentID: 756|LOCAL SERVICE)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1416|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\spoolsv.exe (ID: 1700|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\svchost.exe (ID: 1072|ParentID: 756|LOCAL SERVICE)
C:\WINDOWS\system32\agrsmsvc.exe (ID: 1104|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\svchost.exe (ID: 1248|ParentID: 756|SYSTEM)
C:\WINDOWS\RTHDCPL.exe (ID: 2288|ParentID: 1696|Tomas)
C:\WINDOWS\system32\alg.exe (ID: 2368|ParentID: 756|LOCAL SERVICE)
C:\WINDOWS\system32\igfxtray.exe (ID: 2372|ParentID: 1696|Tomas)
C:\WINDOWS\system32\hkcmd.exe (ID: 2464|ParentID: 1696|Tomas)
C:\WINDOWS\system32\wscntfy.exe (ID: 2508|ParentID: 1112|Tomas)
C:\WINDOWS\system32\igfxpers.exe (ID: 2532|ParentID: 1696|Tomas)
C:\Program Files\AVAST Software\Avast\avastui.exe (ID: 2596|ParentID: 1696|Tomas)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 2696|ParentID: 2332|Tomas)
C:\WINDOWS\system32\igfxsrvc.exe (ID: 2728|ParentID: 944|Tomas)
C:\WINDOWS\system32\svchost.exe (ID: 3000|ParentID: 756|SYSTEM)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 3424|ParentID: 944|NETWORK SERVICE)
C:\WINDOWS\system32\wbem\unsecapp.exe (ID: 4072|ParentID: 944|Tomas)
C:\WINDOWS\explorer.exe (ID: 3452|ParentID: 712|Tomas)
C:\Program Files\Mozilla Firefox\firefox.exe (ID: 4328|ParentID: 3452|Tomas)
C:\UsbFix\UsbFix.exe (ID: 2704|ParentID: 1908|Tomas)

################## | Autorun |


################## | Regedit Run |

F2 - HKLM\..\Winlogon : [Shell] Explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\WINDOWS\system32\userinit.exe,
04 - HKLM\..\Run : [RTHDCPL] RTHDCPL.EXE
04 - HKLM\..\Run : [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
04 - HKLM\..\Run : [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\WINDOWS\system32\igfxpers.exe
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKU\S-1-5-18\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

################## | Generic Research |


################## | Registry |


################## | E.O.F | http://www.sosvirus.net/ | http://www.en.usbfix.net/ |

V těch souborech asi máte chybně nastavenu znakovou sadu. S tímhle asi virus nemá nic společného.

Dá sa to nejako opraviť?

Nemám nainstalován OpenOffice (soubory *.odt mu patří), ale někde by tam měla být možnost přenastavení znakové sady. Přesně vás nenavedu.

Počítač stále v určitých chvíľach prestáva reagovať a mrzne,súbory znova začnú reagovať až po tom čo vypínanie počítača ukončí vynútené akýsi "DE Server". Čo to je a nieje to vír prečo to podríva chod systému?

Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-06-22 21:55:07
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 16 GB (54%) free of 30 GB
Total RAM: 1014 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:55:10, on 22.6.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Tomas\Plocha\RSIT.exe
C:\WINDOWS\system32\control.exe
C:\Program Files\trend micro\Tomas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 4106 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\avast! Emergency Update.job - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\cznc1nk8.default

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 13.0.0.214 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-05-07 436600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-05-10 16342528]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-07 102400]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2000-01-01 134656]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2000-01-01 166912]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2000-01-01 135680]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-06-06 3890208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2011-10-28 49208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.4.lnk]
C:\PROGRA~1\OPENOF~1.4\program\QUICKS~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk]
C:\WINDOWS\system32\RunDll32.exe [2008-04-14 33280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomas^Nabídka Start^Programy^Po spuštění^Sledovat výstrahy inkoustu - HP Deskjet 3520 series.lnk]
C:\WINDOWS\system32\RunDll32.exe [2008-04-14 33280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2000-01-01 205824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe"="C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP (HP Deskjet 1050 J410 series)"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP (HP Deskjet 3520 series)"
"C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe"="C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:Síťový komunikační program HP (HP Deskjet 3520 series)"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Disabled:Total Commander 32 bit international version, file manager replacement for Windows"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-06-20 20:49:42 ----SHD---- C:\RECYCLER
2014-06-20 19:00:07 ----A---- C:\UsbFix [Scan 4] TOMAS-E8CB3E5CF.txt
2014-06-20 18:54:53 ----A---- C:\UsbFix [Scan 3] TOMAS-E8CB3E5CF.txt
2014-06-20 18:47:25 ----D---- C:\UsbFix
2014-06-20 11:34:20 ----A---- C:\Boot.bak
2014-06-20 11:34:15 ----RASHD---- C:\cmdcons
2014-06-20 11:30:50 ----A---- C:\WINDOWS\NIRCMD.exe
2014-06-20 11:30:38 ----D---- C:\Qoobox
2014-06-18 12:22:46 ----D---- C:\Program Files\Mozilla Firefox
2014-06-17 22:51:06 ----D---- C:\Program Files\Kernel for Writer Evaluation ver
2014-06-17 18:45:40 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-06-17 18:45:40 ----A---- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2014-06-17 08:54:33 ----D---- C:\Program Files\Recuva
2014-06-06 16:17:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\InstallMate
2014-06-05 10:45:39 ----A---- C:\WINDOWS\wcx_ftp.ini
2014-06-05 10:40:39 ----A---- C:\WINDOWS\WINCMD.INI
2014-05-26 23:10:04 ----D---- C:\Documents and Settings\Tomas\Data aplikací\OpenOffice
2014-05-26 23:06:13 ----D---- C:\Program Files\OpenOffice 4
2014-05-26 22:58:15 ----D---- C:\Config.Msi
2014-05-25 16:40:55 ----D---- C:\Program Files\Tropico

