Trojsky kun

[skylarinho]

Dobrý večer, prosím o kontrolu.
laptop se zapíná mnohem déle než obvykle, po kontrole antivirem antivir našel trojského koně a "odstranil" jej.. po restartu je počítač stále pomalý.

děkuji

Logfile of random's system information tool 1.08 (written by random/random)
Run by Markuska at 2010-09-30 23:20:59
Microsoft Windows 7 Ultimate
System drive C: has 94 GB (63%) free of 148 GB
Total RAM: 2038 MB (42% free)




======Scheduled tasks folder======


C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2104895378-3808249359-3690982508-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2104895378-3808249359-3690982508-1000UA.job


======Registry dump======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\Markuska\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2009-10-14 150768]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-07 102400]
"MFFSum_Pro_LL2"=C:\Program Files\Xerox Companion Suite\MFFSUM.exe [2009-04-22 24576]
"PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2007-11-13 29984]
"IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2007-11-13 46368]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-07-06 9394792]
"reset"=regedit /s reset.reg []
"MSSE"=c:\Program Files\Microsoft Security Essentials\msseces.exe [2010-06-01 1093208]


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BatteryCare"=C:\Program Files\BatteryCare\BatteryCare.exe [2010-09-02 700416]


C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


======File associations======


.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*


======List of files/folders created in the last 1 months======


2010-09-30 23:09:08 ----D---- C:\rsit
2010-09-30 23:09:08 ----D---- C:\Program Files\trend micro
2010-09-29 18:17:12 ----D---- C:\CAST DECKA
2010-09-28 17:50:02 ----D---- C:\Program Files\Rossmann Foto-Shop Client
2010-09-26 16:14:39 ----D---- C:\Program Files\PMlabs
2010-09-16 22:12:43 ----A---- C:\Windows\system32\iertutil.dll
2010-09-16 07:32:58 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-15 08:42:10 ----D---- C:\Users\Markuska\AppData\Roaming\Mozilla


======List of files/folders modified in the last 1 months======


2010-09-30 23:20:30 ----D---- C:\Windows\Prefetch
2010-09-30 23:11:11 ----D---- C:\Windows\Temp
2010-09-30 23:09:08 ----RD---- C:\Program Files
2010-09-30 22:53:19 ----D---- C:\Windows\system32\config
2010-09-30 22:46:20 ----D---- C:\Users\Markuska\AppData\Roaming\uTorrent
2010-09-30 22:42:35 ----SHD---- C:\System Volume Information
2010-09-30 22:33:09 ----D---- C:\Windows\winsxs
2010-09-30 08:52:03 ----D---- C:\Users\Markuska\AppData\Roaming\vlc
2010-09-30 08:51:24 ----D---- C:\Users\Markuska\AppData\Roaming\dvdcss
2010-09-30 08:47:46 ----AD---- C:\Program Files\RQMONEY_1_3
2010-09-30 08:17:43 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-30 00:31:09 ----SHD---- C:\Windows\Installer
2010-09-30 00:30:23 ----D---- C:\Windows\system32\catroot
2010-09-30 00:30:10 ----D---- C:\Program Files\Internet Explorer
2010-09-29 18:23:12 ----AD---- C:\Program Files\pospa
2010-09-29 16:15:53 ----D---- C:\Windows\system32\catroot2
2010-09-24 08:40:15 ----D---- C:\Windows\system32\NDF
2010-09-20 09:18:49 ----D---- C:\Windows\System32
2010-09-20 09:18:49 ----D---- C:\Windows\inf
2010-09-20 09:18:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-17 07:46:57 ----D---- C:\Windows
2010-09-16 22:15:06 ----D---- C:\ProgramData\Microsoft Help
2010-09-16 22:12:59 ----D---- C:\Windows\debug
2010-09-16 22:12:55 ----A---- C:\Windows\system32\MRT.exe
2010-09-14 14:38:27 ----D---- C:\Users\Markuska\AppData\Roaming\Skype
2010-09-14 14:37:22 ----D---- C:\Users\Markuska\AppData\Roaming\skypePM
2010-09-13 15:28:12 ----D---- C:\Program Files\Opera
2010-09-02 15:20:11 ----D---- C:\Users\Markuska\AppData\Roaming\BatteryCare
2010-09-02 15:19:40 ----D---- C:\Program Files\BatteryCare


