VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Win 32:trojan-gen

https://forum.viry.cz:443/viewtopic.php?t=97016

Stránka 1 z 2

Win 32:trojan-gen

Napsal: 30 led 2010 21:46
od petrslama
dobrý den, potřeboval bych poradit, jak se zbavit viru trojan-gen. Před dvěma dny jsem nainstaloval do PC nero 9 trial. Bylo to stažený z netu a asi tam byl problém. Teď mi to nejde z PC odinstalovat (odstranit SW v ovládacích panelech). Píše to, že to odinstalovalo SW, ale ve skutečnosti tam stále je. Už jsem i vypnul obnovu systému, ale nepomohlo to.
Kromě toho mi Avast stále hlásí Trojan-gen v souborech, které jsem již smazal. Jakmile pustím PC opět tam jsou ty samé soubory s virem. Můžete mi prosím pomoct? Děkuji a posílám log z RIST.

Petr

Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2010-01-30 21:36:03
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 78 GB (60%) free of 131 GB
Total RAM: 2047 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36:11, on 30.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Media Key\MagicKey.exe
C:\Microsoft Office 7\Office12\ONENOTEM.EXE
C:\PROGRA~1\MI43DA~1\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Media Key\OSD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Petr.PETRDOMA\Dokumenty\Stažené soubory\RSIT.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\trend micro\Petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=14597&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [CleanSetup] cmd /C rmdir /S /Q "C:\Documents and Settings\Petr.PETRDOMA\Local Settings\Temp\nro.tmp\"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Microsoft Office 7\Office12\ONENOTEM.EXE
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Cordless DUALphone Startup.lnk = C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Media Key.lnk = C:\Program Files\Media Key\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2417419734
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A719FE98-4086-4666-BC1C-CCA970CF987E}: NameServer = 10.36.0.3,10.36.0.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 9172 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask.com Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-04-02 809864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask.com Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-04-02 809864]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe [2004-02-22 32881]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-09-30 4603904]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-09-30 86016]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [2005-12-13 217088]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]
"NVCLOCK"=rundll32 nvclock.dll,fnNvclock []
"PAC207_Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-06-12 151552]
"CloneCDTray"=C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2006-09-28 57344]
"CloneDVDElbyDelay"=C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe [2002-11-02 45056]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"CleanSetup"=cmd /C rmdir /S /Q C:\Documents and Settings\Petr.PETRDOMA\Local Settings\Temp\nro.tmp\ []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2006-02-22 1302528]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
BTTray.lnk - C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
Cordless DUALphone Startup.lnk - C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Media Key.lnk - C:\Program Files\Media Key\MagicKey.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\Petr.PETRDOMA\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Microsoft Office 7\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\setup\HPZNET01.EXE"="E:\setup\HPZNET01.EXE:*:Enabled:hpznet01.exe"
"E:\setup\HPONICIFS01.EXE"="E:\setup\HPONICIFS01.EXE:*:Enabled:hponicifs01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"D:\TrackMania Sunrise\TM Sunrise\TmSunrise.exe"="D:\TrackMania Sunrise\TM Sunrise\TmSunrise.exe:*:Enabled:TmSunrise"
"D:\uTorrent\Torrent\utorrent.exe"="D:\uTorrent\Torrent\utorrent.exe:*:Enabled:µTorrent"
"D:\Icq\ICQ6.5\ICQ.exe"="D:\Icq\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Microsoft Office 7\Office12\ONENOTE.EXE"="C:\Microsoft Office 7\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{985930e6-d740-11dd-aee8-0013d4535a96}]
shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce2b1c03-613e-11dd-ac78-806d6172696f}]
shell\AutoRun\command - E:\ASUSACPI.exe


======List of files/folders created in the last 1 months======

2010-01-30 21:36:03 ----D---- C:\rsit
2010-01-30 21:36:03 ----D---- C:\Program Files\trend micro
2010-01-29 18:53:04 ----D---- C:\Program Files\Windows Sidebar
2010-01-29 18:52:42 ----A---- C:\WINDOWS\Irremote.ini
2010-01-29 18:43:43 ----D---- C:\Program Files\Nero
2010-01-29 18:43:14 ----D---- C:\WINDOWS\SxsCaPendDel
2010-01-29 18:16:50 ----D---- C:\Nero-9[1].4.13.2b+crack
2010-01-29 15:30:05 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-01-28 18:14:11 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Alwil Software
2010-01-28 18:07:44 ----D---- C:\Program Files\DVD Shrink
2010-01-28 17:30:21 ----SH---- C:\WINDOWS\S2AD19FE5.tmp
2010-01-28 17:25:51 ----D---- C:\Clone DVD + AnyDVD + Crack & Serial
2010-01-28 17:25:25 ----D---- C:\Clone CD v5[1].3.1.0 + Crack!
2010-01-27 17:41:40 ----D---- C:\Program Files\SlySoft
2010-01-27 16:24:44 ----D---- C:\temp_dvd
2010-01-24 18:55:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-01-24 18:52:21 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\NOS
2010-01-23 16:38:34 ----D---- C:\Program Files\Haali
2010-01-23 16:36:50 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\VideoConverter
2010-01-13 17:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 17:22:35 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-01-30 21:36:05 ----D---- C:\WINDOWS\Prefetch
2010-01-30 21:36:03 ----RD---- C:\Program Files
2010-01-30 21:34:32 ----D---- C:\Program Files\Mozilla Firefox
2010-01-30 21:33:39 ----SD---- C:\WINDOWS\Tasks
2010-01-30 21:32:20 ----SHD---- C:\System Volume Information
2010-01-30 21:32:20 ----D---- C:\WINDOWS\system32\Restore
2010-01-30 21:29:48 ----D---- C:\WINDOWS\Temp
2010-01-30 21:27:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-30 20:59:29 ----AD---- C:\WINDOWS
2010-01-30 20:58:36 ----D---- C:\WINDOWS\system32
2010-01-30 19:12:40 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Skype
2010-01-30 19:09:13 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-29 19:14:44 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Nero
2010-01-29 19:08:43 ----HD---- C:\Config.Msi
2010-01-29 18:53:42 ----SHD---- C:\WINDOWS\Installer
2010-01-29 18:53:24 ----D---- C:\Program Files\Common Files\Nero
2010-01-29 18:45:39 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Nero
2010-01-29 18:43:20 ----D---- C:\WINDOWS\WinSxS
2010-01-29 17:20:53 ----A---- C:\WINDOWS\win.ini
2010-01-29 15:30:18 ----D---- C:\WINDOWS\system32\drivers
2010-01-29 09:20:09 ----D---- C:\Program Files\FMS
2010-01-28 18:14:11 ----D---- C:\Program Files\Alwil Software
2010-01-28 17:31:52 ----D---- C:\Program Files\Elaborate Bytes
2010-01-28 17:24:06 ----D---- C:\Program Files\Ahead
2010-01-27 20:50:25 ----A---- C:\WINDOWS\WDICT32.INI
2010-01-27 20:24:52 ----A---- C:\WINDOWS\KBDSC32.INI
2010-01-27 17:31:31 ----D---- C:\Program Files\CDex
2010-01-27 17:23:30 ----HD---- C:\WINDOWS\inf
2010-01-27 17:20:42 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-26 15:48:01 ----D---- C:\Pracovní
2010-01-25 14:13:58 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2010-01-24 18:57:04 ----D---- C:\Program Files\Adobe
2010-01-24 18:56:53 ----D---- C:\Program Files\Common Files\Adobe
2010-01-24 18:55:00 ----D---- C:\Program Files\Common Files
2010-01-23 16:12:09 ----D---- C:\Program Files\Avidemux 2.5
2010-01-22 19:35:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-22 19:35:16 ----D---- C:\Program Files\Internet Explorer
2010-01-22 19:35:05 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-19 19:24:02 ----D---- C:\Documents and Settings
2010-01-13 19:46:42 ----D---- C:\WINDOWS\AppPatch
2010-01-13 17:23:03 ----A---- C:\WINDOWS\imsins.BAK
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-04 19:43:17 ----D---- C:\Fotky

