VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

prosím o kontrolu logu s RSIT

https://forum.viry.cz:443/viewtopic.php?t=97626

Stránka 1 z 2

prosím o kontrolu logu s RSIT

Napsal: 13 úno 2010 23:47
od miruska88888
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-02-13 17:41:16
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 12 GB (60%) free of 20 GB
Total RAM: 511 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:34, on 13.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ConMet\ConMet.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\OrangeBs\TaskBarIcon.exe
C:\Program Files\OrangeBs\BusinessEverywhere.exe
C:\Program Files\OrangeBs\ComComp.exe
C:\Program Files\OrangeBs\Watch.exe
C:\WINDOWS\System32\FTCOMM~1\FTCOMM~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [hpbdfawep] C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe 1
O4 - HKLM\..\Run: [OBSWATCH] C:\PROGRA~1\OrangeBs\Watch.exe
O4 - HKLM\..\Run: [ConMet] C:\Program Files\ConMet\ConMet.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "D:\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "D:\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EDD9947-FF95-4D7A-9B99-1B6CE6EB1C27}: NameServer = 213.151.200.31 213.151.208.162
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: GtFlashSwitch - OptionNV - C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5389 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\HP WEP.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-03-14 16010752]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-12 45056]
"hpbdfawep"=C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 954368]
"OBSWATCH"=C:\PROGRA~1\OrangeBs\Watch.exe [2005-09-07 20480]
"ConMet"=C:\Program Files\ConMet\ConMet.exe [2010-02-13 3813376]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-02-11 2756488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360]
"Nokia.PCSync"=D:\Nokia\Nokia PC Suite 6\PCSync2.exe [2008-03-26 1232896]
"PC Suite Tray"=D:\Nokia\Nokia PC Suite 6\PCSuite.exe [2008-04-16 1079808]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
PowerReg Scheduler V3.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-11 47104]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE"="C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ac7f23a-1346-11df-bca6-00138fb739ab}]
shell\AutoRun\command - F:\eexyv.exe
shell\open\command - F:\eexyv.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8482226e-e2af-11de-bc7c-00138fb739ab}]
shell\AutoRun\command - F:\eexyv.exe
shell\open\command - F:\eexyv.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0333dcc-18d0-11df-bca8-00138fb739ab}]
shell\AutoRun\command - F:\eexyv.exe
shell\open\command - F:\eexyv.exe


======List of files/folders created in the last 1 months======

2010-02-13 17:41:18 ----D---- C:\Program Files\trend micro
2010-02-13 17:41:16 ----D---- C:\rsit
2010-02-13 17:34:31 ----D---- C:\WINDOWS\system32\CatRoot_bak
2010-02-13 14:29:02 ----A---- C:\WINDOWS\ModemLog_GlobeTrotter Module 3G+ Modem.txt
2010-02-13 14:25:15 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-02-13 14:25:13 ----D---- C:\Program Files\Adobe
2010-02-13 14:25:08 ----D---- C:\WINDOWS\system32\FTCOMModule
2010-02-13 14:25:03 ----A---- C:\WINDOWS\system32\IfHelper.dll
2010-02-13 14:25:03 ----A---- C:\WINDOWS\system32\FTRTSVC.exe
2010-02-13 14:25:01 ----A---- C:\WINDOWS\system32\W32n50.dll
2010-02-13 14:24:47 ----D---- C:\Program Files\FranceTelecomUninstall
2010-02-13 14:23:50 ----D---- C:\Program Files\OrangeBs
2010-02-13 14:23:03 ----D---- C:\Program Files\Option
2010-02-13 14:23:03 ----D---- C:\Program Files\Common Files\GtFlashSwitch
2010-02-13 10:33:01 ----D---- C:\Documents and Settings\Administrator\Application Data\Help
2010-02-13 10:13:32 ----A---- C:\WINDOWS\IE4 Error Log.txt
2010-02-13 09:54:45 ----A---- C:\R_NDIS.txt
2010-02-13 09:26:01 ----D---- C:\Program Files\Google
2010-02-13 09:25:44 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-02-13 09:25:39 ----D---- C:\Program Files\Alwil Software
2010-02-13 09:25:39 ----D---- C:\Documents and Settings\All Users\Application Data\Alwil Software
2010-02-13 09:12:03 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2010-02-13 09:12:02 ----D---- C:\Program Files\Common Files\Adobe
2010-02-13 08:37:52 ----D---- C:\Program Files\ConMet
2010-02-13 08:37:52 ----D---- C:\Documents and Settings\All Users\Application Data\ConMet
2010-02-13 08:37:52 ----D---- C:\Documents and Settings\Administrator\Application Data\ConMet
2010-02-13 08:30:28 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-02-13 08:30:28 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-02-13 08:30:22 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2010-02-13 08:30:21 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-02-13 08:30:21 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2010-02-13 08:30:21 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2010-01-21 22:41:53 ----D---- C:\Documents and Settings\Administrator\Application Data\Nokia Multimedia Player
2010-01-21 22:34:26 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-01-21 22:34:23 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-01-21 22:34:22 ----HDC---- C:\WINDOWS\$NtUninstallWdf01005$
2010-01-21 22:32:47 ----D---- C:\Documents and Settings\Administrator\Application Data\PC Suite
2010-01-21 22:32:45 ----D---- C:\Documents and Settings\All Users\Application Data\PC Suite
2010-01-21 22:32:21 ----D---- C:\Documents and Settings\Administrator\Application Data\Nokia
2010-01-21 22:31:55 ----D---- C:\Program Files\Common Files\PCSuite
2010-01-21 22:31:55 ----D---- C:\Program Files\Common Files\Nokia
2010-01-21 22:31:29 ----D---- C:\Program Files\DIFX
2010-01-21 22:31:22 ----D---- C:\Program Files\PC Connectivity Solution
2010-01-21 22:31:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\wdfcoinstaller01005.dll
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2010-01-21 22:28:51 ----D---- C:\Documents and Settings\All Users\Application Data\Installations

