Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log POMOC!

Zpráva

Yurda · #31 Příspěvek od **Yurda** » 15 lis 2010 18:07

myslim ze by to melo by toto ale nejsem si jisty daval jsem to vyhledat podle datumu uz je tu tech logu prilis moc

. Spoustel jsem to kdyztak pouze v nouzovem rezimu ne v nouzovem rezimu s praci v siti nevadi to ? Budu tu kdyztak max po 20 hodine musim jit tedka neco zaridit !

ComboFix 10-11-14.01 - Zbyněk Juroš 15.11.2010 18:00:57.5.2 - x86 MINIMAL
Spuštěný z: C:\Documents and Settings\Zbyněk Juroš\Plocha\Beruska.com.exe
Použité ovládací přepínače :: C:\Documents and Settings\Zbyněk Juroš\Plocha\CFScript.txt

file zipped: c:\documents and settings\Zbyněk Juroš\Data aplikací\Microsoft\Windows\shell.exe
file zipped: c:\documents and settings\Zbyněk Juroš\Data aplikací\sdghzxfg.bat
.

#32 Příspěvek od **vyosek** » 15 lis 2010 18:08

Log neni cely, vic tam toho nemate

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

Provedte aktualizaci - treti zalozka
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Yurda · #33 Příspěvek od **Yurda** » 15 lis 2010 20:23

#34 Příspěvek od **vyosek** » 15 lis 2010 20:26

Nooo neni

Vubec netusim odkud muze byt

Pockam co najde MBAM

Yurda · #35 Příspěvek od **Yurda** » 15 lis 2010 20:55

sken uz bezi nako dlouho ale takze nemam davat nic mazat a ani davat restartovat pocitac ? koukam na ten navod ale tohle mi neni jasne jestli mam potom akceptovat teda ten restart kdyz nemam nic mazat...

#36 Příspěvek od **vyosek** » 15 lis 2010 21:00

Pokud MBAM stale skenuje a neni seknuty, tak jej nechte

Date Zobrazit vysledky a pote Ulozit protokol - ten mi sem nakopirujete

Restart byste provadel az byste oznacil co mazat - zatim neoznacujte nic a nechte to na posouzeni...

Yurda · #37 Příspěvek od **Yurda** » 15 lis 2010 22:15

mam to tu ! pockam tedy na vase posouzeni

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 5121

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

15.11.2010 22:07:48
mbam-log-2010-11-15 (22-07-48).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 288727
Uplynulý čas: 1 hodina(y), 16 minuta(y), 9 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 4
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 10

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\C8H1KKCTZV (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\U36VRSFLG6 (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Qoobox\Quarantine\C\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\svchost.exe.vir (Backdoor.Cycbot) -> No action taken.
C:\System Volume Information\_restore{2CDF5B0B-6029-4417-9A96-DC1702CFB9A2}\RP15\A0010423.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{2CDF5B0B-6029-4417-9A96-DC1702CFB9A2}\RP15\A0010425.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{2CDF5B0B-6029-4417-9A96-DC1702CFB9A2}\RP15\A0010437.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{2CDF5B0B-6029-4417-9A96-DC1702CFB9A2}\RP15\A0010438.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{2CDF5B0B-6029-4417-9A96-DC1702CFB9A2}\RP18\A0017867.exe (Backdoor.Cycbot) -> No action taken.
C:\Documents and Settings\Zbyněk Juroš\Data aplikací\data.dat (Stolen.Data) -> No action taken.
C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\stor.cfg (Malware.Trace) -> No action taken.
C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\Windows\shell.exe (Trojan.Shell) -> No action taken.
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> No action taken.