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdK8;Ovladač procesoru AMD Athlon64; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-05-08 38400]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbfilter;Keyboard Filter Driver; C:\WINDOWS\system32\drivers\kbfilter.sys [2002-07-11 12856]
R1 UsbFltr;WayTechUSBFilterDriver; C:\WINDOWS\system32\drivers\UsbFltr.sys [2003-12-29 8576]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 BtAudio;Bluetooth Audio; C:\WINDOWS\system32\DRIVERS\btaudio.sys [2003-01-16 21701]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2003-01-16 30043]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2003-01-16 144608]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2003-01-16 65076]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2003-03-28 3840]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-09-30 2743840]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2004-11-11 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2004-11-11 12928]
R3 PAC207;Trust 100K Series Webcam; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2008-02-13 618112]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-24 6784]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VGAUTI;VGAUTI; \??\C:\WINDOWS\system32\DRIVERS\VGAUTI.sys []
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
R4 sr;Ovladač filtru Obnovy systému; C:\WINDOWS\System32\DRIVERS\sr.sys [2008-04-14 73344]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2008-06-05 8320]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-12-22 25280]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 21248]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SQTECH905C;DualCamera; C:\WINDOWS\System32\Drivers\Capt905c.sys [2005-04-25 33538]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2004-09-30 127043]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: Win 32:trojan-gen

Napsal: 30 led 2010 22:10
od petrslama
můžete mi někdo prosím poradit ??? pls.

Re: Win 32:trojan-gen

Napsal: 30 led 2010 22:27
od petrslama
podíváte se mi prosím někdo na můj log, pls ??? Moc díky P.

Re: Win 32:trojan-gen

Napsal: 30 led 2010 22:37
od petrslama
co znamená ta černá tečka u dotazu? Můj problém nemá řešení?