======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-12-18 26024]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-07-06 3132712]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\netw5v32.sys [2010-01-13 6628352]
R3 NSCIRDA;NSC Infrared Device Driver; C:\Windows\system32\DRIVERS\nscirda.sys [2008-01-19 30720]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-14 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-14 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-14 661504]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-09-07 192816]
R3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-05-02 290816]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010-02-25 10064]
R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2009-08-09 29696]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner; C:\Windows\system32\drivers\AVerFx2hbtv.sys [2009-05-05 436096]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 cpuz132;cpuz132; \??\C:\Users\Markuska\AppData\Local\Temp\cpuz132\cpuz132_x32.sys []
S3 KMWDFILTERx86;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\Program Files\BatteryCare\WinRing0.sys [2008-07-26 14416]
S3 XMLDIUSB;XML USB Device Interface; C:\Windows\System32\Drivers\XMLDIUSB.sys [2008-01-16 33152]


======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R2 AVerRemote;AVerRemote; C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe [2009-04-08 344064]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 FUSServices;Session Launcher Service; C:\Windows\system32\FUSServices.exe [2009-04-22 10752]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2009-09-06 71096]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-05-07 1051976]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 AVerScheduleService;AVerScheduleService; C:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe [2008-12-09 405504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-11 654848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TuneUp.Defrag;@C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-08-23 435016]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-15 1343400]

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[skylarinho]