======List of files/folders modified in the last 1 months======

2010-02-13 18:21:02 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-02-13 17:41:18 ----RD---- C:\Program Files
2010-02-13 17:39:18 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-13 17:39:17 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-13 17:39:15 ----HD---- C:\WINDOWS\inf
2010-02-13 17:34:31 ----D---- C:\WINDOWS\system32
2010-02-13 17:34:31 ----D---- C:\WINDOWS\Debug
2010-02-13 17:34:31 ----D---- C:\WINDOWS
2010-02-13 17:32:19 ----D---- C:\WINDOWS\Prefetch
2010-02-13 14:03:29 ----D---- C:\WINDOWS\Temp
2010-02-13 13:51:47 ----D---- C:\WINDOWS\system32\Restore
2010-02-13 10:06:16 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2010-02-13 09:45:08 ----SD---- C:\WINDOWS\Tasks
2010-02-13 09:33:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-13 09:32:18 ----SHD---- C:\WINDOWS\Installer
2010-02-13 09:26:00 ----D---- C:\WINDOWS\system32\drivers
2010-02-13 09:25:54 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-13 09:12:02 ----D---- C:\Program Files\Common Files
2010-02-13 08:52:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-13 08:30:31 ----D---- C:\WINDOWS\Help
2010-02-13 08:30:28 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-21 23:14:08 ----D---- C:\WINDOWS\system32\wbem
2010-01-21 22:31:02 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-02-11 28880]
R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2005-10-18 11008]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-02-11 162512]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-02-11 46672]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-02-11 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-02-11 100432]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2007-02-18 62336]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-03-14 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-02-11 23376]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-11 1414656]
R3 GTFFBUS;GT FF BUS; C:\WINDOWS\system32\DRIVERS\gtffbus.sys [2006-01-25 16000]
R3 GTMMDMUSB;GT M 3G+ USB MDM; C:\WINDOWS\system32\DRIVERS\gtmmdmusb.sys [2006-02-01 25472]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS; C:\WINDOWS\system32\DRIVERS\Gtm51Irp.sys [2006-02-01 102784]
R3 GTMSERUSB;GT M 3G+ USB SER; C:\WINDOWS\system32\DRIVERS\gtmserusb.sys [2006-02-01 21760]
R3 GTPTSER;GT PT SER; C:\WINDOWS\system32\DRIVERS\gtptser.sys [2006-01-25 8064]
R3 GTSCSER;GT SC SER; C:\WINDOWS\system32\DRIVERS\gtscser.sys [2005-12-09 19328]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2007-02-18 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-03-16 4249088]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-03-14 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-07-29 34048]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-07-29 12928]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-02-18 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-02-18 59264]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-02-18 17152]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service; C:\WINDOWS\system32\DRIVERS\GtVUsb.sys [2005-12-22 5120]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2005-01-19 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2007-11-29 16896]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2007-11-29 19328]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 8064]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbser;Nokia USB Serial Port; C:\WINDOWS\system32\DRIVERS\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-11 393216]
R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2005-10-18 241152]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-06-10 40960]
R2 GtFlashSwitch;GtFlashSwitch; C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [2007-02-09 176128]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-29 572928]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-13 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2007-02-18 38912]
S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

-----------------EOF-----------------

Re: prosím o kontrolu logu s RSIT

Napsal: 13 úno 2010 23:52
od Unlimited_Killer
Na logu se pracuje. :welcome:

Re: prosím o kontrolu logu s RSIT

Napsal: 13 úno 2010 23:54
od miruska88888
info.txt logfile of random's system information tool 1.06 2010-02-13 17:41:36