Re: Win 32:trojan-gen

Napsal: 31 led 2010 01:57
od Unlimited_Killer
Nesmíte si odpovídat - luštitelé logů myslí, že už už se Vás někdo ujal - máte u tématu příspěvky.

~~~

Vložte sem log z ComboFix.

Stáhněte a uložte na Plochu ComboFix, poté ho spusťte s administrátorským oprávněním.
Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'. Budete také dotázán na instalaci konzole pro zotavení, klikněte na 'Ano'.
Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat. Váš PC bude pravděpodobně restartován, tak se toho neděste. Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
Po skončení skenu na Vás vypadne log, který vkopírujete sem.

Re: Win 32:trojan-gen

Napsal: 31 led 2010 08:49
od petrslama
díky za odpověď. Posílám log z Combofixu. Nemohl nalázt 1 systémový soubor, který jsem asi odstranil Avastem. Nero jsem už smazal ručně.
Co dál? Díky P.

Re: Win 32:trojan-gen

Napsal: 31 led 2010 08:53
od petrslama
tady je ten log z Combofixu

ComboFix 10-01-30.04 - Petr 31.01.2010 8:25.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1448 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr.PETRDOMA\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100130-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 72 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\recycler\S-1-5-21-854245398-838170752-839522115-1003
c:\recycler\S-1-5-21-854245398-838170752-839522115-1006
c:\recycler\S-1-5-21-854245398-838170752-839522115-1007

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-31 )))))))))))))))))))))))))))))))
.

2010-01-30 20:36 . 2010-01-30 20:36 -------- d-----w- C:\rsit
2010-01-30 20:36 . 2010-01-30 20:36 -------- d-----w- c:\program files\trend micro
2010-01-29 17:53 . 2010-01-29 17:53 -------- d-----w- c:\program files\Windows Sidebar
2010-01-29 17:43 . 2010-01-29 18:08 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-29 14:30 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-29 14:30 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-29 14:30 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-29 14:30 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-01-29 14:30 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-29 14:30 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-29 14:30 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-29 14:30 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-29 14:30 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-28 17:07 . 2010-01-28 17:07 -------- d-----w- c:\program files\DVD Shrink
2010-01-27 16:41 . 2010-01-30 21:19 -------- d-----w- c:\program files\SlySoft
2010-01-27 15:24 . 2010-01-27 15:27 -------- d-----w- C:\temp_dvd
2010-01-24 17:55 . 2010-01-24 17:55 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-23 15:38 . 2010-01-23 15:38 -------- d-----w- c:\program files\Haali
2010-01-13 13:26 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 21:19 . 2008-12-12 17:28 -------- d-----w- c:\program files\Elaborate Bytes
2010-01-29 17:53 . 2009-12-16 10:25 -------- d-----w- c:\program files\Common Files\Nero
2010-01-29 08:20 . 2007-04-01 19:41 -------- d-----w- c:\program files\FMS
2010-01-28 17:14 . 2007-04-01 11:42 -------- d-----w- c:\program files\Alwil Software
2010-01-28 16:31 . 2010-01-28 16:30 24 --sh--w- c:\windows\S2AD19FE5.tmp
2010-01-28 16:24 . 2007-04-01 09:42 -------- d-----w- c:\program files\Ahead
2010-01-27 16:31 . 2009-12-25 11:08 -------- d-----w- c:\program files\CDex
2010-01-24 17:56 . 2007-04-01 09:49 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-23 15:12 . 2009-12-18 13:55 -------- d-----w- c:\program files\Avidemux 2.5
2009-12-28 16:21 . 2009-12-28 16:21 -------- d-----w- c:\program files\Common Files\PAC207
2009-12-28 16:21 . 2009-12-28 16:21 -------- d-----w- c:\program files\Trust
2009-12-28 16:21 . 2007-04-01 09:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-23 17:26 . 2007-04-01 10:16 -------- d-----r- c:\program files\Skype
2009-12-22 12:13 . 2009-12-22 12:13 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-12-21 19:08 . 2008-08-03 08:14 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 09:17 . 2001-10-25 12:00 83742 ----a-w- c:\windows\system32\perfc005.dat
2009-12-20 09:17 . 2001-10-25 12:00 441086 ----a-w- c:\windows\system32\perfh005.dat
2009-12-20 09:08 . 2008-08-03 07:50 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-12-20 09:08 . 2008-08-03 07:50 3038 ----a-w- c:\windows\PCHEALTH\HELPCTR\PackageStore\SkuStore.bin
2009-12-19 16:02 . 2009-03-27 13:21 230432 ----a-w- C:\StiImg.dat
2009-12-18 14:17 . 2009-12-18 14:17 -------- d-----w- c:\program files\Ask.com
2009-12-18 14:16 . 2009-12-18 14:16 -------- d-----w- c:\program files\FreeTime
2009-12-16 10:53 . 2009-12-16 10:53 -------- d-----w- c:\program files\MSBuild
2009-12-16 10:53 . 2009-12-16 10:53 -------- d-----w- c:\program files\Reference Assemblies
2009-12-16 10:51 . 2009-12-16 10:51 -------- d-----w- c:\program files\MSXML 6.0
2009-12-10 16:41 . 2009-12-10 16:40 -------- d-----w- c:\program files\DivX
2009-12-10 16:41 . 2009-12-10 16:40 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-06 21:22 . 2007-04-01 10:03 -------- d-----w- c:\program files\Microsoft Works
2009-12-04 15:05 . 2009-12-04 15:05 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-11-27 18:41 . 2009-11-27 18:33 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-21 16:03 . 2008-08-03 08:15 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 21:31 . 2009-11-14 21:31 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 21:31 . 2009-11-14 21:31 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 21:31 . 2009-11-14 21:31 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 21:31 . 2009-11-14 21:31 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 21:31 . 2009-11-14 21:31 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 21:31 . 2009-11-14 21:31 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 21:31 . 2009-11-14 21:31 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-12 20:17 . 2009-10-27 14:10 63 ----a-w- c:\documents and settings\Petr.PETRDOMA\jagex_runescape_preferences2.dat
2009-11-12 20:14 . 2009-01-10 17:19 38 ----a-w- c:\documents and settings\Petr.PETRDOMA\jagex_runescape_preferences.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-04-02 18:50 809864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-04-02 809864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-04-02 809864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-02-22 1302528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 32881]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-09-30 4603904]
"nwiz"="nwiz.exe" [2004-09-30 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-09-30 86016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"NVCLOCK"="nvclock.dll" [2003-04-14 81920]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-06-12 151552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr.PETRDOMA\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\microsoft office 7\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
BTTray.lnk - c:\program files\MICROSTAR\Bluetooth Software\BTTray.exe [2003-1-16 360509]
Cordless DUALphone Startup.lnk - c:\program files\Cordless USB Phone\Cordless DUALphone Suite.exe [2007-4-1 572416]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Media Key.lnk - c:\program files\Media Key\MagicKey.exe [2007-4-1 159744]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"d:\\Icq\\ICQ6.5\\ICQ.exe"=
"c:\\Microsoft Office 7\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 13:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [29.1.2010 15:30 114768]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [3.8.2008 10:17 12856]
R1 UsbFltr;WayTechUSBFilterDriver;c:\windows\system32\drivers\UsbFltr.sys [3.8.2008 10:17 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29.1.2010 15:30 20560]
R3 PAC207;Trust 100K Series Webcam;c:\windows\system32\drivers\PFC027.SYS [28.12.2009 17:21 618112]
R3 VGAUTI;VGAUTI;c:\windows\system32\drivers\vgauti.sys [3.8.2008 13:10 39372]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-01-30 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-04-02 18:50]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.ask.com/?o=14597&l=dis
IE: E&xportovat do aplikace Microsoft Excel - c:\micros~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A719FE98-4086-4666-BC1C-CCA970CF987E} = 10.36.0.3,10.36.0.1
FF - ProfilePath - c:\documents and settings\Petr.PETRDOMA\Data aplikací\Mozilla\Firefox\Profiles\gu7yuyus.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=en_US&q=
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJPI142_04.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPOJI610.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-FMS - c:\program files\FMS\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 08:34
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NVCLOCK = rundll32 nvclock.dll,fnNvclock??????????????????????????????V?>w?????&??? ??????d??????????????????w

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2864)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\windows\system32\BTNCopy.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
c:\windows\SOUNDMAN.EXE
c:\windows\system32\rundll32.exe
c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
c:\progra~1\MI43DA~1\BLUETO~1\BTSTAC~1.EXE
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\Media Key\OSD.EXE
c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\HPZinw12.exe
.
**************************************************************************
.
Celkový čas: 2010-01-31 08:42:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-31 07:42

Před spuštěním: Volných bajtů: 83 801 448 448
Po spuštění: Volných bajtů: 95 588 855 808

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - D92CA64A0FB16FF0059A413927C9041C

Re: Win 32:trojan-gen

Napsal: 31 led 2010 14:00
od Unlimited_Killer
Jdeme dál.

~~~

Otevřete si Poznámkový blok a vkopírujte do něj

Kód: Vybrat vše

KillAll::

File::
c:\windows\S2AD19FE5.tmp
c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"HP Software Update"=-
"QuickTime Task"=-
"Adobe Reader Speed Launcher"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"CleanSetup"=-

Extra::

DDS::
uStart Page = hxxp://www.ask.com/?o=14597&l=dis

FireFox::
FF - ProfilePath - c:\documents and settings\Petr.PETRDOMA\Data aplikací\Mozilla\Firefox\Profiles\gu7yuyus.default\
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?cl ... e=en_US&q=

Reboot::
uložte to na Plochu jako CFScript.txt Pak jej myší přetáhněte nad ComboFix (musí být na Ploše) a pusťte (vizte obrázek).

Obrázek

ComboFix vykoná příkazy ze skriptu, PC může být opět restartován.
Po skončení mi sem vložte log, který na Vás po dočistění vybafne.

Re: Win 32:trojan-gen

Napsal: 31 led 2010 14:44
od petrslama
hotovo. Tady je log:

ComboFix 10-01-30.04 - Petr 31.01.2010 14:26:55.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1458 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr.PETRDOMA\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Petr.PETRDOMA\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100130-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk"
"c:\windows\S2AD19FE5.tmp"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
c:\program files\Ask.com
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\UpdateTask.exe
c:\windows\S2AD19FE5.tmp
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-31 )))))))))))))))))))))))))))))))
.