ComboFix 10-09-30.05 - Markuska 01.10.2010 19:44:58.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.2038.1276 [GMT 2:00]
Spuštěný z: C:UsersMarkuskaDownloadsComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:Program Files\setup.exe
C:Program FilesSetup.exe
C:UsersMarkuskajre-6u1-windows-i586-p.exe
C:Windowssystem32pthreadVC.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-01 do 2010-10-01 )))))))))))))))))))))))))))))))
.
2010-10-01 17:51:15 . 2010-10-01 17:51:15 -------- d-----w- C:UsersDefaultAppDataLocaltemp
2010-09-30 21:09:08 . 2010-09-30 21:25:48 -------- d-----w- C:Program Filestrend micro
2010-09-30 21:09:08 . 2010-09-30 21:21:07 -------- d-----w- C:rsit
2010-09-29 22:30:20 . 2010-03-04 03:57:55 190976 ----a-w- C:Windowssystem32driversks.sys
2010-09-29 16:17:12 . 2010-09-29 16:18:03 -------- d-----w- C:CAST DECKA
2010-09-29 14:16:57 . 2010-06-19 06:15:54 2048 ----a-w- C:Windowssystem32tzres.dll
2010-09-28 15:50:02 . 2010-09-28 15:51:23 -------- d-----w- C:Program FilesRossmann Foto-Shop Client
2010-09-26 14:14:39 . 2010-09-26 14:14:39 -------- d-----w- C:Program FilesPMlabs
2010-09-16 05:32:58 . 2010-08-21 05:32:37 316928 ----a-w- C:Windowssystem32spoolsv.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 20:46:20 . 2009-11-14 12:40:36 -------- d-----w- C:UsersMarkuskaAppDataRoaminguTorrent
2010-09-30 06:52:03 . 2009-11-15 19:02:45 -------- d-----w- C:UsersMarkuskaAppDataRoamingvlc
2010-09-30 06:51:24 . 2010-01-11 12:02:08 -------- d-----w- C:UsersMarkuskaAppDataRoamingdvdcss
2010-09-30 06:47:46 . 2010-01-05 19:38:10 -------- d---a-w- C:Program FilesRQMONEY_1_3
2010-09-30 06:17:43 . 2009-11-14 13:00:36 -------- d-----w- C:Program FilesMicrosoft Silverlight
2010-09-29 16:23:12 . 2009-01-11 08:37:43 -------- d---a-w- C:Program Filespospa
2010-09-20 07:18:49 . 2009-11-14 12:55:13 626622 ----a-w- C:Windowssystem32perfh005.dat
2010-09-20 07:18:49 . 2009-11-14 12:55:13 120878 ----a-w- C:Windowssystem32perfc005.dat
2010-09-16 20:15:06 . 2009-11-19 12:36:11 -------- d-----w- C:ProgramDataMicrosoft Help
2010-09-14 12:38:27 . 2009-11-14 12:03:16 -------- d-----w- C:UsersMarkuskaAppDataRoamingSkype
2010-09-14 12:37:22 . 2009-11-14 12:16:11 -------- d-----w- C:UsersMarkuskaAppDataRoamingskypePM
2010-09-13 13:28:12 . 2009-11-14 11:28:32 -------- d-----w- C:Program FilesOpera
2010-09-02 13:20:11 . 2010-03-03 12:12:04 -------- d-----w- C:UsersMarkuskaAppDataRoamingBatteryCare
2010-09-02 13:19:40 . 2010-03-03 12:12:04 -------- d-----w- C:Program FilesBatteryCare
2010-08-31 10:11:40 . 2010-08-31 10:11:40 3401880 ----a-w- C:UsersMarkuskaAppDataRoamingMozillapluginsnpgtpo3dautoplugin.dll
2010-08-31 09:55:30 . 2010-08-31 09:55:30 275096 ----a-w- C:UsersMarkuskaAppDataRoamingMozillapluginsnpgoogletalk.dll
2010-08-31 09:39:10 . 2010-08-31 09:39:10 3734536 ----a-w- C:UsersMarkuskaAppDataRoamingMozillapluginsGoogle Talk Plugin Extrasd3dx9_36.dll
2010-08-23 14:42:39 . 2010-08-23 14:42:23 -------- d-----w- C:Program FilesMicrosoft Security Essentials
2010-08-23 14:13:43 . 2009-11-14 12:40:36 -------- d-----w- C:Program FilesuTorrent
2010-08-23 13:39:49 . 2010-08-23 13:39:33 -------- d-----w- C:Program FilesTuneUp Utilities 2010
2010-08-23 13:39:39 . 2010-08-23 13:39:39 -------- d-----w- C:UsersMarkuskaAppDataRoamingTuneUp Software
2010-08-23 13:39:33 . 2010-08-23 13:38:52 -------- d-----w- C:ProgramDataTuneUp Software
2010-08-23 13:38:43 . 2010-08-23 13:38:43 -------- d-sh--w- C:ProgramData{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-08-19 10:09:13 . 2010-08-19 10:09:13 -------- d-----w- C:Program FilesRealtek
2009-11-14 10:57:08 . 2009-11-14 10:57:08 363 ----a-w- C:Program FilesRecentPlaces.lnk
2007-01-03 21:24:02 . 2007-01-03 21:24:02 489 ----a-w- C:Program Filesreadme.txt
2009-06-10 21:26:35 . 2009-07-14 02:04:20 9633792 --sha-r- C:WindowsFontsStaticCache.dat
.
------- Sigcheck -------
[-] 2010-06-15 17:41:08 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385 (win7_rtm.090713-1255)] . . C:WindowsSystem32user32.dll