#38 Příspěvek od **vyosek** » 15 lis 2010 22:16

Vse co nasel MBAM smazte

Jak se chova PC

Yurda · #39 Příspěvek od **Yurda** » 15 lis 2010 22:30

PC vypada v poradku

zatim

#40 Příspěvek od **vyosek** » 15 lis 2010 22:32

T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u google toolbaru
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Dejte novy log z RSIT

Yurda · #41 Příspěvek od **Yurda** » 16 lis 2010 00:27

tak vsechno hotove akorat jen u OTC to ta ocista probehla behem asi 1 sekundy tak se mi to zdalo nejake divne ale asi to tak melo byt a u TFC se mi po dokonceni akorat nespustil automaticky restart tak jsem to dal ructe jinak vsechno ok a zde mate log :

Logfile of random's system information tool 1.08 (written by random/random)
Run by Zbyněk Juroš at 2010-11-16 00:37:45
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 4 GB (3%) free of 111 GB
Total RAM: 1279 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:37:50, on 16.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\WINDOWS\system32\WF2K.EXE
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Zbyněk Juroš\Plocha\RSIT.exe
C:\Program Files\trend micro\Zbyněk Juroš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe C:\WINDOWS\system32\wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [combofix] C:\Beruska.com24657B\CF11386.cfxxe /c C:\Beruska.com24657B\Combobatch.bat
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 2848337609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2848321843
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B397110-D1A9-40F4-9A33-88F97738CF03}: NameServer = 195.146.100.105,195.146.100.100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Aktivace aplikace ABBYY PDF Transformer 3.0 – Licenční služba (ABBYY.Licensing.PDFTransformer.Classic.3.0) - ABBYY - C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
O23 - Service: avast! Firewall - Unknown owner - C:\Program Files\Alwil Software\Avast5\afwServ.exe (file missing)
O23 - Service: Služba Google Update (gupdate1c9f8e0db4527b8) (gupdate1c9f8e0db4527b8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 9307 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-05-11 50376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-03-03 149968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-09-15 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} -
{855F3B16-6D32-4fe6-8A56-BBB695989046}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
"IMONTRAY"=C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe [2003-01-10 32768]
"FastTVSync"=C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe [2003-06-04 241664]
"WinFoxV2"=C:\WINDOWS\system32\WF2K.EXE [2009-03-30 1490944]
"WinFast2KLoadDefault"=C:\WINDOWS\system32\wf2kcpl.dll [2009-03-30 668672]
"SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-12 106496]
"vmware-tray"=C:\Program Files\VMware\VMware Workstation\vmware-tray.exe [2008-10-28 96816]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-07-09 110696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-07-09 13923432]
"combofix"=C:\Beruska.com24657B\CF11386.cfxxe [2010-11-15 390144]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
InterVideo Scheduler server.lnk - C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
REALTEK RTL8187 Wireless LAN Utility.lnk - C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe

C:\Documents and Settings\Zbyněk Juroš\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"LegalNoticeText"=
"LegalNoticeCaption"=
"SynchronousMachineGroupPolicy"=0
"SynchronousUserGroupPolicy"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSMBalloonTip"=1
"NoDriveTypeAutoRun"=323
"MemCheckBoxInRunDlg"=0
"NoAutoTrayNotify"=0
"NoResolveTrack"=0
"NoResolveSearch"=1
"NoWelcomeScreen"=1
"NoRecentDocsNetHood"=1
"NoDesktopCleanupWizard"=1
"NoSharedDocuments"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoStrCmpLogical"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe"="C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe:*:Enabled:RtWlan"
"C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"="C:\Program Files\VMware\VMware Workstation\vmware-authd.exe:*:Enabled:VMware Authd"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Steam\steamapps\onndra\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\onndra\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"