2010-01-31 11:57 . 2010-01-31 11:57 -------- d-----w- c:\program files\Nokia1
2010-01-31 11:51 . 2010-01-31 11:51 -------- d-----w- c:\windows\system32\wbem\Repository
2010-01-31 10:46 . 2003-01-16 06:12 65076 ----a-r- c:\windows\system32\drivers\btwusb.sys
2010-01-31 10:46 . 2003-01-16 06:12 17388 ----a-r- c:\windows\system32\drivers\frmupgr.sys
2010-01-31 09:47 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-01-31 09:47 . 2010-01-31 09:47 -------- d-----w- c:\program files\PC Connectivity Solution
2010-01-31 08:42 . 2010-01-31 08:42 -------- d-----w- c:\program files\CCleaner
2010-01-30 20:36 . 2010-01-30 20:36 -------- d-----w- C:\rsit
2010-01-30 20:36 . 2010-01-30 20:36 -------- d-----w- c:\program files\trend micro
2010-01-29 17:53 . 2010-01-29 17:53 -------- d-----w- c:\program files\Windows Sidebar
2010-01-29 17:43 . 2010-01-29 18:08 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-29 14:30 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-29 14:30 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-29 14:30 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-29 14:30 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-01-29 14:30 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-29 14:30 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-29 14:30 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-29 14:30 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-29 14:30 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-28 17:07 . 2010-01-28 17:07 -------- d-----w- c:\program files\DVD Shrink
2010-01-27 16:41 . 2010-01-30 21:19 -------- d-----w- c:\program files\SlySoft
2010-01-27 15:24 . 2010-01-27 15:27 -------- d-----w- C:\temp_dvd
2010-01-24 17:55 . 2010-01-24 17:55 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-23 15:38 . 2010-01-23 15:38 -------- d-----w- c:\program files\Haali
2010-01-13 13:26 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 11:57 . 2007-09-09 07:26 -------- d-----w- c:\program files\Common Files\Nokia
2010-01-31 09:47 . 2009-04-15 16:42 -------- d-----w- c:\program files\DIFX
2010-01-30 21:19 . 2008-12-12 17:28 -------- d-----w- c:\program files\Elaborate Bytes
2010-01-29 17:53 . 2009-12-16 10:25 -------- d-----w- c:\program files\Common Files\Nero
2010-01-29 08:20 . 2007-04-01 19:41 -------- d-----w- c:\program files\FMS
2010-01-28 17:14 . 2007-04-01 11:42 -------- d-----w- c:\program files\Alwil Software
2010-01-28 16:24 . 2007-04-01 09:42 -------- d-----w- c:\program files\Ahead
2010-01-27 16:31 . 2009-12-25 11:08 -------- d-----w- c:\program files\CDex
2010-01-24 17:56 . 2007-04-01 09:49 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-23 15:12 . 2009-12-18 13:55 -------- d-----w- c:\program files\Avidemux 2.5
2009-12-28 16:21 . 2009-12-28 16:21 -------- d-----w- c:\program files\Common Files\PAC207
2009-12-28 16:21 . 2009-12-28 16:21 -------- d-----w- c:\program files\Trust
2009-12-28 16:21 . 2007-04-01 09:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-23 17:26 . 2007-04-01 10:16 -------- d-----r- c:\program files\Skype
2009-12-22 12:13 . 2009-12-22 12:13 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-12-21 19:08 . 2008-08-03 08:14 916480 ------w- c:\windows\system32\wininet.dll
2009-12-20 09:17 . 2001-10-25 12:00 83742 ----a-w- c:\windows\system32\perfc005.dat
2009-12-20 09:17 . 2001-10-25 12:00 441086 ----a-w- c:\windows\system32\perfh005.dat
2009-12-20 09:08 . 2008-08-03 07:50 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-12-20 09:08 . 2008-08-03 07:50 3038 ----a-w- c:\windows\PCHEALTH\HELPCTR\PackageStore\SkuStore.bin
2009-12-19 16:02 . 2009-03-27 13:21 230432 ----a-w- C:\StiImg.dat
2009-12-18 14:16 . 2009-12-18 14:16 -------- d-----w- c:\program files\FreeTime
2009-12-16 10:53 . 2009-12-16 10:53 -------- d-----w- c:\program files\MSBuild
2009-12-16 10:53 . 2009-12-16 10:53 -------- d-----w- c:\program files\Reference Assemblies
2009-12-16 10:51 . 2009-12-16 10:51 -------- d-----w- c:\program files\MSXML 6.0
2009-12-10 16:41 . 2009-12-10 16:40 -------- d-----w- c:\program files\DivX
2009-12-10 16:41 . 2009-12-10 16:40 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-06 21:22 . 2007-04-01 10:03 -------- d-----w- c:\program files\Microsoft Works
2009-12-04 15:05 . 2009-12-04 15:05 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-11-27 18:41 . 2009-11-27 18:33 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-21 16:03 . 2008-08-03 08:15 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 21:31 . 2009-11-14 21:31 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 21:31 . 2009-11-14 21:31 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 21:31 . 2009-11-14 21:31 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 21:31 . 2009-11-14 21:31 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 21:31 . 2009-11-14 21:31 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 21:31 . 2009-11-14 21:31 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 21:31 . 2009-11-14 21:31 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-12 20:17 . 2009-10-27 14:10 63 ----a-w- c:\documents and settings\Petr.PETRDOMA\jagex_runescape_preferences2.dat
2009-11-12 20:14 . 2009-01-10 17:19 38 ----a-w- c:\documents and settings\Petr.PETRDOMA\jagex_runescape_preferences.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"PcSync"="c:\program files\Nokia1\Nokia PC Suite 6\PCSync2.exe" [2006-02-22 1302528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-09-30 4603904]
"nwiz"="nwiz.exe" [2004-09-30 921600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-09-30 86016]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"NVCLOCK"="nvclock.dll" [2003-04-14 81920]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-06-12 151552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr.PETRDOMA\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\microsoft office 7\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
BTTray.lnk - c:\program files\MICROSTAR\Bluetooth Software\BTTray.exe [2003-1-16 360509]
Cordless DUALphone Startup.lnk - c:\program files\Cordless USB Phone\Cordless DUALphone Suite.exe [2007-4-1 572416]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Media Key.lnk - c:\program files\Media Key\MagicKey.exe [2007-4-1 159744]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"d:\\Icq\\ICQ6.5\\ICQ.exe"=
"c:\\Microsoft Office 7\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 13:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [29.1.2010 15:30 114768]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [3.8.2008 10:17 12856]
R1 UsbFltr;WayTechUSBFilterDriver;c:\windows\system32\drivers\UsbFltr.sys [3.8.2008 10:17 8576]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29.1.2010 15:30 20560]
R3 PAC207;Trust 100K Series Webcam;c:\windows\system32\drivers\PFC027.SYS [28.12.2009 17:21 618112]
R3 VGAUTI;VGAUTI;c:\windows\system32\drivers\vgauti.sys [3.8.2008 13:10 39372]
.
Obsah adresáře 'Naplánované úlohy'