[7] 2009-07-14 01:16:17 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385 (win7_rtm.090713-1255)] . . C:Windowswinsxsx86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3user32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"BatteryCare"="C:Program FilesBatteryCareBatteryCare.exe" [2010-09-02 01:35:54 700416]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"reset"="regedit" [X]
"SynTPStart"="C:Program FilesSynapticsSynTPSynTPStart.exe" [2007-09-07 10:35:10 102400]
"MFFSum_Pro_LL2"="C:Program FilesXerox Companion SuiteMFFSUM.exe" [2009-04-22 03:35:34 24576]
"PaperPort PTD"="C:Program FilesScanSoftPaperPortpptd40nt.exe" [2007-11-13 16:39:16 29984]
"IndexSearch"="C:Program FilesScanSoftPaperPortIndexSearch.exe" [2007-11-13 16:37:14 46368]
"IgfxTray"="C:Windowssystem32igfxtray.exe" [2009-09-23 17:30:48 141848]
"HotKeysCmds"="C:Windowssystem32hkcmd.exe" [2009-09-23 17:30:48 173592]
"Persistence"="C:Windowssystem32igfxpers.exe" [2009-09-23 17:30:48 150552]
"RtHDVCpl"="C:Program FilesRealtekAudioHDARtHDVCpl.exe" [2010-07-06 16:30:12 9394792]
"MSSE"="c:Program FilesMicrosoft Security Essentialsmsseces.exe" [2010-06-01 12:53:46 1093208]
C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup
AVer HID Receiver.lnk - C:Program FilesCommon FilesAVerMediaAVerQuickAVerHIDReceiver.exe [2010-1-17 159744]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalMsMpSvc]
@="Service"
[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun-]
"Google Update"="C:UsersMarkuskaAppDataLocalGoogleUpdateGoogleUpdate.exe" /c
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]
"SSBkgdUpdate"="C:Program FilesCommon FilesScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
"SunJavaUpdateSched"="C:Program FilesCommon FilesJavaJava Updatejusched.exe"
"MFPrintServer_Pro_LL2"="C:Program FilesXerox Companion SuiteMFPrintServer.exe"
"OrderReminder"=C:Program FilesHewlett-PackardOrderReminderOrderReminder.exe
"VirtualCloneDrive"="C:Program FilesElaborate BytesVirtualCloneDriveVCDDaemon.exe" /s
R2 AVerScheduleService;AVerScheduleService;C:Program FilesCommon FilesAVerMediaServiceAVerScheduleService.exe [2008-12-09 10:01:50 405504]
R2 FUSServices;Session Launcher Service;C:Windowssystem32FUSServices.exe [2009-04-22 03:18:24 10752]
R3 AVerFx2hbtv;AVerMedia USB SW Hybrid Tuner;C:Windowssystem32driversAVerFx2hbtv.sys [2009-05-05 06:00:56 436096]
R3 KMWDFILTERx86;HIDServiceDesc;C:Windowssystem32DRIVERSKMWDFILTER.sys [2009-04-29 13:37:26 25088]
R3 WatAdminSvc;WatAdminSvc; [x]
S2 AVerRemote;AVerRemote;C:Program FilesCommon FilesAVerMediaServiceAVerRemote.exe [2009-04-08 03:49:30 344064]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesService32.exe [2010-05-07 16:04:20 1051976]
S3 MpNWMon;Microsoft Malware Protection Network Driver;C:Windowssystem32DRIVERSMpNWMon.sys [2010-03-25 19:30:22 42368]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;C:Windowssystem32DRIVERSnetw5v32.sys [2010-01-13 16:29:54 6628352]
S3 SrvHsfHDA;SrvHsfHDA;C:Windowssystem32DRIVERSVSTAZL3.SYS [2009-07-13 22:13:45 207360]
S3 SrvHsfV92;SrvHsfV92;C:Windowssystem32DRIVERSVSTDPV3.SYS [2009-07-13 22:13:46 980992]
S3 SrvHsfWinac;SrvHsfWinac;C:Windowssystem32DRIVERSVSTCNXT3.SYS [2009-07-13 22:13:45 661504]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:Program FilesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys [2010-02-25 09:18:08 10064]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
2010-09-30 C:WindowsTasksGoogleUpdateTaskUserS-1-5-21-2104895378-3808249359-3690982508-1000Core.job
- C:UsersMarkuskaAppDataLocalGoogleUpdateGoogleUpdate.exe [2010-04-04 15:29:48 . 2010-04-04 15:29:45]
2010-10-01 C:WindowsTasksGoogleUpdateTaskUserS-1-5-21-2104895378-3808249359-3690982508-1000UA.job
- C:UsersMarkuskaAppDataLocalGoogleUpdateGoogleUpdate.exe [2010-04-04 15:29:48 . 2010-04-04 15:29:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/ig?hl=cs
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
Trusted Zone: mojebanka.cz
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}

[Rudy]

4 infikované položky smazány, zbytek logu vypadá čistý.

[skylarinho]

Vypada to, ze je to v poradku, diky moc

[Rudy]

Nemáte zač!