zmiznuté programy

[Ivanka19]

Logfile of random's system information tool 1.10 (written by random/random)
Run by Ivanka at 2014-09-28 15:11:44
Microsoft Windows 7 Home Premium
System drive C: has 136 GB (89%) free of 153 GB
Total RAM: 2558 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:11:54, on 28. 9. 2014
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Ivanka\Downloads\RSIT.exe
C:\Program Files\trend micro\Ivanka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

--
End of file - 3079 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-09-14 457712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2007-04-16 577536]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-09-14 4085896]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-02-10 61440]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-09-28 15:11:44 ----D---- C:\rsit
2014-09-28 15:11:44 ----D---- C:\Program Files\trend micro
2014-09-14 15:59:34 ----D---- C:\Windows\Panther
2014-09-14 15:58:34 ----D---- C:\Program Files\Winamp
2014-09-14 15:58:28 ----D---- C:\Windows\PCHEALTH
2014-09-14 15:57:43 ----D---- C:\Users\Ivanka\AppData\Roaming\vlc
2014-09-14 15:57:40 ----D---- C:\ProgramData\Canneverbe Limited
2014-09-14 15:57:39 ----D---- C:\Users\Ivanka\AppData\Roaming\Canneverbe Limited
2014-09-14 15:57:30 ----D---- C:\Program Files\CDBurnerXP
2014-09-14 15:57:09 ----D---- C:\Program Files\VideoLAN
2014-09-14 15:56:34 ----D---- C:\Program Files\Foxit Software
2014-09-14 15:55:33 ----D---- C:\Program Files\Microsoft Office
2014-09-14 15:55:32 ----D---- C:\ProgramData\Microsoft Help
2014-09-14 15:55:07 ----D---- C:\totalcmd
2014-09-14 15:54:41 ----RHD---- C:\MSOCache
2014-09-14 15:53:44 ----A---- C:\Windows\system32\XAudio2_7.dll
2014-09-14 15:53:44 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2014-09-14 15:53:44 ----A---- C:\Windows\system32\xactengine3_7.dll
2014-09-14 15:53:44 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2014-09-14 15:53:43 ----A---- C:\Windows\system32\D3DX9_43.dll
2014-09-14 15:53:43 ----A---- C:\Windows\system32\d3dx11_43.dll
2014-09-14 15:53:43 ----A---- C:\Windows\system32\d3dx10_43.dll
2014-09-14 15:53:43 ----A---- C:\Windows\system32\d3dcsx_43.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\XAudio2_6.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\XAudio2_5.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\xactengine3_6.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\xactengine3_5.dll
2014-09-14 15:53:42 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2014-09-14 15:53:41 ----A---- C:\Windows\system32\d3dx11_42.dll
2014-09-14 15:53:41 ----A---- C:\Windows\system32\d3dx10_42.dll
2014-09-14 15:53:41 ----A---- C:\Windows\system32\d3dcsx_42.dll
2014-09-14 15:53:41 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2014-09-14 15:53:40 ----A---- C:\Windows\system32\D3DX9_42.dll
2014-09-14 15:53:40 ----A---- C:\Windows\system32\D3DX9_41.dll
2014-09-14 15:53:40 ----A---- C:\Windows\system32\d3dx10_41.dll
2014-09-14 15:53:40 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2014-09-14 15:53:39 ----A---- C:\Windows\system32\XAudio2_4.dll
2014-09-14 15:53:39 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2014-09-14 15:53:39 ----A---- C:\Windows\system32\xactengine3_4.dll
2014-09-14 15:53:39 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\XAudio2_3.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\xactengine3_3.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\D3DX9_40.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\d3dx10_40.dll
2014-09-14 15:53:38 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\XAudio2_2.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\xactengine3_2.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\d3dx10_39.dll
2014-09-14 15:53:37 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2014-09-14 15:53:36 ----A---- C:\Windows\system32\XAudio2_1.dll
2014-09-14 15:53:36 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2014-09-14 15:53:36 ----A---- C:\Windows\system32\xactengine3_1.dll
2014-09-14 15:53:36 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2014-09-14 15:53:36 ----A---- C:\Windows\system32\D3DX9_39.dll
2014-09-14 15:53:35 ----A---- C:\Windows\system32\XAudio2_0.dll
2014-09-14 15:53:35 ----A---- C:\Windows\system32\D3DX9_38.dll
2014-09-14 15:53:35 ----A---- C:\Windows\system32\d3dx10_38.dll
2014-09-14 15:53:35 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2014-09-14 15:53:34 ----A---- C:\Windows\system32\xactengine3_0.dll
2014-09-14 15:53:34 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2014-09-14 15:53:34 ----A---- C:\Windows\system32\d3dx10_37.dll
2014-09-14 15:53:34 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2014-09-14 15:53:33 ----A---- C:\Windows\system32\xactengine2_10.dll
2014-09-14 15:53:33 ----A---- C:\Windows\system32\D3DX9_37.dll
2014-09-14 15:53:32 ----A---- C:\Windows\system32\d3dx9_36.dll

[Rudy]

Zdravím!
Log není kompletní. Programy opravdu zmizely, nebo zmizely pouze zástupci z plochy?