======Uninstall list======

-->C:\PROGRA~1\OrangeBs\MesSMS\UNWISE.EXE C:\PROGRA~1\OrangeBs\MesSMS\INSTALL.LOG
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Reader 6.0.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001}
ASUS Enhanced Display Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x9 -removeonly
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->MsiExec.exe /I{F9AD857F-0492-4AC2-9A77-241360ADBB3C}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil Software\Avast5\Setup\setiface.dll" RunSetup
Business Everywhere-->C:\PROGRA~1\OrangeBs\Uninstall.exe
Connection Meter-->C:\Program Files\ConMet\ConMet.exe /uninstall
GlobeTrotter Connect-->MsiExec.exe /X{F34FAFF0-0C58-404E-9535-F00A1D693DD0}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\4.0.249.89\Installer\setup.exe" --uninstall --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP LaserJet P1000 series-->C:\Program Files\Avago-HP\{44e40264-f705-405d-b874-815155a017e1}\uninstall.exe SYSTEMHORNET "C:\Program Files\Avago-HP\{44e40264-f705-405d-b874-815155a017e1}"
HPCarePackCore-->MsiExec.exe /I{7B02BF60-796D-4616-908B-B31A63CFDEFB}
HPCarePackProducts-->MsiExec.exe /I{ECA31632-C2AD-4774-A3CA-2813D47E4DD0}
HPSSupply-->MsiExec.exe /X{7902E313-FF0F-4493-ACB1-A8147B78DCD0}
Hunting Unlimited 2008-->"D:\Hry\Hunting Unlimited 2008\unins000.exe"
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011041B-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
MrvlUsgTracking-->MsiExec.exe /I{02C85EC5-E864-4847-AF55-42730861004C}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
Nokia Connectivity Cable Driver-->MsiExec.exe /X{4F1DCA42-2030-437C-A94E-736692A499C1}
Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Nokia_PC_Suite_rel_6_86_9_4_EA.exe
Nokia PC Suite-->MsiExec.exe /I{5AFEABF5-7411-4C29-9FA9-71ABE880662D}
NVIDIA Drivers-->C:\WINDOWS\system32\nvunrm.exe UninstallGUI
Option ICON USB modem-->C:\PROGRA~1\FranceTelecomUninstall\OptionGTUSB\Uninstall.exe Uninstall.ini
PC Connectivity Solution-->MsiExec.exe /I{E9BC886E-0D8A-4EF5-B793-30DB776C6E2C}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x1b -removeonly
Windows Driver Package - Nokia Modem (03/05/2008 3.7)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_635B28EFCFA9395123BB1C251595CB16129E2560\nokia_bluetooth.inf
Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_28F2EAC406838DA65AFF6C6886FE9FE96AEF5186\nokbtmdm.inf
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf

======Security center information======

AV: avast! Antivirus

======System event log======

Computer Name: THIS-40B7825CFB
Event Code: 7035
Message: Službe SSDP Discovery Service bolo úspešne odoslané riadenie Spustené.

Record Number: 1397
Source Name: Service Control Manager
Time Written: 20091222213333.000000-300
Event Type: informácie
User: NT AUTHORITY\SYSTEM

Computer Name: THIS-40B7825CFB
Event Code: 7036
Message: Služba IMAPI CD-Burning COM Service vstúpila do stavu Spustené.

Record Number: 1396
Source Name: Service Control Manager
Time Written: 20091222213333.000000-300
Event Type: informácie
User:

Computer Name: THIS-40B7825CFB
Event Code: 7035
Message: Službe IMAPI CD-Burning COM Service bolo úspešne odoslané riadenie Spustené.

Record Number: 1395
Source Name: Service Control Manager
Time Written: 20091222213333.000000-300
Event Type: informácie
User: NT AUTHORITY\SYSTEM

Computer Name: THIS-40B7825CFB
Event Code: 7036
Message: Služba Computer Browser vstúpila do stavu Zastavené.

Record Number: 1394
Source Name: Service Control Manager
Time Written: 20091222213330.000000-300
Event Type: informácie
User:

Computer Name: THIS-40B7825CFB
Event Code: 7036
Message: Služba Application Layer Gateway Service vstúpila do stavu Spustené.