======List of files/folders created in the last 1 months======

2010-11-16 00:37:45 ----D---- C:\rsit
2010-11-16 00:37:45 ----D---- C:\Program Files\trend micro
2010-11-15 20:43:44 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Malwarebytes
2010-11-15 20:39:10 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-11-15 20:39:09 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-11-15 20:39:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-11-15 20:39:09 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-11-15 18:06:57 ----D---- C:\WINDOWS\temp
2010-11-15 17:58:00 ----SD---- C:\Beruska.com24657B
2010-11-15 14:52:32 ----A---- C:\WINDOWS\rafazon.bat
2010-11-15 14:52:31 ----AD---- C:\rafazon
2010-11-15 14:40:40 ----D---- C:\Beruska.com
2010-11-14 18:36:09 ----SHD---- C:\WINDOWS\CSC
2010-11-14 17:51:45 ----A---- C:\Boot.bak
2010-11-14 17:51:38 ----RASHD---- C:\cmdcons
2010-11-14 17:47:53 ----D---- C:\Qoobox
2010-11-13 17:29:08 ----D---- C:\50cfb7d96da3dae3d7
2010-11-13 16:37:55 ----A---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\sdghzxfg.bat
2010-11-04 23:52:01 ----A---- C:\WINDOWS\system32\javaws.exe
2010-11-04 23:52:01 ----A---- C:\WINDOWS\system32\javaw.exe
2010-11-04 23:52:01 ----A---- C:\WINDOWS\system32\java.exe
2010-11-04 22:24:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2010-11-04 22:23:25 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\ICQ
2010-11-04 22:23:01 ----D---- C:\Program Files\ICQ6.5
2010-11-04 22:19:10 ----D---- C:\Program Files\ICQToolbar
2010-11-03 23:38:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2010-11-03 14:32:39 ----A---- C:\WINDOWS\system32\drivers\aswFW.sys
2010-11-03 14:32:09 ----A---- C:\WINDOWS\system32\drivers\aswNdis2.sys
2010-11-03 14:31:48 ----D---- C:\Program Files\Alwil Software
2010-11-03 14:31:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-11-03 02:04:49 ----D---- C:\Program Files\CCleaner
2010-10-25 23:22:24 ----D---- C:\Documents and Settings\All Users\Data aplikací\Macromedia
2010-10-25 23:21:48 ----D---- C:\Program Files\Macromedia
2010-10-25 23:21:48 ----D---- C:\Program Files\Common Files\Macromedia
2010-10-25 23:19:25 ----A---- C:\WINDOWS\unlite3.exe
2010-10-25 23:19:24 ----D---- C:\Program Files\Bradbury

======List of files/folders modified in the last 1 months======

2010-11-16 00:37:45 ----RD---- C:\Program Files
2010-11-16 00:35:56 ----SHD---- C:\WINDOWS\Installer
2010-11-16 00:35:36 ----SD---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft
2010-11-16 00:35:36 ----D---- C:\WINDOWS\system32
2010-11-16 00:35:36 ----D---- C:\Program Files\ICQ FORCE
2010-11-16 00:34:50 ----D---- C:\Program Files\BitLord
2010-11-16 00:32:25 ----D---- C:\WINDOWS
2010-11-16 00:31:40 ----D---- C:\WINDOWS\Debug
2010-11-16 00:07:56 ----D---- C:\WINDOWS\Prefetch
2010-11-15 23:49:58 ----D---- C:\Documents and Settings\All Users\Data aplikací\VMware
2010-11-15 23:49:49 ----A---- C:\WINDOWS\RTacDbg.txt
2010-11-15 23:48:47 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-11-15 23:41:48 ----SHD---- C:\System Volume Information
2010-11-15 23:41:48 ----D---- C:\WINDOWS\system32\Restore
2010-11-15 23:41:37 ----D---- C:\Program Files\Steam
2010-11-15 22:39:56 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-11-15 22:39:56 ----D---- C:\WINDOWS\system32\drivers
2010-11-15 18:08:03 ----D---- C:\WINDOWS\system32\config
2010-11-15 18:06:59 ----D---- C:\WINDOWS\system32\drivers\etc
2010-11-15 18:05:04 ----D---- C:\WINDOWS\AppPatch
2010-11-15 18:05:01 ----D---- C:\Program Files\Common Files
2010-11-15 18:00:21 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-15 17:52:14 ----SHD---- C:\RECYCLER
2010-11-15 17:25:33 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\ChessBase
2010-11-15 14:47:56 ----A---- C:\WINDOWS\system.ini
2010-11-15 00:08:54 ----SD---- C:\WINDOWS\Tasks
2010-11-14 21:42:32 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-11-14 20:23:40 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Skype
2010-11-14 17:51:46 ----RASH---- C:\boot.ini
2010-11-14 12:38:37 ----D---- C:\Documents and Settings
2010-11-14 00:31:33 ----HD---- C:\WINDOWS\inf
2010-11-13 23:18:03 ----D---- C:\WINDOWS\system32\CatRoot
2010-11-13 23:15:34 ----D---- C:\WINDOWS\WinSxS
2010-11-13 21:09:41 ----AC---- C:\WINDOWS\wincmd.ini
2010-11-13 20:56:39 ----AC---- C:\WINDOWS\wcx_ftp.ini
2010-11-13 20:42:34 ----D---- C:\Program Files\Google
2010-11-10 14:19:01 ----D---- C:\WINDOWS\system32\Com
2010-11-06 16:26:21 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\uTorrent
2010-11-05 16:38:41 ----D---- C:\Program Files\mIRC
2010-11-04 23:51:59 ----D---- C:\Program Files\Java
2010-11-04 22:27:56 ----HD---- C:\Program Files\InstallShield Installation Information
2010-11-04 20:15:59 ----D---- C:\WINDOWS\system32\inetsrv
2010-11-03 02:11:14 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Media Player Classic
2010-11-03 02:09:50 ----D---- C:\WINDOWS\Minidump
2010-11-02 20:53:44 ----D---- C:\Program Files\Mozilla Firefox
2010-10-31 13:21:40 ----SD---- C:\Program Files\HLSW
2010-10-31 06:22:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-30 07:45:52 ----D---- C:\Program Files\Microsoft Silverlight
2010-10-29 20:39:07 ----D---- C:\Documents and Settings\Zbyněk Juroš\Data aplikací\dvdcss
2010-10-25 23:21:08 ----D---- C:\WINDOWS\Downloaded Installations
2010-10-23 13:14:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-10-20 19:13:44 ----AC---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
R0 aswNdis2;avast! Firewall Core Firewall Service; C:\WINDOWS\system32\drivers\aswNdis2.sys [2010-09-07 190416]
R0 d347bus;d347bus; C:\WINDOWS\system32\DRIVERS\d347bus.sys [2004-08-22 155136]
R0 d347prt;d347prt; C:\WINDOWS\System32\Drivers\d347prt.sys [2004-08-22 5248]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-11-09 691696]
R1 aswFW;avast! TDI Firewall driver; C:\WINDOWS\system32\drivers\aswFW.sys [2010-09-07 99792]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2003-05-09 33248]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2010-05-26 21361]
R2 cdenable;cdenable; C:\WINDOWS\System32\Drivers\cdenable.sys [1999-06-10 6112]
R2 hcmon;VMware hcmon; \??\C:\WINDOWS\system32\drivers\hcmon.sys []
R2 iSMBIOS;iSMBIOS; \??\C:\WINDOWS\system32\drivers\iSMBIOS.SYS []
R2 SIODRV;SIODRV; \??\C:\WINDOWS\system32\drivers\SIODRV.SYS []
R2 vmci;VMware vmci; \??\C:\WINDOWS\system32\Drivers\vmci.sys []
R2 VMnetBridge;VMware Bridge Protocol; C:\WINDOWS\system32\DRIVERS\vmnetbridge.sys [2008-10-28 31280]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys []
R2 VMparport;VMware VMparport; \??\C:\WINDOWS\system32\Drivers\VMparport.sys []
R2 vmx86;VMware vmx86; \??\C:\WINDOWS\system32\Drivers\vmx86.sys []
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys []
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-14 100224]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-07-09 10604128]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-09-27 9856]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 SMBios;Intel (R) System Management BIOS Service; C:\WINDOWS\system32\DRIVERS\SMBios.sys [2003-10-14 36484]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vmkbd2;VMware kbd2; \??\C:\WINDOWS\system32\drivers\VMkbd.sys []
R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\vmnetadapter.sys [2008-10-28 16560]
R3 WFsys;WinFox Control I/O Driver; C:\WINDOWS\system32\DRIVERS\wfsys.sys [2002-04-22 13692]
R4 WINFOXIO;WINFOXIO; \??\C:\WINDOWS\system32\Drivers\WINFOXIO.SYS []
S3 AMDPCI;AMDPCI; \??\C:\DOCUME~1\ZBYNKJ~1\LOCALS~1\Temp\AMDPCI.sys []
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2003-03-04 145408]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\ZBYNKJ~1\LOCALS~1\Temp\ECV7.tmp []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-06-05 25280]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 npf;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2010-01-27 50704]
S3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.23\RivaTuner32.sys []
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter; C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2008-06-27 332928]
S3 smbusp;Intel(R) SMBus 2.0 Driver; C:\WINDOWS\system32\DRIVERS\smb.sys [2002-10-23 21963]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Via4in1;Via4in1; \??\D:\DATA\fscommand\Via4in1.sys []
S3 vmusb;VMware USB Client Driver; C:\WINDOWS\System32\Drivers\vmusb.sys [2008-10-28 31280]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0;Aktivace aplikace ABBYY PDF Transformer 3.0 – Licenční služba; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2009-05-14 759048]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-15 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-07-09 155752]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-03-30 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-10-24 215104]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files\VMware\VMware Workstation\vmware-authd.exe [2008-10-28 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2008-10-28 326192]
R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [2008-10-28 399920]
S2 avast! Firewall;avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe []
S2 gupdate1c9f8e0db4527b8;Služba Google Update (gupdate1c9f8e0db4527b8); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-29 133104]
S2 imonNT;Intel(R) Active Monitor; C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe [2003-01-10 102400]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe [2002-12-17 7520337]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE [2002-12-17 311872]
S3 ufad-ws60;VMware Agent Service; C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe [2008-10-02 191024]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

Yurda · #42 Příspěvek od **Yurda** » 16 lis 2010 00:32

jo a jeste jedna vec dost obcas se mi spoustel a i dneska se mi spoustil wauclt.exe je to myslim neco pro windows update jenze ten mam vypnuty a pokazdy kdyz se spustil tak spolecne s jednim svchost.exe zrali dohromady pres 200 000 kB ten svchost.exe uz je v poradku zere tolik kolik by mel ale ten wauclt.exe se porad spousti ale uz nezere pres 100 000kB ale jen treba do 10 000kB ale porad se spousti :/ nedalo by se to nak ošéfovat ?

#43 Příspěvek od **vyosek** » 16 lis 2010 06:52

Z jakeho duvodu chcete mit zakazane aktualizace windows

Je treba mit aktualni winy

Yurda · #44 Příspěvek od **Yurda** » 16 lis 2010 10:00

windowsy moc neauktualizuju... Drive naky roky jsem to delal ale byla to vzdycky jen na obtíž... Jak to jinak vypada ?

#45 Příspěvek od **vyosek** » 16 lis 2010 11:06

Aktualizovane Windows, avntivir a firewall jsou zakladem bezpecnosti PC halvne taky rozum = neklikat na kdejakou blbinu, nenavstevovat temna zakouni webu (warez, porno apod.) - nejjednodussi je nechat zaple automaticke aktualizace a winy se aktualizuji samostatne a Vas neobtezuji

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

Vyskoci na Vas okenko, do ktereho zkopirujte text nize
Kód: Vybrat vše
```
services.msc
```
Kliknete na OK
Najdete sluzby nize
Služba Google Update
Java Quick Starter
U sluzby provedte toto
- Klik na ni pravym mysidlem a zvolit Vlastnosti
- Nyní klik na Zastavit
- Typ spousteni nastavit na Zakazano
- Potvrdte kliknutim na OK

Otevrete si poznamkovy blok

Start->spustit->notepad
Vlozte text nize

Kód: Vybrat vše

@ECHO OFF
rmdir C:\Beruska.com24657B
del "C:\Documents and Settings\Zbyněk Juroš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll"
rmdir C:\Beruska.com
del "C:\Documents and Settings\Zbyněk Juroš\Data aplikací\sdghzxfg.bat"
sc stop AMDPCI
sc delete AMDPCI

Soubor ulozte jako del.bat
Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
Zavrit notepad a spustit dvojklikem del.bat
Pripadny dotaz na zmenu registru potvrdte
Okno jen problikne a provede mazani - soubor muzete smazat

Otevrete si poznamkovy blok

Start->spustit->notepad
Vlozte text nize

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[HKCU\Software\Microsoft\Internet Explorer\SearchURL]
"(Default)"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKLM\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"=-
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"combofix"=-

Soubor ulozte jako oprava.reg
Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
Zavrit notepad a spustit dvojklikem oprava.reg
Pripadny dotaz na zmenu registru potvrdte
Okno jen problikne a opravi regsitry - soubor muzete smazat

Jinak log vypada v poradku

VIRY.CZ

Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log POMOC!

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO

Re: Win32:Bamital-AM ; Win32:Rootkit-gen [rtk] + Rsit log PO