2010-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\micros~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A719FE98-4086-4666-BC1C-CCA970CF987E} = 10.36.0.3,10.36.0.1
FF - ProfilePath - c:\documents and settings\Petr.PETRDOMA\Data aplikací\Mozilla\Firefox\Profiles\gu7yuyus.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJPI142_04.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPOJI610.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 14:34
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NVCLOCK = rundll32 nvclock.dll,fnNvclock??????????????????????????????V?>w?????&??? ??????d??????????????????w

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(716)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\corel\Graphics8\programs\CMFFld80.dll
c:\windows\system32\BTNCopy.dll
c:\program files\Nokia1\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia1\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia1\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia1\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\rundll32.exe
c:\progra~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE
c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
c:\progra~1\MI43DA~1\BLUETO~1\BTSTAC~1.EXE
c:\program files\Media Key\OSD.EXE
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Celkový čas: 2010-01-31 14:42:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-31 13:42
ComboFix2.txt 2010-01-31 07:42

Před spuštěním: Volných bajtů: 92 791 488 512
Po spuštění: Volných bajtů: 92 856 086 528

- - End Of File - - FD207F6A2285974511614050CF1B0CF6

Re: Win 32:trojan-gen

Napsal: 31 led 2010 14:59
od Unlimited_Killer
Prosím nový RSIT log.

Re: Win 32:trojan-gen

Napsal: 31 led 2010 16:45
od petrslama
tady je:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2010-01-31 16:43:30
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 89 GB (68%) free of 131 GB
Total RAM: 2047 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:34, on 31.1.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Media Key\MagicKey.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\MI43DA~1\BLUETO~1\BTSTAC~1.EXE
C:\Microsoft Office 7\Office12\ONENOTEM.EXE
C:\Program Files\Media Key\OSD.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Documents and Settings\Petr.PETRDOMA\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe /NoDialog
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Microsoft Office 7\Office12\ONENOTEM.EXE
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Cordless DUALphone Startup.lnk = C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Media Key.lnk = C:\Program Files\Media Key\MagicKey.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2417419734
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A719FE98-4086-4666-BC1C-CCA970CF987E}: NameServer = 10.36.0.3,10.36.0.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7515 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-09-30 4603904]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-09-30 86016]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]
"NVCLOCK"=rundll32 nvclock.dll,fnNvclock []
"PAC207_Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-06-12 151552]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE [2005-12-13 217088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"PcSync"=C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe [2006-02-22 1302528]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
BTTray.lnk - C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
Cordless DUALphone Startup.lnk - C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Media Key.lnk - C:\Program Files\Media Key\MagicKey.exe