Record Number: 1393
Source Name: Service Control Manager
Time Written: 20091222213329.000000-300
Event Type: informácie
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2c02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 00:50
od Unlimited_Killer
Jdeme na to. :James008:

~~~

1) Zapojte do PC všechny flashky, externí disky, mp3 přehrávače atd. →
  • na disku s označením F: je infekce!

2) ComboFix
  • Stáhněte a uložte na Plochu ComboFix.
  • Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
  • Spusťte ho s administrátorským oprávněním.
  • Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'.
  • Budete také dotázáni na instalaci konzole pro zotavení, taktéž klikněte na 'Ano'.
  • Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat.
  • Váš PC bude pravděpodobně restartován, tak se toho nelekněte.
  • Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
  • Po skončení skenu (či následném restartu) na Vás 'vypadne' log, který vkopírujete ve formě textu sem.
  • Pokud žádný log 'nevypadne', naleznete jej v umístění C:\ComboFix.txt

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 09:39
od miruska88888
moj PC reštartovaný nebol......tu je log s combofix

ComboFix 10-02-12.01 - Administrator 14.02.2010 3:29.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.511.185 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2010-01-14 to 2010-02-14 )))))))))))))))))))))))))))))))
.

2010-02-13 23:36 . 2010-02-13 23:36 -------- d-s---w- c:\documents and settings\Administrator\UserData
2010-02-13 22:41 . 2010-02-13 23:22 -------- d-----w- c:\program files\trend micro
2010-02-13 22:41 . 2010-02-13 22:41 -------- d-----w- C:\rsit
2010-02-13 22:34 . 2010-02-13 22:39 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-02-13 19:25 . 2004-08-04 04:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-13 19:25 . 2010-02-14 08:11 -------- d-----w- c:\windows\system32\FTCOMModule
2010-02-13 19:25 . 2005-10-06 20:27 36864 ----a-w- c:\windows\system32\IfHelper.dll
2010-02-13 19:25 . 2004-06-10 21:20 40960 ----a-w- c:\windows\system32\FTRTSVC.exe
2010-02-13 19:25 . 2003-08-04 20:22 94208 ----a-w- c:\windows\system32\W32n50.dll
2010-02-13 19:25 . 2003-08-04 20:22 16128 ------w- c:\windows\system32\PCANDIS5.SYS
2010-02-13 19:24 . 2010-02-13 19:24 -------- d-----w- c:\program files\FranceTelecomUninstall
2010-02-13 19:24 . 2006-02-01 17:29 102784 ----a-w- c:\windows\system32\drivers\Gtm51Irp.sys
2010-02-13 19:24 . 2006-02-01 17:29 21760 ----a-w- c:\windows\system32\drivers\gtmserusb.sys
2010-02-13 19:24 . 2006-02-01 17:29 25472 ----a-w- c:\windows\system32\drivers\gtmmdmusb.sys
2010-02-13 19:24 . 2006-01-25 19:50 16000 ----a-w- c:\windows\system32\drivers\gtffbus.sys
2010-02-13 19:24 . 2006-01-25 19:50 8064 ----a-w- c:\windows\system32\drivers\gtptser.sys
2010-02-13 19:24 . 2005-12-22 20:30 5120 ----a-w- c:\windows\system32\drivers\GtVUsb.sys
2010-02-13 19:24 . 2005-12-09 18:41 19328 ----a-w- c:\windows\system32\drivers\gtscser.sys
2010-02-13 19:23 . 2010-02-14 08:28 -------- d-----w- c:\program files\OrangeBs
2010-02-13 19:23 . 2010-02-13 19:23 -------- d-----w- c:\program files\Option
2010-02-13 19:23 . 2010-02-13 19:23 -------- d-----w- c:\program files\Common Files\GtFlashSwitch
2010-02-13 15:33 . 2010-02-13 15:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2010-02-13 14:31 . 2010-02-13 14:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:32 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Temp
2010-02-13 14:26 . 2010-02-13 14:26 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:29 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:28 -------- d-----w- c:\program files\Google
2010-02-13 14:26 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-13 14:26 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-13 14:25 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-13 14:25 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-13 14:25 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-13 14:25 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-13 14:25 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-13 14:25 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-13 14:25 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-13 14:25 . 2010-02-13 14:25 -------- d-----w- c:\program files\Alwil Software
2010-02-13 14:25 . 2010-02-13 14:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-13 14:12 . 2010-02-13 14:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-13 13:38 . 2010-02-14 08:28 22752 ----a-w- c:\documents and settings\Administrator\Application Data\ConMet\Konta\Administrator.cmd
2010-02-13 13:37 . 2010-02-14 08:28 -------- d-----w- c:\documents and settings\All Users\Application Data\ConMet
2010-02-13 13:37 . 2010-02-14 08:10 -------- d-----w- c:\documents and settings\Administrator\Application Data\ConMet
2010-02-13 13:37 . 2010-02-13 13:37 -------- d-----w- c:\program files\ConMet
2010-02-13 13:30 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-23 15:45 . 2010-02-06 18:26 -------- d-sh--w- c:\documents and settings\Administrator\Phone Browser
2010-01-22 03:41 . 2010-01-22 03:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia Multimedia Player
2010-01-22 03:34 . 2004-08-04 04:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-22 03:34 . 2006-10-09 02:51 23856 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-22 03:32 . 2010-02-06 18:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite
2010-01-22 03:32 . 2010-01-22 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2010-01-22 03:32 . 2010-02-06 19:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia
2010-01-22 03:30 . 2008-04-29 06:09 49432760 ----a-r- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Nokia_PC_Suite_rel_6_86_9_4_EA.exe
2010-01-22 03:29 . 2010-01-22 03:29 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstCCD.exe
2010-01-22 03:29 . 2010-01-22 03:29 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-01-22 03:29 . 2010-01-22 03:29 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstPCS.exe