======List of files/folders modified in the last 1 month======

2014-06-22 21:55:10 ----D---- C:\Program Files\trend micro
2014-06-22 21:55:03 ----D---- C:\WINDOWS\Prefetch
2014-06-22 21:52:00 ----D---- C:\WINDOWS\Temp
2014-06-22 21:50:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-06-22 21:50:13 ----D---- C:\WINDOWS\system32\Restore
2014-06-20 18:23:04 ----D---- C:\WINDOWS
2014-06-20 17:45:10 ----D---- C:\WINDOWS\system32\drivers
2014-06-20 17:42:04 ----A---- C:\WINDOWS\system.ini
2014-06-20 17:41:54 ----D---- C:\WINDOWS\system32\drivers\etc
2014-06-20 17:40:25 ----D---- C:\WINDOWS\system32\config
2014-06-20 17:37:30 ----D---- C:\WINDOWS\system32
2014-06-20 17:37:30 ----D---- C:\WINDOWS\AppPatch
2014-06-20 17:37:26 ----D---- C:\Program Files\Common Files
2014-06-20 17:31:06 ----D---- C:\WINDOWS\system32\CatRoot2
2014-06-20 11:34:20 ----RASH---- C:\boot.ini
2014-06-19 19:38:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-06-18 16:32:57 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-06-18 12:45:13 ----RD---- C:\Program Files
2014-06-17 18:45:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2014-06-13 11:14:22 ----D---- C:\Program Files\Battle for Wesnoth 1.10.7
2014-06-06 20:06:29 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2014-05-27 18:43:01 ----D---- C:\Documents and Settings\Tomas\Data aplikací\Notepad++
2014-05-26 23:08:28 ----SHD---- C:\WINDOWS\Installer
2014-05-26 23:07:57 ----D---- C:\WINDOWS\assembly
2014-05-26 23:06:34 ----RSD---- C:\WINDOWS\Fonts
2014-05-26 23:05:41 ----D---- C:\WINDOWS\WinSxS
2014-05-26 23:03:43 ----D---- C:\WINDOWS\Minidump
2014-05-26 22:54:17 ----D---- C:\Documents and Settings\Tomas\Data aplikací\OpenOffice.org2
2014-05-25 16:51:06 ----SD---- C:\Documents and Settings\Tomas\Data aplikací\Microsoft
2014-05-25 16:51:06 ----D---- C:\Documents and Settings\Tomas\Data aplikací\Adobe
2014-05-25 16:40:54 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2014-05-07 49944]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2014-05-07 180632]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2014-05-15 54832]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2014-05-15 777488]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2014-05-15 411680]
R1 aswTdi;aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [2014-05-07 57672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2014-05-07 24184]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2014-05-07 67824]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2000-01-01 1202560]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-06-06 161792]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2000-01-01 1730272]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-05-10 4419584]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-09-07 215904]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2009-03-17 58208]
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-07-26 547904]
S3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2011-05-24 1979328]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2000-01-01 13312]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-05-07 50344]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14 257712]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-18 119408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-07-20 754856]

-----------------EOF-----------------

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Liongard
->Temporary Internet Files folder emptied: 33170 bytes

User: Liongard.TOMAS-E8CB3E5CF
->Temp folder emptied: 1058540 bytes
->Temporary Internet Files folder emptied: 49286 bytes
->FireFox cache emptied: 373655508 bytes
->Flash cache emptied: 2767 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Mama
->Temp folder emptied: 587930 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 365943178 bytes
->Flash cache emptied: 4742 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Tomas
->Temp folder emptied: 630190 bytes
->Temporary Internet Files folder emptied: 524422 bytes
->FireFox cache emptied: 300740897 bytes
->Flash cache emptied: 1089 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 43432 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 995,00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: Liongard

User: Liongard.TOMAS-E8CB3E5CF
->Flash cache emptied: 0 bytes

User: LocalService

User: Mama
->Flash cache emptied: 0 bytes

User: NetworkService

User: Tomas
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.21.0 log created on 06232014_095512

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\AvastLock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...