C:\Documents and Settings\Petr.PETRDOMA\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Microsoft Office 7\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"D:\Icq\ICQ6.5\ICQ.exe"="D:\Icq\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Microsoft Office 7\Office12\ONENOTE.EXE"="C:\Microsoft Office 7\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-01-31 14:42:21 ----A---- C:\ComboFix.txt
2010-01-31 14:25:48 ----D---- C:\ComboFix
2010-01-31 12:57:05 ----D---- C:\Program Files\Nokia1
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msxbse35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\mstext35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msrd2x35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\mspdox35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msltus35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msexch35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\VBAR332.DLL
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msrpfs35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msrepl35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjter35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjt4jlt.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjint35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjet35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msexcl35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\JETCOMP.exe
2010-01-31 10:50:01 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\PC Suite
2010-01-31 10:47:01 ----D---- C:\Program Files\PC Connectivity Solution
2010-01-31 10:45:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Installations
2010-01-31 10:36:14 ----A---- C:\WINDOWS\IE4 Error Log.txt
2010-01-31 10:11:44 ----D---- C:\WINDOWS\Prefetch
2010-01-31 10:09:10 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-01-31 10:09:01 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-01-31 10:08:48 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-01-31 10:08:38 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-01-31 10:08:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-01-31 10:08:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-01-31 10:08:10 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-01-31 10:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-01-31 10:07:52 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-01-31 10:07:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-01-31 10:07:34 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-01-31 10:07:22 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-01-31 10:07:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-01-31 10:07:06 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-01-31 10:06:57 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-01-31 10:06:48 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-01-31 10:06:40 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-01-31 10:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-01-31 10:06:22 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-01-31 10:06:13 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-01-31 10:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-01-31 10:05:56 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-01-31 10:05:46 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-01-31 10:05:37 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2010-01-31 10:05:23 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-01-31 10:05:15 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-01-31 10:05:06 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-01-31 10:04:57 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-01-31 10:04:49 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-01-31 10:04:41 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-01-31 10:04:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-01-31 10:04:24 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-01-31 10:04:15 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-01-31 10:04:07 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-01-31 10:03:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-01-31 10:03:48 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-01-31 10:03:36 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-01-31 10:03:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-01-31 10:03:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-01-31 10:03:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-01-31 10:03:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-01-31 10:02:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-01-31 10:02:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-01-31 10:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-01-31 10:02:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-01-31 10:02:17 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-01-31 10:02:13 ----A---- C:\WINDOWS\imsins.BAK
2010-01-31 10:02:06 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-01-31 10:01:57 ----A---- C:\WINDOWS\setuplog.txt
2010-01-31 10:00:21 ----A---- C:\WINDOWS\000001_.tmp
2010-01-31 09:42:45 ----D---- C:\Program Files\CCleaner
2010-01-31 08:22:34 ----A---- C:\Boot.bak
2010-01-31 08:22:19 ----RASHD---- C:\cmdcons
2010-01-31 08:20:44 ----A---- C:\WINDOWS\zip.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\SWSC.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\SWREG.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\sed.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\PEV.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\NIRCMD.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\MBR.exe
2010-01-31 08:20:44 ----A---- C:\WINDOWS\grep.exe
2010-01-31 08:20:25 ----D---- C:\WINDOWS\ERDNT
2010-01-31 08:20:11 ----D---- C:\Qoobox
2010-01-30 21:36:03 ----D---- C:\rsit
2010-01-30 21:36:03 ----D---- C:\Program Files\trend micro
2010-01-29 18:53:04 ----D---- C:\Program Files\Windows Sidebar
2010-01-29 18:52:42 ----A---- C:\WINDOWS\Irremote.ini
2010-01-29 18:43:14 ----D---- C:\WINDOWS\SxsCaPendDel
2010-01-29 15:30:05 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-01-28 18:14:11 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Alwil Software
2010-01-28 18:07:44 ----D---- C:\Program Files\DVD Shrink
2010-01-27 17:41:40 ----D---- C:\Program Files\SlySoft
2010-01-27 16:24:44 ----D---- C:\temp_dvd
2010-01-24 18:55:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-01-24 18:52:21 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\NOS
2010-01-23 16:38:34 ----D---- C:\Program Files\Haali
2010-01-23 16:36:50 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\VideoConverter
2010-01-13 17:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 17:22:35 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-01-31 16:40:43 ----D---- C:\Program Files\Mozilla Firefox
2010-01-31 15:18:30 ----D---- C:\WINDOWS\Temp
2010-01-31 14:42:23 ----D---- C:\WINDOWS\system32\drivers
2010-01-31 14:41:19 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-31 14:34:57 ----AD---- C:\WINDOWS
2010-01-31 14:34:57 ----A---- C:\WINDOWS\system.ini
2010-01-31 14:32:35 ----RD---- C:\Program Files
2010-01-31 14:32:34 ----SD---- C:\WINDOWS\Tasks
2010-01-31 14:30:52 ----D---- C:\WINDOWS\system32
2010-01-31 14:30:52 ----D---- C:\WINDOWS\AppPatch
2010-01-31 14:30:50 ----D---- C:\Program Files\Common Files
2010-01-31 14:26:24 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-31 12:58:22 ----HD---- C:\WINDOWS\inf
2010-01-31 12:58:21 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-31 12:57:35 ----SHD---- C:\WINDOWS\Installer
2010-01-31 12:57:27 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-31 12:57:27 ----D---- C:\Config.Msi
2010-01-31 12:57:05 ----D---- C:\Program Files\Common Files\Nokia
2010-01-31 12:51:59 ----D---- C:\WINDOWS\system32\config
2010-01-31 12:51:35 ----D---- C:\WINDOWS\system32\wbem
2010-01-31 12:51:35 ----D---- C:\WINDOWS\Registration
2010-01-31 12:42:13 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Downloaded Installations
2010-01-31 12:22:08 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Skype
2010-01-31 12:01:42 ----A---- C:\WINDOWS\ModemLog_Bluetooth Modem.txt
2010-01-31 11:41:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-31 10:50:45 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Nokia
2010-01-31 10:50:06 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\PC Suite
2010-01-31 10:47:06 ----D---- C:\Program Files\DIFX
2010-01-31 10:13:17 ----D---- C:\WINDOWS\Debug
2010-01-31 10:10:13 ----D---- C:\WINDOWS\security
2010-01-31 10:02:22 ----D---- C:\Program Files\Messenger
2010-01-31 10:00:49 ----D---- C:\WINDOWS\system32\oobe
2010-01-31 10:00:49 ----D---- C:\WINDOWS\Help
2010-01-31 10:00:14 ----D---- C:\WINDOWS\ehome
2010-01-31 09:45:33 ----D---- C:\WINDOWS\Minidump
2010-01-31 08:22:34 ----RASH---- C:\boot.ini
2010-01-31 08:20:43 ----SHD---- C:\System Volume Information
2010-01-31 08:20:43 ----D---- C:\WINDOWS\system32\Restore
2010-01-31 08:14:48 ----D---- C:\WINDOWS\WinSxS
2010-01-30 22:19:51 ----D---- C:\Program Files\Elaborate Bytes
2010-01-29 19:14:44 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Nero
2010-01-29 18:53:24 ----D---- C:\Program Files\Common Files\Nero
2010-01-29 18:45:39 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Nero
2010-01-29 17:20:53 ----A---- C:\WINDOWS\win.ini
2010-01-29 09:20:09 ----D---- C:\Program Files\FMS
2010-01-28 18:14:11 ----D---- C:\Program Files\Alwil Software
2010-01-28 17:24:06 ----D---- C:\Program Files\Ahead
2010-01-27 20:50:25 ----A---- C:\WINDOWS\WDICT32.INI
2010-01-27 20:24:52 ----A---- C:\WINDOWS\KBDSC32.INI
2010-01-27 17:31:31 ----D---- C:\Program Files\CDex
2010-01-26 15:48:01 ----D---- C:\Pracovní
2010-01-25 14:13:58 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2010-01-24 18:57:04 ----D---- C:\Program Files\Adobe
2010-01-24 18:56:53 ----D---- C:\Program Files\Common Files\Adobe
2010-01-23 16:12:09 ----D---- C:\Program Files\Avidemux 2.5
2010-01-22 19:35:16 ----D---- C:\Program Files\Internet Explorer
2010-01-22 19:35:05 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-19 19:24:02 ----D---- C:\Documents and Settings
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-04 19:43:17 ----D---- C:\Fotky

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdK8;Ovladač procesoru AMD Athlon64; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-05-08 38400]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbfilter;Keyboard Filter Driver; C:\WINDOWS\system32\drivers\kbfilter.sys [2002-07-11 12856]
R1 UsbFltr;WayTechUSBFilterDriver; C:\WINDOWS\system32\drivers\UsbFltr.sys [2003-12-29 8576]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 BtAudio;Bluetooth Audio; C:\WINDOWS\system32\DRIVERS\btaudio.sys [2003-01-16 21701]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2003-01-16 30043]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2003-01-16 144608]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2003-01-16 65076]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-09-30 2743840]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2004-11-11 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2004-11-11 12928]
R3 PAC207;Trust 100K Series Webcam; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2008-02-13 618112]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-24 6784]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VGAUTI;VGAUTI; \??\C:\WINDOWS\system32\DRIVERS\VGAUTI.sys []
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2008-06-05 8320]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-12-22 25280]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 mbr;mbr; \??\C:\DOCUME~1\PETR~1.PET\LOCALS~1\Temp\mbr.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 21248]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SQTECH905C;DualCamera; C:\WINDOWS\System32\Drivers\Capt905c.sys [2005-04-25 33538]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2004-09-30 127043]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: Win 32:trojan-gen

Napsal: 01 úno 2010 11:33
od Unlimited_Killer
Omlouvám se za prodlevu - to víte, škola. :oops:
Jinak už je čisto, jen uklidíme.
Všechny tyto kroky dělejte v pořadí, v jakém jsou zadány.

~~~

Spusťte Poznámkový blok [Start > Spustit > notepad > Enter].
Do něho vkopírujte následující text:

Kód: Vybrat vše

del "C:\WINDOWS\000001_.tmp"
Uložte ho například na Plochu jako del.bat [vizte obrázek] a dvojklikem jej spusťte.
Obrázek
Po použití tento soubor smažte.

~~~

Odinstalujte ComboFix
Start >> Spustit >> vkopírujte do okénka:

Kód: Vybrat vše

ComboFix /Uninstall
>> stiskněte Enter
To odinstaluje ComboFix a smaže s ním související soubory a složky.

~~~

Stáhněte OTC a dvojklikem ho spusťte.
Klikněte na 'CleanUp!'. Budete vyzváni k restartu - to proveďte.

~~~

Zkuste pročistit PC CCleanerem.
Nainstalujte, jen dávejte pozor a při instalaci odfajfkujte položku Instalovat Yahoo! Toolbar.
Spusťte.

:arrow: Záložka Čistič -> nechte zatrženo vše, jak je, a klikněte na 'Spustit CCleaner'.

:arrow: Záložka Registry > klikněte na 'Hledej problémy'. Vyhledá problémy v registru, až dokončí analyzování, klikněte na 'Opravit vybrané problémy'. Nabídne Vám vytvoření zálohy - pro jistotu ji vytvořte a uložte například na Plochu.

CCleaner doporučuji používat pravidelně, celkem rapidně dokáže zrychlit PC.

~~~

Zkuste defragmentovat disk. Buď pomocí integrovaného Windowsáckého nástroje (není moc dobrý), nebo například přes Defraggler. Dobré zkušenosti mám taky s jednoduchým JKDefrag, který se nemusí instalovat.

~~~

Po těchto mým 'zákrocích' Vám nebudou fungovat automatické aktualizace například Javy (spouštěly se zbytečně hned po startu systému a zatěžovaly RAM).
Proto doporučuji stáhnout si prográmek jménem FileHippo Update Checker, který stačit jednou týdně spustit a přehledně Vám zobrazí, který software je neaktuální.

~~~

Po všech těchto krocích udělejte nový RSIT log.

Re: Win 32:trojan-gen

Napsal: 01 úno 2010 14:41
od petrslama
díky za pomoc. PC je fakt čistý, ale mám trochu problém s dll knihovnou. Při spuštění BT mi to píše tuhle hlášku

res://C:\WINDOWS\system32\btrezxp.dll/212. "Chyba v řádku 134 znak 5. Chyba: Objekt tuto vlastnost nebo metodu nepodporuje". Neznáš nějaký bezpečný SW, jak knihovnu opravit?

Jinak moc díky za pomoc

Re: Win 32:trojan-gen

Napsal: 01 úno 2010 14:47
od petrslama
tady je ještě ten log z RSITu.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2010-02-01 14:45:59
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 89 GB (68%) free of 131 GB
Total RAM: 2047 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:46:04, on 1.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Media Key\MagicKey.exe
C:\Microsoft Office 7\Office12\ONENOTEM.EXE
C:\PROGRA~1\MI43DA~1\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Media Key\OSD.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Petr.PETRDOMA\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Petr.exe
C:\WINDOWS\system32\HPZinw12.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Microsoft Office 7\Office12\ONENOTEM.EXE
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Cordless DUALphone Startup.lnk = C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Media Key.lnk = C:\Program Files\Media Key\MagicKey.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 2417419734
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A719FE98-4086-4666-BC1C-CCA970CF987E}: NameServer = 10.36.0.3,10.36.0.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7776 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-09-30 4603904]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-09-30 86016]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]
"NVCLOCK"=rundll32 nvclock.dll,fnNvclock []
"PAC207_Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-06-12 151552]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia1\NOKIAP~1\LAUNCH~1.EXE [2005-12-13 217088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"PcSync"=C:\Program Files\Nokia1\Nokia PC Suite 6\PCSync2.exe [2006-02-22 1302528]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
BTTray.lnk - C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
Cordless DUALphone Startup.lnk - C:\Program Files\Cordless USB Phone\Cordless DUALphone Suite.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Media Key.lnk - C:\Program Files\Media Key\MagicKey.exe

C:\Documents and Settings\Petr.PETRDOMA\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Microsoft Office 7\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"D:\Icq\ICQ6.5\ICQ.exe"="D:\Icq\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Microsoft Office 7\Office12\ONENOTE.EXE"="C:\Microsoft Office 7\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-02-01 14:45:59 ----D---- C:\rsit
2010-01-31 16:47:17 ----SHD---- C:\RECYCLER
2010-01-31 12:57:05 ----D---- C:\Program Files\Nokia1
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msxbse35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\mstext35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msrd2x35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\mspdox35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msltus35.dll
2010-01-31 12:21:40 ----A---- C:\WINDOWS\system32\msexch35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\VBAR332.DLL
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msrpfs35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msrepl35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjter35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjt4jlt.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjint35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msjet35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\msexcl35.dll
2010-01-31 12:21:39 ----A---- C:\WINDOWS\system32\JETCOMP.exe
2010-01-31 10:50:01 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\PC Suite
2010-01-31 10:47:01 ----D---- C:\Program Files\PC Connectivity Solution
2010-01-31 10:45:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Installations
2010-01-31 10:11:44 ----D---- C:\WINDOWS\Prefetch
2010-01-31 10:09:10 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-01-31 10:09:01 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-01-31 10:08:48 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-01-31 10:08:38 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-01-31 10:08:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-01-31 10:08:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-01-31 10:08:10 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-01-31 10:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-01-31 10:07:52 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-01-31 10:07:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-01-31 10:07:34 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-01-31 10:07:22 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-01-31 10:07:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-01-31 10:07:06 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-01-31 10:06:57 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-01-31 10:06:48 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-01-31 10:06:40 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-01-31 10:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-01-31 10:06:22 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-01-31 10:06:13 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-01-31 10:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-01-31 10:05:56 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-01-31 10:05:46 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-01-31 10:05:37 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2010-01-31 10:05:23 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-01-31 10:05:15 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-01-31 10:05:06 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-01-31 10:04:57 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-01-31 10:04:49 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-01-31 10:04:41 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-01-31 10:04:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-01-31 10:04:24 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-01-31 10:04:15 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-01-31 10:04:07 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-01-31 10:03:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-01-31 10:03:48 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-01-31 10:03:36 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-01-31 10:03:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-01-31 10:03:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-01-31 10:03:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-01-31 10:03:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-01-31 10:02:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-01-31 10:02:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-01-31 10:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-01-31 10:02:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-01-31 10:02:17 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-01-31 10:02:06 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-01-31 10:00:21 ----A---- C:\WINDOWS\000001_.tmp
2010-01-31 09:42:45 ----D---- C:\Program Files\CCleaner
2010-01-31 08:22:34 ----A---- C:\Boot.bak
2010-01-31 08:22:19 ----RASHD---- C:\cmdcons
2010-01-31 08:20:25 ----D---- C:\WINDOWS\ERDNT
2010-01-30 21:36:03 ----D---- C:\Program Files\trend micro
2010-01-29 18:53:04 ----D---- C:\Program Files\Windows Sidebar
2010-01-29 18:52:42 ----A---- C:\WINDOWS\Irremote.ini
2010-01-29 18:43:14 ----D---- C:\WINDOWS\SxsCaPendDel
2010-01-29 15:30:05 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-01-28 18:14:11 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Alwil Software
2010-01-28 18:07:44 ----D---- C:\Program Files\DVD Shrink
2010-01-27 17:41:40 ----D---- C:\Program Files\SlySoft
2010-01-27 16:24:44 ----D---- C:\temp_dvd
2010-01-24 18:55:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-01-24 18:52:21 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\NOS
2010-01-23 16:38:34 ----D---- C:\Program Files\Haali
2010-01-23 16:36:50 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\VideoConverter
2010-01-13 17:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 17:22:35 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-02-01 14:44:02 ----D---- C:\Program Files\Mozilla Firefox
2010-02-01 14:31:55 ----D---- C:\WINDOWS\Debug
2010-02-01 14:31:55 ----AD---- C:\WINDOWS
2010-02-01 14:17:05 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-01 14:16:31 ----D---- C:\WINDOWS\Temp
2010-02-01 14:14:26 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-01-31 14:42:23 ----D---- C:\WINDOWS\system32\drivers
2010-01-31 14:34:57 ----A---- C:\WINDOWS\system.ini
2010-01-31 14:32:35 ----RD---- C:\Program Files
2010-01-31 14:32:34 ----SD---- C:\WINDOWS\Tasks
2010-01-31 14:30:52 ----D---- C:\WINDOWS\system32
2010-01-31 14:30:52 ----D---- C:\WINDOWS\AppPatch
2010-01-31 14:30:50 ----D---- C:\Program Files\Common Files
2010-01-31 12:58:22 ----HD---- C:\WINDOWS\inf
2010-01-31 12:58:21 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-31 12:57:35 ----SHD---- C:\WINDOWS\Installer
2010-01-31 12:57:27 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-31 12:57:27 ----D---- C:\Config.Msi
2010-01-31 12:57:05 ----D---- C:\Program Files\Common Files\Nokia
2010-01-31 12:51:59 ----D---- C:\WINDOWS\system32\config
2010-01-31 12:51:35 ----D---- C:\WINDOWS\system32\wbem
2010-01-31 12:51:35 ----D---- C:\WINDOWS\Registration
2010-01-31 12:42:13 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Downloaded Installations
2010-01-31 12:22:08 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Skype
2010-01-31 12:01:42 ----A---- C:\WINDOWS\ModemLog_Bluetooth Modem.txt
2010-01-31 11:41:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-31 10:50:45 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Nokia
2010-01-31 10:50:06 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\PC Suite
2010-01-31 10:47:06 ----D---- C:\Program Files\DIFX
2010-01-31 10:10:13 ----D---- C:\WINDOWS\security
2010-01-31 10:02:22 ----D---- C:\Program Files\Messenger
2010-01-31 10:00:49 ----D---- C:\WINDOWS\system32\oobe
2010-01-31 10:00:49 ----D---- C:\WINDOWS\Help
2010-01-31 10:00:14 ----D---- C:\WINDOWS\ehome
2010-01-31 09:45:33 ----D---- C:\WINDOWS\Minidump
2010-01-31 08:22:34 ----RASH---- C:\boot.ini
2010-01-31 08:20:43 ----SHD---- C:\System Volume Information
2010-01-31 08:20:43 ----D---- C:\WINDOWS\system32\Restore
2010-01-31 08:14:48 ----D---- C:\WINDOWS\WinSxS
2010-01-30 22:19:51 ----D---- C:\Program Files\Elaborate Bytes
2010-01-29 19:14:44 ----D---- C:\Documents and Settings\Petr.PETRDOMA\Data aplikací\Nero
2010-01-29 18:53:24 ----D---- C:\Program Files\Common Files\Nero
2010-01-29 18:45:39 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Nero
2010-01-29 17:20:53 ----A---- C:\WINDOWS\win.ini
2010-01-29 09:20:09 ----D---- C:\Program Files\FMS
2010-01-28 18:14:11 ----D---- C:\Program Files\Alwil Software
2010-01-28 17:24:06 ----D---- C:\Program Files\Ahead
2010-01-27 20:50:25 ----A---- C:\WINDOWS\WDICT32.INI
2010-01-27 20:24:52 ----A---- C:\WINDOWS\KBDSC32.INI
2010-01-27 17:31:31 ----D---- C:\Program Files\CDex
2010-01-26 15:48:01 ----D---- C:\Pracovní
2010-01-25 14:13:58 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2010-01-24 18:57:04 ----D---- C:\Program Files\Adobe
2010-01-24 18:56:53 ----D---- C:\Program Files\Common Files\Adobe
2010-01-23 16:12:09 ----D---- C:\Program Files\Avidemux 2.5
2010-01-22 19:35:16 ----D---- C:\Program Files\Internet Explorer
2010-01-22 19:35:05 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-19 19:24:02 ----D---- C:\Documents and Settings
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-04 19:43:17 ----D---- C:\Fotky

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdK8;Ovladač procesoru AMD Athlon64; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-05-08 38400]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbfilter;Keyboard Filter Driver; C:\WINDOWS\system32\drivers\kbfilter.sys [2002-07-11 12856]
R1 UsbFltr;WayTechUSBFilterDriver; C:\WINDOWS\system32\drivers\UsbFltr.sys [2003-12-29 8576]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 BtAudio;Bluetooth Audio; C:\WINDOWS\system32\DRIVERS\btaudio.sys [2003-01-16 21701]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2003-01-16 30043]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2003-01-16 144608]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2003-01-16 65076]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-09-30 2743840]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2004-11-11 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2004-11-11 12928]
R3 PAC207;Trust 100K Series Webcam; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2008-02-13 618112]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-24 6784]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VGAUTI;VGAUTI; \??\C:\WINDOWS\system32\DRIVERS\VGAUTI.sys []
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 grmnusb;grmnusb; C:\WINDOWS\system32\drivers\grmnusb.sys [2008-06-05 8320]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-12-22 25280]
S3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 21248]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SQTECH905C;DualCamera; C:\WINDOWS\System32\Drivers\Capt905c.sys [2005-04-25 33538]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2004-09-30 127043]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: Win 32:trojan-gen

Napsal: 01 úno 2010 15:24
od Unlimited_Killer
Když jsem googlil, našel jsem že pomůže přeinstalace toho programu od WIDCOMMu. Zkuste to.
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz