Prosim o kontrolu logu z PC mojej priatelky.

Zpráva

Lestatos · #1 Příspěvek od **Lestatos** » 09 čer 2010 11:38

PC sa mi zda trosku spomaleny a pri zapnuti viacerych aplikacii nestiha . Dakujem velmi pekne.

Logfile of random's system information tool 1.07 (written by random/random)
Run by user at 2010-06-09 12:35:16
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 24 GB (32%) free of 76 GB
Total RAM: 2814 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:35:48, on 9. 6. 2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\HControlUser.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\OBERON\SHARE\SYSTEM\OBERON Center.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Auto Keylogger\klkernel.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Opera\opera.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\user\Desktop\RSIT.exe
C:\Program Files\trend micro\user.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2086743
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O3 - Toolbar: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\ASUSTek\ASUSDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HControlUser] "C:\Program Files\ATK Hotkey\HcontrolUser.exe"
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OBERON Center] C:\OBERON\Share\System\OBERON Center.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WndMsg] C:\Program Files\Auto Keylogger\klkernel.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\RunServices: [WndMsg] C:\Program Files\Auto Keylogger\klkernel.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7282 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2008-06-11 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHP1.dll [2010-06-08 2515552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{dd02a4eb-4afd-4d60-99d8-e67f964ca813} - PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHP1.dll [2010-06-08 2515552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut"=C:\Program Files\ASUSTek\ASUSDVD\Language\Language.exe [2008-12-19 62760]
"HControlUser"=C:\Program Files\ATK Hotkey\HcontrolUser.exe [2008-01-12 98304]
"ATKOSD2"=C:\Program Files\ATKOSD2\ATKOSD2.exe [2008-01-24 7766016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-07-25 13548064]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-07-25 92704]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-08-12 6265376]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-08-17 102400]
"ASUS Screen Saver Protector"=C:\Windows\AsScrPro.exe [2009-02-24 3054136]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-12 39792]
"OBERON Center"=C:\OBERON\Share\System\OBERON Center.exe [2009-07-19 344064]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-14 644696]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2007-04-03 1603152]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"WndMsg"=C:\Program Files\Auto Keylogger\klkernel.exe [2003-12-09 202627]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"P2Go_Menu"=C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-06-14 210216]
"CLMLServer"=C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [2008-07-19 104936]
"ASUS Camera ScreenSaver"=C:\Windows\AsScrProlog.exe [2009-02-24 47672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"Skytel"=C:\Windows\Skytel.exe [2008-08-12 1833504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-07-16 25604904]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe [2008-12-12 87336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Agent zálohovania.lnk]
C:\OBERON\Backup\backup.exe [2006-09-29 86016]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"DisableStatusMessages"=0
"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26ac80fa-03fe-11df-9f1b-0023545e9ebd}]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc30b86-2ac0-11de-99c2-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc30b88-2ac0-11de-99c2-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5044a749-2de9-11de-a3c5-806e6f6e6963}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{616a719b-8f9e-11de-9005-0023545e9ebd}]
shell\AutoRun\command - F:\c2e.exe
shell\open\command - F:\c2e.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7434f8d4-31f1-11df-a6c6-0023545e9ebd}]
shell\AutoRun\command - H:\NAUMI///radil.exe
shell\open\command - H:\NAUMI///radil.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e37233c-27a2-11df-87cd-0023545e9ebd}]
shell\AutoRun\command - H:\fk.exe
shell\open\command - H:\fk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a59b625f-2ab0-11de-bfdd-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a59b6284-2ab0-11de-bfdd-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca9a54cb-3097-11de-9ac2-0023545e9ebd}]
shell\AutoRun\command - hyetn1i.exe
shell\open\command - hyetn1i.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e33f3875-735f-11de-b077-0023545e9ebd}]
shell\AutoRun\command - H:\p3vwxx.exe
shell\open\command - H:\p3vwxx.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa61381a-3a55-11de-a2fe-0023545e9ebd}]
shell\AutoRun\command - F:\AutoRun.exe

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-06-05 22:20:10 ----D---- C:\Program Files\QS
2010-06-05 22:20:07 ----D---- C:\Users\user\AppData\Roaming\TeamViewer
2010-05-26 09:53:21 ----A---- C:\Windows\system32\tzres.dll
2010-05-12 09:34:55 ----A---- C:\Windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 months======

2010-06-09 12:35:48 ----D---- C:\Program Files\trend micro
2010-06-09 12:35:28 ----D---- C:\Windows\Prefetch
2010-06-09 12:35:19 ----D---- C:\Windows\temp
2010-06-09 12:35:00 ----D---- C:\Users\user\AppData\Roaming\Skype
2010-06-09 12:32:59 ----D---- C:\OBERON
2010-06-09 11:43:13 ----D---- C:\Windows\System32
2010-06-09 11:43:13 ----D---- C:\Windows\inf
2010-06-09 11:43:13 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-06-09 07:36:30 ----SHD---- C:\System Volume Information
2010-06-08 11:45:48 ----D---- C:\Program Files\PHPNukeEN
2010-06-08 08:48:16 ----D---- C:\Windows\system32\spool
2010-06-05 22:20:10 ----RD---- C:\Program Files
2010-06-05 22:05:53 ----D---- C:\Users\user\AppData\Roaming\dvdcss
2010-05-28 10:41:17 ----D---- C:\Windows\rescache
2010-05-28 10:30:39 ----D---- C:\Windows\winsxs
2010-05-28 10:30:38 ----D---- C:\Windows\system32\sk-SK
2010-05-26 09:52:39 ----D---- C:\Windows\system32\catroot2
2010-05-26 09:52:39 ----D---- C:\Windows\system32\catroot
2010-05-13 09:29:20 ----SHD---- C:\Windows\Installer
2010-05-13 09:27:04 ----D---- C:\Program Files\Windows Mail
2010-05-12 11:21:16 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-02-05 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-02-05 51376]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-04-06 908800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
R3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-08-12 2159384]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2008-06-03 15928]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-07-08 1050656]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2010-03-04 51232]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-25 7547552]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2008-07-22 15872]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2008-04-01 1807744]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-08-17 190512]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
S3 CRFILTER;USB Mass Storage Filter; C:\Windows\system32\DRIVERS\CRFILTER.sys [2008-04-07 6656]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2008-03-17 101632]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-10-03 94208]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-25 196608]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 09 čer 2010 11:43

Zdravim a pekne odpoledne preji,

ze ty pritelkyne si neumi dat do kopy PC samy, resp. pozadat o pomoc samotne - jste jiz nekolikaty uzivatel co dava log za pritelkyni, ale v pohode, nic se nedeje - i ja to tak delam s moji

Kouknem na to...

Doporucuji odinstalovat (pokud nepouzivate) toolbary (listy prohlizecu) v Přidat nebo odebrat programy

Tohle tam mate umyslne spustene C:\Program Files\Auto Keylogger\klkernel.exe

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

Stahnete OTL (viz muj podpis) a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Zaskrtnete okenko Pro vsechny uzivatele
Zaskrtnete okenko Kontrola na havet "LOP"
Zaskrtnete okenko Kontrola na havet "Purity"
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

Kliknete na tlacitko Prohledat
Po dokonceni skenu (cca 5min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

Lestatos · #3 Příspěvek od **Lestatos** » 11 čer 2010 06:11

Keyloger mame umyselne koli detom. vkladam logy.

############################## | UsbFix 7.008 | [Deletion]

User: user (Administrator) # USER-PC [ASUSTeK Computer Inc. F5GL]
Updated 10/06/10 by El Desaparecido / C_XX
Started at 07:06:00 | 11/06/2010
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Genuine Intel(R) CPU T1600 @ 1.66GHz
CPU 2: Genuine Intel(R) CPU T1600 @ 1.66GHz
Microsoft® Windows Vista™ Home Basic (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18928

Windows Firewall: Enabled

RAM -> 2814 Mb
C:\ (%systemdrive%) -> Fixed drive # 75 Gb (23 Mb free - 31%) [VistaOS] # NTFS
D:\ -> Fixed drive # 65 Gb (41 Mb free - 63%) [DATA] # NTFS
E:\ -> CD-ROM

################## | Files # Infected Folders |

Deleted ! C:\Users\user\dopdf.exe
Deleted ! C:\Users\user\PokerStarsInstall.exe
Deleted ! C:\Users\user\wlsetup-custom.exe
Deleted ! C:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-1000
Deleted ! D:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-1000
Deleted ! D:\$Recycle.Bin\S-1-5-21-42084804-1979057341-236238764-500

################## | Registry |

Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
Deleted ! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig
Deleted ! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableSR

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\F
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\H
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{26ac80fa-03fe-11df-9f1b-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{3cc30b86-2ac0-11de-99c2-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{5044a749-2de9-11de-a3c5-806e6f6e6963}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{7434f8d4-31f1-11df-a6c6-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{7e37233c-27a2-11df-87cd-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{a59b625f-2ab0-11de-bfdd-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{ca9a54cb-3097-11de-9ac2-0023545e9ebd}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{fa61381a-3a55-11de-a2fe-0023545e9ebd}

################## | Listing |

[11/06/2010 - 07:07:59 | SHD ] C:\$RECYCLE.BIN
[15/11/2009 - 20:56:46 | D ] C:\32788R22FWJFW
[04/04/2007 - 21:50:44 | A | 19] C:\AK21.txt
[06/10/2008 - 05:46:41 | A | 21] C:\app3.LOG
[24/02/2009 - 05:52:17 | D ] C:\ASUS.SYS
[18/09/2006 - 23:43:36 | A | 24] C:\autoexec.bat
[12/04/2010 - 16:52:19 | SHD ] C:\Boot
[11/04/2009 - 08:36:36 | RASH | 333257] C:\bootmgr
[17/04/2008 - 08:20:25 | RAS | 8192] C:\BOOTSECT.BAK
[15/11/2009 - 20:56:45 | A | 1150] C:\Bug.txt
[04/03/2010 - 12:00:38 | A | 2] C:\CheckerLog.log
[15/11/2009 - 07:40:29 | D ] C:\ComboFix
[18/09/2006 - 23:43:37 | A | 10] C:\config.sys
[24/02/2009 - 06:05:19 | A | 19497] C:\devlist.txt
[02/11/2006 - 14:59:44 | SHD ] C:\Documents and Settings
[17/01/2009 - 04:19:43 | A | 61] C:\DVD.LOG
[08/09/2008 - 04:34:43 | RAH | 1048576] C:\F5GL.BIN
[09/09/2008 - 10:47:57 | A | 13] C:\F5GL_VISTA.10
[24/02/2009 - 06:05:14 | A | 9] C:\Finish.log
[11/06/2010 - 06:51:38 | ASH | 2951946240] C:\hiberfil.sys
[24/02/2009 - 05:07:54 | A | 481] C:\igoogle_log.txt
[04/03/2010 - 17:11:27 | D ] C:\instal
[01/10/2009 - 11:38:04 | D ] C:\lj1010seriesprintsys
[08/08/2008 - 09:22:19 | A | 30] C:\NERO.LOG
[07/01/2009 - 11:16:08 | A | 30] C:\NIS2009.TXT
[11/06/2010 - 06:53:04 | D ] C:\OBERON
[16/03/2007 - 01:18:45 | A | 25] C:\OFFICE2007_L.TXT
[11/06/2010 - 06:51:36 | ASH | 3265728512] C:\pagefile.sys
[23/02/2009 - 15:01:56 | A | 105] C:\Pass.txt
[30/12/2008 - 03:35:33 | A | 3054] C:\Patch.LOG
[21/01/2008 - 04:43:50 | D ] C:\PerfLogs
[11/06/2010 - 06:54:44 | RD ] C:\Program Files
[11/06/2010 - 07:00:45 | HD ] C:\ProgramData
[15/11/2009 - 07:17:39 | D ] C:\Qoobox
[29/04/2008 - 16:30:34 | A | 20] C:\READER_K.TXT
[09/09/2008 - 10:47:57 | A | 6] C:\RECOVERY.DAT
[24/02/2009 - 05:40:54 | A | 780] C:\RHDSetup.log
[14/11/2009 - 11:39:17 | D ] C:\rsit
[24/02/2009 - 05:54:50 | A | 163] C:\setup.log
[16/05/2006 - 02:22:24 | A | 5] C:\store.log
[24/02/2009 - 04:10:32 | A | 166] C:\SumHidd.txt
[24/02/2009 - 04:09:49 | A | 98] C:\SumOS.txt
[11/06/2010 - 07:02:35 | SHD ] C:\System Volume Information
[11/06/2010 - 07:07:59 | D ] C:\UsbFix
[11/06/2010 - 07:08:02 | A | 4501] C:\UsbFix.txt
[16/04/2009 - 20:02:40 | RD ] C:\Users
[21/10/2008 - 05:19:48 | A | 21] C:\V553.txt
[11/06/2010 - 06:50:34 | D ] C:\Windows
[16/04/2009 - 15:52:05 | D ] C:\ZALOHY
[11/06/2010 - 07:07:59 | D ] D:\$RECYCLE.BIN
[20/08/2009 - 22:33:24 | D ] D:\3e5be2c22b72fb82f1830af91aab48
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1028.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1031.txt
[07/11/2007 - 08:00:40 | A | 10134] D:\eula.1033.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1036.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1040.txt
[07/11/2007 - 08:00:40 | A | 118] D:\eula.1041.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.1042.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.2052.txt
[07/11/2007 - 08:00:40 | A | 17734] D:\eula.3082.txt
[29/01/2010 - 19:16:57 | D ] D:\Filmy
[07/11/2007 - 08:00:40 | A | 1110] D:\globdata.ini
[07/11/2007 - 08:00:40 | A | 843] D:\install.ini
[07/11/2007 - 08:03:18 | A | 76304] D:\install.res.1028.dll
[07/11/2007 - 08:03:18 | A | 96272] D:\install.res.1031.dll
[07/11/2007 - 08:03:18 | A | 91152] D:\install.res.1033.dll
[07/11/2007 - 08:03:18 | A | 97296] D:\install.res.1036.dll
[07/11/2007 - 08:03:18 | A | 95248] D:\install.res.1040.dll
[07/11/2007 - 08:03:18 | A | 81424] D:\install.res.1041.dll
[07/11/2007 - 08:03:18 | A | 79888] D:\install.res.1042.dll
[07/11/2007 - 08:03:18 | A | 75792] D:\install.res.2052.dll
[07/11/2007 - 08:03:18 | A | 96272] D:\install.res.3082.dll
[30/11/2009 - 13:26:11 | A | 2379099] D:\installer_zoner_photo_studio_11_0_1_9_English.exe
[18/07/2009 - 07:12:43 | SHD ] D:\System Volume Information
[07/11/2007 - 08:00:40 | A | 5686] D:\vcredist.bmp
[07/11/2007 - 08:09:22 | A | 1442522] D:\VC_RED.cab
[07/11/2007 - 08:12:28 | A | 232960] D:\VC_RED.MSI

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_USER-PC.zip
http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution.

################## | E.O.F |

#4 Příspěvek od **vyosek** » 11 čer 2010 06:25

Dobre rano,
mel jste tam zapojene flash disky pri aplikaci USBFixu

Dle logu to vypada ze ne. Pokud tam nebyli, zapojte je a spustte USBFix znovu dle navodu vyse...

Pak Vas poprosim o log z OTL - navod opet vyse

Lestatos · #5 Příspěvek od **Lestatos** » 11 čer 2010 07:28

na tomto NB ziaden flashdisk nepouzivame . Dakujem

#6 Příspěvek od **vyosek** » 11 čer 2010 14:34

Co potom tedy jsou disky F,H,I

virtualni mechaniky napr.Deamonu

Vlozte log z OTL - navod vizte vyse

#7 Příspěvek od **vyosek** » 14 čer 2010 16:42

Co se deje, ze se tu nic nedeje

VIRY.CZ

Prosim o kontrolu logu z PC mojej priatelky.

Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.

Re: Prosim o kontrolu logu z PC mojej priatelky.