2010-01-22 03:28 . 2010-01-22 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 03:34 . 2010-01-22 03:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-22 03:34 . 2010-01-22 03:34 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\Common Files\PCSuite
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\Common Files\Nokia
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\DIFX
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\PC Connectivity Solution
2010-01-11 17:42 . 2009-08-23 10:52 -------- d--h--w- c:\program files\InstallShield Installation Information
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="d:\nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="d:\nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-14 16010752]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"OBSWATCH"="c:\progra~1\OrangeBs\Watch.exe" [2005-09-07 20480]
"ConMet"="c:\program files\ConMet\ConMet.exe" [2010-02-13 3813376]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 99840]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2009-9-6 225280]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [13.2.2010 9:26 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [13.2.2010 9:26 19024]
R2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [9.2.2007 13:48 176128]
R3 GTFFBUS;GT FF BUS;c:\windows\system32\drivers\gtffbus.sys [13.2.2010 14:24 16000]
R3 GTMMDMUSB;GT M 3G+ USB MDM;c:\windows\system32\drivers\gtmmdmusb.sys [13.2.2010 14:24 25472]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\drivers\Gtm51Irp.sys [13.2.2010 14:24 102784]
R3 GTMSERUSB;GT M 3G+ USB SER;c:\windows\system32\drivers\gtmserusb.sys [13.2.2010 14:24 21760]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13.2.2010 9:26 133104]
S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service;c:\windows\system32\drivers\GtVUsb.sys [13.2.2010 14:24 5120]
.
Contents of the 'Scheduled Tasks' folder

2010-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-13 14:26]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-13 14:26]

2010-02-14 c:\windows\Tasks\HP WEP.job
- c:\program files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 18:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-14 03:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(856)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(532)
c:\windows\system32\msi.dll
.
Completion time: 2010-02-14 03:33:55
ComboFix-quarantined-files.txt 2010-02-14 08:33

Pre-Run: 13 210 054 656 bytes free
Post-Run: 13 472 927 744 bytes free

- - End Of File - - EC39B4A687908654E62AA3DCE1B281EF

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 11:40
od miruska88888
prosiim o kontrolu logu z combofix.........zatial dakujem

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 11:40
od Unlimited_Killer
Nebojte, jdu na to.

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 12:29
od miruska88888
prosiiim o pomoc:)

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 12:39
od Unlimited_Killer
Dobrá, jdeme na to. :James008:
A omlouvám se za zpoždění. :oops:

1) Zapojte do PC všechny flashky, externí disky, mp3 přehrávače atd. →
  • na disku s označením F: je infekce!
2) Skript do ComboFix-u
  • Otevřete si Poznámkový blok [Start → Spustit → notepad → Enter].
  • Do něj vkopírujte následující text:

    Kód: Vybrat vše

    KillAll::

File::
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
F:\eexyv.exe
c:\documents and settings\Administrator\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe 

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ac7f23a-1346-11df-bca6-00138fb739ab}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8482226e-e2af-11de-bc7c-00138fb739ab}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0333dcc-18d0-11df-bca8-00138fb739ab}]

Extra::

Reboot::
  • Uložte tento soubor na Plochu pod jménem CFScript (koncovka .txt).
  • Přetáhněte tento soubor nad ComboFix a pusťte ho.
  • I tento soubor, i ComboFix musí být na Ploše!
    Obrázek
  • ComboFix se spustí a vykoná příkazy ze skriptu.
  • Počítač bude pravděpodobně restartován.
  • Po restartu na Vás vyskočí okno s logem, který mi vkopírujete sem ve formě textu.

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:02
od miruska88888
ComboFix 10-02-12.01 - Administrator 14.02.2010 6:46.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.511.222 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\Administrator\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe"
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
"F:\eexyv.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
c:\windows\tasks\GoogleUpdateTaskMachineCore.job
c:\windows\tasks\GoogleUpdateTaskMachineUA.job

.
((((((((((((((((((((((((( Files Created from 2010-01-14 to 2010-02-14 )))))))))))))))))))))))))))))))
.

2010-02-14 11:50 . 2010-02-14 11:50 -------- d-----w- c:\windows\system32\wbem\snmp
2010-02-14 11:50 . 2010-02-14 11:50 -------- d-----w- c:\windows\system32\xircom
2010-02-14 11:50 . 2010-02-14 11:50 -------- d-----w- c:\program files\microsoft frontpage
2010-02-13 23:36 . 2010-02-13 23:36 -------- d-s---w- c:\documents and settings\Administrator\UserData
2010-02-13 22:41 . 2010-02-13 23:22 -------- d-----w- c:\program files\trend micro
2010-02-13 22:41 . 2010-02-13 22:41 -------- d-----w- C:\rsit
2010-02-13 22:34 . 2010-02-13 22:39 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-02-13 19:25 . 2004-08-04 04:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-13 19:25 . 2010-02-14 10:05 -------- d-----w- c:\windows\system32\FTCOMModule
2010-02-13 19:25 . 2005-10-06 20:27 36864 ----a-w- c:\windows\system32\IfHelper.dll
2010-02-13 19:25 . 2004-06-10 21:20 40960 ----a-w- c:\windows\system32\FTRTSVC.exe
2010-02-13 19:25 . 2003-08-04 20:22 94208 ----a-w- c:\windows\system32\W32n50.dll
2010-02-13 19:25 . 2003-08-04 20:22 16128 ------w- c:\windows\system32\PCANDIS5.SYS
2010-02-13 19:24 . 2010-02-13 19:24 -------- d-----w- c:\program files\FranceTelecomUninstall
2010-02-13 19:24 . 2006-02-01 17:29 102784 ----a-w- c:\windows\system32\drivers\Gtm51Irp.sys
2010-02-13 19:24 . 2006-02-01 17:29 21760 ----a-w- c:\windows\system32\drivers\gtmserusb.sys
2010-02-13 19:24 . 2006-02-01 17:29 25472 ----a-w- c:\windows\system32\drivers\gtmmdmusb.sys
2010-02-13 19:24 . 2006-01-25 19:50 16000 ----a-w- c:\windows\system32\drivers\gtffbus.sys
2010-02-13 19:24 . 2006-01-25 19:50 8064 ----a-w- c:\windows\system32\drivers\gtptser.sys
2010-02-13 19:24 . 2005-12-22 20:30 5120 ----a-w- c:\windows\system32\drivers\GtVUsb.sys
2010-02-13 19:24 . 2005-12-09 18:41 19328 ----a-w- c:\windows\system32\drivers\gtscser.sys
2010-02-13 19:23 . 2010-02-14 11:45 -------- d-----w- c:\program files\OrangeBs
2010-02-13 19:23 . 2010-02-13 19:23 -------- d-----w- c:\program files\Option
2010-02-13 19:23 . 2010-02-13 19:23 -------- d-----w- c:\program files\Common Files\GtFlashSwitch
2010-02-13 15:33 . 2010-02-13 15:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2010-02-13 14:31 . 2010-02-13 14:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:32 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Temp
2010-02-13 14:26 . 2010-02-13 14:26 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:29 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2010-02-13 14:26 . 2010-02-13 14:28 -------- d-----w- c:\program files\Google
2010-02-13 14:26 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-13 14:26 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-13 14:25 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-13 14:25 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-13 14:25 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-13 14:25 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-13 14:25 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-13 14:25 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-13 14:25 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-13 14:25 . 2010-02-13 14:25 -------- d-----w- c:\program files\Alwil Software
2010-02-13 14:25 . 2010-02-13 14:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-13 14:12 . 2010-02-13 14:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-13 13:38 . 2010-02-14 11:51 22752 ----a-w- c:\documents and settings\Administrator\Application Data\ConMet\Konta\Administrator.cmd
2010-02-13 13:37 . 2010-02-14 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\ConMet
2010-02-13 13:37 . 2010-02-14 11:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\ConMet
2010-02-13 13:37 . 2010-02-13 13:37 -------- d-----w- c:\program files\ConMet
2010-02-13 13:30 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-01-23 15:45 . 2010-02-06 18:26 -------- d-sh--w- c:\documents and settings\Administrator\Phone Browser
2010-01-22 03:41 . 2010-01-22 03:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia Multimedia Player
2010-01-22 03:34 . 2004-08-04 04:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-01-22 03:34 . 2006-10-09 02:51 23856 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-22 03:32 . 2010-02-06 18:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite
2010-01-22 03:32 . 2010-01-22 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2010-01-22 03:32 . 2010-02-06 19:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia
2010-01-22 03:30 . 2008-04-29 06:09 49432760 ----a-r- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Nokia_PC_Suite_rel_6_86_9_4_EA.exe
2010-01-22 03:29 . 2010-01-22 03:29 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstCCD.exe
2010-01-22 03:29 . 2010-01-22 03:29 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-01-22 03:29 . 2010-01-22 03:29 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{5AFEABF5-7411-4C29-9FA9-71ABE880662D}\Installer\CommonCustomActions\UninstPCS.exe
2010-01-22 03:28 . 2010-01-22 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 03:34 . 2010-01-22 03:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2010-01-22 03:34 . 2010-01-22 03:34 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\Common Files\PCSuite
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\Common Files\Nokia
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\DIFX
2010-01-22 03:31 . 2010-01-22 03:31 -------- d-----w- c:\program files\PC Connectivity Solution
2010-01-11 17:42 . 2009-08-23 10:52 -------- d--h--w- c:\program files\InstallShield Installation Information
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="d:\nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="d:\nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-14 16010752]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"OBSWATCH"="c:\progra~1\OrangeBs\Watch.exe" [2005-09-07 20480]
"ConMet"="c:\program files\ConMet\ConMet.exe" [2010-02-13 3813376]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-04 99840]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [13.2.2010 9:26 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [13.2.2010 9:26 19024]
R2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [9.2.2007 13:48 176128]
R3 GTFFBUS;GT FF BUS;c:\windows\system32\drivers\gtffbus.sys [13.2.2010 14:24 16000]
R3 GTMMDMUSB;GT M 3G+ USB MDM;c:\windows\system32\drivers\gtmmdmusb.sys [13.2.2010 14:24 25472]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\drivers\Gtm51Irp.sys [13.2.2010 14:24 102784]
R3 GTMSERUSB;GT M 3G+ USB SER;c:\windows\system32\drivers\gtmserusb.sys [13.2.2010 14:24 21760]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13.2.2010 9:26 133104]
S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service;c:\windows\system32\drivers\GtVUsb.sys [13.2.2010 14:24 5120]
.
Contents of the 'Scheduled Tasks' folder

2010-02-14 c:\windows\Tasks\HP WEP.job
- c:\program files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 18:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-14 06:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3908)
c:\windows\system32\msi.dll
c:\program files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\ATKKBService.exe
c:\windows\System32\FTRTSVC.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
.
**************************************************************************
.
Completion time: 2010-02-14 06:54:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-14 11:54
ComboFix2.txt 2010-02-14 08:33

Pre-Run: 13 469 687 808 bytes free
Post-Run: 6 adresárov, 13 447 852 032 voľných bajtov

- - End Of File - - 51DB9CCEEFEED21C4E47F9904C37B1C3

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:08
od miruska88888
dúfam že to pomôže

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:08
od Unlimited_Killer
0K.

1) Malwarebytes' Anti-Malware
  • Stáhněte MbAM a postupujte podle popisu.
  • Zatím nic nemažte, MbAM má občas falešné detekce.
  • Poté mi sem vložte log ve formě textu.
2) Nový RSIT log

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:35
od miruska88888
Malwarebytes' Anti-Malware 1.44
Verze databáze: 3737
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14.2.2010 7:33:06
mbam-log-2010-02-14 (07-33-06).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 108727
Uplynulý čas: 5 minute(s), 59 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:36
od miruska88888
nový RSIT log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-02-14 07:35:46
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 13 GB (63%) free of 20 GB
Total RAM: 511 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:35:59, on 14.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ConMet\ConMet.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
D:\Nokia\Nokia PC Suite 6\PCSync2.exe
D:\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\OrangeBs\TaskBarIcon.exe
C:\Program Files\OrangeBs\BusinessEverywhere.exe
C:\Program Files\OrangeBs\ComComp.exe
C:\Program Files\OrangeBs\Watch.exe
C:\WINDOWS\System32\FTCOMM~1\FTCOMM~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [hpbdfawep] C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe 1
O4 - HKLM\..\Run: [OBSWATCH] C:\PROGRA~1\OrangeBs\Watch.exe
O4 - HKLM\..\Run: [ConMet] C:\Program Files\ConMet\ConMet.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Nokia.PCSync] "D:\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "D:\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EDD9947-FF95-4D7A-9B99-1B6CE6EB1C27}: NameServer = 213.151.200.31 213.151.208.162
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: GtFlashSwitch - OptionNV - C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5479 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\HP WEP.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-03-14 16010752]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-12 45056]
"hpbdfawep"=C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 954368]
"OBSWATCH"=C:\PROGRA~1\OrangeBs\Watch.exe [2005-09-07 20480]
"ConMet"=C:\Program Files\ConMet\ConMet.exe [2010-02-13 3813376]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-02-11 2756488]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-01-07 429392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"=D:\Nokia\Nokia PC Suite 6\PCSync2.exe [2008-03-26 1232896]
"PC Suite Tray"=D:\Nokia\Nokia PC Suite 6\PCSuite.exe [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-11 47104]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE"="C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-02-14 07:23:36 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2010-02-14 07:23:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-14 07:23:30 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-02-14 06:54:53 ----A---- C:\ComboFix.txt
2010-02-14 06:50:26 ----D---- C:\Program Files\xerox
2010-02-14 06:50:25 ----D---- C:\WINDOWS\system32\xircom
2010-02-14 06:50:25 ----D---- C:\Program Files\microsoft frontpage
2010-02-14 03:33:58 ----D---- C:\WINDOWS\temp
2010-02-14 03:28:22 ----A---- C:\WINDOWS\zip.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\SWSC.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\SWREG.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\sed.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\PEV.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\MBR.exe
2010-02-14 03:28:22 ----A---- C:\WINDOWS\grep.exe
2010-02-14 03:28:17 ----D---- C:\WINDOWS\ERDNT
2010-02-14 03:28:09 ----D---- C:\Qoobox
2010-02-13 18:26:15 ----D---- C:\WINDOWS\Minidump
2010-02-13 17:41:18 ----D---- C:\Program Files\trend micro
2010-02-13 17:41:16 ----D---- C:\rsit
2010-02-13 17:34:31 ----D---- C:\WINDOWS\system32\CatRoot_bak
2010-02-13 14:29:02 ----A---- C:\WINDOWS\ModemLog_GlobeTrotter Module 3G+ Modem.txt
2010-02-13 14:25:15 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-02-13 14:25:13 ----D---- C:\Program Files\Adobe
2010-02-13 14:25:08 ----D---- C:\WINDOWS\system32\FTCOMModule
2010-02-13 14:25:03 ----A---- C:\WINDOWS\system32\IfHelper.dll
2010-02-13 14:25:03 ----A---- C:\WINDOWS\system32\FTRTSVC.exe
2010-02-13 14:25:01 ----A---- C:\WINDOWS\system32\W32n50.dll
2010-02-13 14:24:47 ----D---- C:\Program Files\FranceTelecomUninstall
2010-02-13 14:23:50 ----D---- C:\Program Files\OrangeBs
2010-02-13 14:23:03 ----D---- C:\Program Files\Option
2010-02-13 14:23:03 ----D---- C:\Program Files\Common Files\GtFlashSwitch
2010-02-13 10:33:01 ----D---- C:\Documents and Settings\Administrator\Application Data\Help
2010-02-13 10:13:32 ----A---- C:\WINDOWS\IE4 Error Log.txt
2010-02-13 09:26:01 ----D---- C:\Program Files\Google
2010-02-13 09:25:44 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-02-13 09:25:39 ----D---- C:\Program Files\Alwil Software
2010-02-13 09:25:39 ----D---- C:\Documents and Settings\All Users\Application Data\Alwil Software
2010-02-13 09:12:03 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2010-02-13 09:12:02 ----D---- C:\Program Files\Common Files\Adobe
2010-02-13 08:37:52 ----D---- C:\Program Files\ConMet
2010-02-13 08:37:52 ----D---- C:\Documents and Settings\All Users\Application Data\ConMet
2010-02-13 08:37:52 ----D---- C:\Documents and Settings\Administrator\Application Data\ConMet
2010-02-13 08:30:28 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-02-13 08:30:28 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-02-13 08:30:22 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2010-02-13 08:30:21 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-02-13 08:30:21 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2010-02-13 08:30:21 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2010-01-21 22:41:53 ----D---- C:\Documents and Settings\Administrator\Application Data\Nokia Multimedia Player
2010-01-21 22:34:26 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-01-21 22:34:23 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-01-21 22:34:22 ----HDC---- C:\WINDOWS\$NtUninstallWdf01005$
2010-01-21 22:32:47 ----D---- C:\Documents and Settings\Administrator\Application Data\PC Suite
2010-01-21 22:32:45 ----D---- C:\Documents and Settings\All Users\Application Data\PC Suite
2010-01-21 22:32:21 ----D---- C:\Documents and Settings\Administrator\Application Data\Nokia
2010-01-21 22:31:55 ----D---- C:\Program Files\Common Files\PCSuite
2010-01-21 22:31:55 ----D---- C:\Program Files\Common Files\Nokia
2010-01-21 22:31:29 ----D---- C:\Program Files\DIFX
2010-01-21 22:31:22 ----D---- C:\Program Files\PC Connectivity Solution
2010-01-21 22:31:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\wdfcoinstaller01005.dll
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2010-01-21 22:31:15 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2010-01-21 22:28:51 ----D---- C:\Documents and Settings\All Users\Application Data\Installations

======List of files/folders modified in the last 1 months======

2010-02-14 07:35:35 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-14 07:35:35 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-14 07:35:32 ----HD---- C:\WINDOWS\inf
2010-02-14 07:23:36 ----D---- C:\WINDOWS\Prefetch
2010-02-14 07:23:32 ----D---- C:\WINDOWS\system32\drivers
2010-02-14 07:23:30 ----RD---- C:\Program Files
2010-02-14 07:01:14 ----SD---- C:\WINDOWS\Tasks
2010-02-14 06:51:31 ----D---- C:\WINDOWS
2010-02-14 06:50:49 ----A---- C:\WINDOWS\system.ini
2010-02-14 06:50:26 ----D---- C:\WINDOWS\system32\wbem
2010-02-14 06:50:26 ----D---- C:\WINDOWS\ime
2010-02-14 06:50:25 ----D---- C:\WINDOWS\system32
2010-02-14 06:47:54 ----D---- C:\WINDOWS\AppPatch
2010-02-14 06:47:51 ----D---- C:\Program Files\Common Files
2010-02-14 06:45:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-13 18:21:02 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-02-13 17:34:31 ----D---- C:\WINDOWS\Debug
2010-02-13 13:51:47 ----D---- C:\WINDOWS\system32\Restore
2010-02-13 10:06:16 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2010-02-13 09:32:18 ----SHD---- C:\WINDOWS\Installer
2010-02-13 09:25:54 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-13 08:52:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-13 08:30:31 ----D---- C:\WINDOWS\Help
2010-02-13 08:30:28 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-21 22:31:02 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-02-11 28880]
R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2005-10-18 11008]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-02-11 162512]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-02-11 46672]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-02-11 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-02-11 100432]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2007-02-18 62336]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-03-14 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-02-11 23376]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-11 1414656]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 GTFFBUS;GT FF BUS; C:\WINDOWS\system32\DRIVERS\gtffbus.sys [2006-01-25 16000]
R3 GTMMDMUSB;GT M 3G+ USB MDM; C:\WINDOWS\system32\DRIVERS\gtmmdmusb.sys [2006-02-01 25472]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS; C:\WINDOWS\system32\DRIVERS\Gtm51Irp.sys [2006-02-01 102784]
R3 GTMSERUSB;GT M 3G+ USB SER; C:\WINDOWS\system32\DRIVERS\gtmserusb.sys [2006-02-01 21760]
R3 GTPTSER;GT PT SER; C:\WINDOWS\system32\DRIVERS\gtptser.sys [2006-01-25 8064]
R3 GTSCSER;GT SC SER; C:\WINDOWS\system32\DRIVERS\gtscser.sys [2005-12-09 19328]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2007-02-18 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-03-16 4249088]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-03-14 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-07-29 34048]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-07-29 12928]
R3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-02-18 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-02-18 59264]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-02-18 17152]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service; C:\WINDOWS\system32\DRIVERS\GtVUsb.sys [2005-12-22 5120]
S3 mbr;mbr; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys []
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2005-01-19 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2007-11-29 16896]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2007-11-29 19328]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 8064]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbser;Nokia USB Serial Port; C:\WINDOWS\system32\DRIVERS\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 8064]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-11 393216]
R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2005-10-18 241152]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-06-10 40960]
R2 GtFlashSwitch;GtFlashSwitch; C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [2007-02-09 176128]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-29 572928]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-13 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2007-02-18 38912]
S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

-----------------EOF-----------------

Re: prosím o kontrolu logu s RSIT

Napsal: 14 úno 2010 13:38
od miruska88888
to bola fuska:)
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz