nalezeny viry, prosím o kontrolu logu

[Lukvot]

Dobrý den, ntb. má po startu cca půl hod. zcela vytížený HDD a paměti. Win Vista spuštěno asi 67 procesů, je to normální? V msconfig po spuštění jsem vypnul co se dalo, problém trvá. Po nějaké době se počítač odpojí od wifi sítě a již nejde připojit, jedině po restartu. Mwav našel nějaké viry - viz níže. Prosím o kontrolu logu z Hijackthis a radu jak postupovat dál. Děkuji.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:04:08, on 30.4.2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18602)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\Taskmgr.exe
C:\Users\Maruska\AppData\Local\Temp\mexe.com
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Maruska\Downloads\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... pl=11&qkw=%s&tbid=60040
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inbox.com/homepage.aspx?tbid=80093&lng=cs
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: (no name) - {D4CF558B-745C-44FF-854F-D6FCAE69B6E1} - C:\PROGRA~1\87F80.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\a\AppData\Local\Temp\MACROM~1\SWFUPD~1\swfupdate.dll
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - C:\ProgramData\a\AppData\Local\Temp\Macromedia\swfupdate\swfupdate.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 5617 bytes

Mwav mi našel tohle:

Objekt "FreeSpyScannerAndRemover Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Spyware.NetScreenWatch Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Backdoor (IRCBot) Trojans Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Trojan.Renos.PGZ Trojan-Downloader" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
C:\Windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.4518\OARTCONV.DLL je infikovaný virem Exe.Corrupted !! Provedené akce: Ponecháno, neodstraněno!.

[vyosek]

Zdravim a pekny vecer preji

Dejte log z RSIT - viz muj podpis - je podrobenejsi nez HJT

[Lukvot]

Zde požadovaný log. Děkuji.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Maruska at 2011-04-30 21:03:08
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 5 GB (7%) free of 69 GB
Total RAM: 1015 MB (27% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{D3FB69CC-AC06-4795-98D6-4F3CFBC968B9}.job
C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-01-29 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4CF558B-745C-44FF-854F-D6FCAE69B6E1}]
C:\PROGRA~1\87F80.dll [2011-04-22 445952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-29 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18 818280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-22 815104]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-08-24 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-08-24 154136]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-08-24 129560]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-04-18 3460784]
"Skytel"=C:\Windows\Skytel.exe [2007-06-15 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-10-10 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-26 161328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2007-07-06 4669440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
C:\PROGRA~1\Toshiba\BLUETO~1\TosBtMng.exe [2007-01-18 2752512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MultiFrame.lnk]
C:\PROGRA~1\ASUS\ASUSMU~1\MULTIF~1.EXE [2006-12-29 991600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~2\a\AppData\Local\Temp\MACROM~1\SWFUPD~1\swfupdate.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-08-24 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - C:\ProgramData\a\AppData\Local\Temp\Macromedia\swfupdate\swfupdate.dll [2011-04-15 43520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2011-04-30 21:03:09 ----D---- C:\Program Files\trend micro
2011-04-30 21:03:08 ----D---- C:\rsit
2011-04-30 20:47:40 ----AD---- C:\Windows\rundll16.exe
2011-04-30 20:47:40 ----AD---- C:\Windows\logo1_.exe
2011-04-30 15:30:52 ----A---- C:\Windows\system32\msshsq.dll
2011-04-30 14:46:16 ----D---- C:\ProgramData\WindowsSearch
2011-04-30 14:02:22 ----AD---- C:\Windows\VDLL.DLL
2011-04-30 14:02:22 ----AD---- C:\Windows\system32\runouce.exe
2011-04-30 14:02:22 ----AD---- C:\Windows\RUNDL132.EXE
2011-04-30 14:02:22 ----AD---- C:\Windows\logo_1.exe
2011-04-30 13:49:38 ----A---- C:\Windows\system32\msvcr80.dll
2011-04-30 13:49:37 ----A---- C:\Windows\system32\msvcp80.dll
2011-04-30 13:49:36 ----A---- C:\Windows\system32\eEmpty.exe
2011-04-30 13:49:25 ----D---- C:\Program Files\Common Files\MicroWorld
2011-04-30 13:48:55 ----D---- C:\ProgramData\MicroWorld
2011-04-30 13:45:13 ----A---- C:\Windows\system32\Apphlpdm.dll
2011-04-30 13:45:11 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2011-04-30 11:37:48 ----D---- C:\Windows\pss
2011-04-29 18:39:48 ----A---- C:\Windows\system32\msshooks.dll
2011-04-29 18:39:47 ----A---- C:\Windows\system32\msscb.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\thawbrkr.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\srchadmin.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\SearchFilterHost.exe
2011-04-29 18:39:46 ----A---- C:\Windows\system32\propsys.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\propdefs.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\msstrc.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\mssprxy.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\mssitlb.dll
2011-04-29 18:39:46 ----A---- C:\Windows\system32\korwbrkr.dll
2011-04-29 18:39:45 ----A---- C:\Windows\system32\wsepno.dll
2011-04-29 18:39:45 ----A---- C:\Windows\system32\rtffilt.dll
2011-04-29 18:39:45 ----A---- C:\Windows\system32\mimefilt.dll
2011-04-29 18:39:44 ----A---- C:\Windows\system32\xmlfilter.dll
2011-04-29 18:39:44 ----A---- C:\Windows\system32\offfilt.dll
2011-04-29 18:39:44 ----A---- C:\Windows\system32\nlhtml.dll
2011-04-29 18:39:44 ----A---- C:\Windows\system32\msscntrs.dll
2011-04-29 18:39:43 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2011-04-29 18:39:43 ----A---- C:\Windows\system32\chtbrkr.dll
2011-04-29 18:39:43 ----A---- C:\Windows\system32\chsbrkr.dll
2011-04-29 18:39:41 ----A---- C:\Windows\system32\tquery.dll
2011-04-29 18:39:41 ----A---- C:\Windows\system32\SearchIndexer.exe
2011-04-29 18:39:41 ----A---- C:\Windows\system32\mssvp.dll
2011-04-29 18:39:41 ----A---- C:\Windows\system32\mssrch.dll
2011-04-29 18:39:41 ----A---- C:\Windows\system32\mssph.dll
2011-04-29 18:39:40 ----A---- C:\Windows\system32\mssphtb.dll
2011-04-29 18:35:26 ----A---- C:\Windows\system32\psisdecd.dll
2011-04-29 18:30:30 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2011-04-29 18:30:30 ----A---- C:\Windows\system32\PresentationHost.exe
2011-04-29 18:30:30 ----A---- C:\Windows\system32\netfxperf.dll
2011-04-29 18:30:30 ----A---- C:\Windows\system32\mscoree.dll
2011-04-29 18:30:29 ----A---- C:\Windows\system32\dfshim.dll
2011-04-29 18:27:26 ----D---- C:\Windows\system32\WindowsPowerShell
2011-04-29 18:24:28 ----A---- C:\Windows\system32\winrsmgr.dll
2011-04-29 18:23:30 ----A---- C:\Windows\system32\wsmprovhost.exe
2011-04-29 18:23:30 ----A---- C:\Windows\system32\winrshost.exe
2011-04-29 18:23:30 ----A---- C:\Windows\system32\winrs.exe
2011-04-29 18:23:27 ----A---- C:\Windows\system32\wsmplpxy.dll
2011-04-29 18:23:27 ----A---- C:\Windows\system32\winrssrv.dll
2011-04-29 18:23:24 ----A---- C:\Windows\system32\WsmRes.dll
2011-04-29 18:23:24 ----A---- C:\Windows\system32\wevtfwd.dll
2011-04-29 18:23:24 ----A---- C:\Windows\system32\wecutil.exe
2011-04-29 18:23:24 ----A---- C:\Windows\system32\wecsvc.dll
2011-04-29 18:23:24 ----A---- C:\Windows\system32\wecapi.dll
2011-04-29 18:23:23 ----A---- C:\Windows\system32\pwrshplugin.dll
2011-04-29 18:23:10 ----A---- C:\Windows\system32\winrm.vbs
2011-04-29 18:23:07 ----A---- C:\Windows\system32\WsmWmiPl.dll
2011-04-29 18:23:07 ----A---- C:\Windows\system32\WsmAuto.dll
2011-04-29 18:23:07 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2011-04-29 18:23:07 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2011-04-29 18:23:07 ----A---- C:\Windows\system32\winrscmd.dll
2011-04-29 18:23:06 ----A---- C:\Windows\system32\WsmSvc.dll
2011-04-29 17:41:17 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-04-29 17:41:15 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-04-29 17:41:05 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-04-29 17:41:04 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-04-29 17:41:02 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-04-29 17:40:53 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-04-29 17:39:37 ----A---- C:\Windows\system32\aswBoot.exe
2011-04-29 17:39:12 ----D---- C:\ProgramData\AVAST Software
2011-04-29 17:39:12 ----D---- C:\Program Files\AVAST Software
2011-04-29 17:12:40 ----A---- C:\Windows\system32\javaws.exe
2011-04-29 17:12:40 ----A---- C:\Windows\system32\javaw.exe
2011-04-29 17:12:40 ----A---- C:\Windows\system32\java.exe
2011-04-29 17:12:40 ----A---- C:\Windows\system32\deployJava1.dll
2011-04-29 17:01:26 ----A---- C:\Windows\system32\wmp.dll
2011-04-29 17:01:16 ----A---- C:\Windows\system32\wmploc.DLL
2011-04-29 17:00:30 ----A---- C:\Windows\system32\dnsrslvr.dll
2011-04-29 17:00:30 ----A---- C:\Windows\system32\dnsapi.dll
2011-04-29 17:00:29 ----A---- C:\Windows\system32\dnscacheugc.exe
2011-04-29 16:54:05 ----A---- C:\Windows\system32\srvsvc.dll
2011-04-29 16:54:04 ----A---- C:\Windows\system32\netevent.dll
2011-04-29 16:53:29 ----A---- C:\Windows\system32\usp10.dll
2011-04-29 16:53:18 ----A---- C:\Windows\system32\schannel.dll
2011-04-29 16:53:12 ----A---- C:\Windows\system32\fontsub.dll
2011-04-29 16:53:12 ----A---- C:\Windows\system32\atmlib.dll
2011-04-29 16:53:12 ----A---- C:\Windows\system32\atmfd.dll
2011-04-29 16:53:00 ----A---- C:\Windows\system32\odbc32.dll
2011-04-29 16:52:45 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-04-29 16:52:45 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-04-29 16:52:45 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-04-29 16:52:45 ----A---- C:\Windows\system32\drivers\bowser.sys
2011-04-29 16:52:35 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-04-29 16:52:35 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-04-29 16:52:35 ----A---- C:\Windows\system32\ntdll.dll
2011-04-29 16:52:28 ----A---- C:\Windows\system32\mfc42.dll
2011-04-29 16:52:27 ----A---- C:\Windows\system32\mfc42u.dll
2011-04-29 16:52:17 ----A---- C:\Windows\system32\iccvid.dll
2011-04-29 16:52:10 ----A---- C:\Windows\system32\pacerprf.dll
2011-04-29 16:52:10 ----A---- C:\Windows\system32\drivers\pacer.sys
2011-04-29 16:51:58 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-04-29 16:51:58 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-04-29 16:51:58 ----A---- C:\Windows\system32\drivers\srv.sys
2011-04-29 16:51:53 ----A---- C:\Windows\system32\asycfilt.dll
2011-04-29 16:51:45 ----A---- C:\Windows\system32\ole32.dll
2011-04-29 16:51:40 ----A---- C:\Windows\system32\spoolsv.exe
2011-04-29 16:50:52 ----A---- C:\Windows\system32\t2embed.dll
2011-04-29 16:50:44 ----A---- C:\Windows\system32\occache.dll
2011-04-29 16:50:44 ----A---- C:\Windows\system32\mshtml.dll
2011-04-29 16:50:43 ----A---- C:\Windows\system32\ieframe.dll
2011-04-29 16:50:42 ----A---- C:\Windows\system32\wininet.dll
2011-04-29 16:50:42 ----A---- C:\Windows\system32\urlmon.dll
2011-04-29 16:50:42 ----A---- C:\Windows\system32\mstime.dll
2011-04-29 16:50:41 ----A---- C:\Windows\system32\msfeeds.dll
2011-04-29 16:50:40 ----A---- C:\Windows\system32\ieapfltr.dll
2011-04-29 16:50:39 ----A---- C:\Windows\system32\mshtmled.dll
2011-04-29 16:50:38 ----A---- C:\Windows\system32\iertutil.dll
2011-04-29 16:50:37 ----A---- C:\Windows\system32\iepeers.dll
2011-04-29 16:50:37 ----A---- C:\Windows\system32\iedkcs32.dll
2011-04-29 16:50:37 ----A---- C:\Windows\system32\ieaksie.dll
2011-04-29 16:50:36 ----A---- C:\Windows\system32\ieUnatt.exe
2011-04-29 16:50:35 ----A---- C:\Windows\system32\jsproxy.dll
2011-04-29 16:50:35 ----A---- C:\Windows\system32\ieencode.dll
2011-04-29 16:50:15 ----A---- C:\Windows\system32\shsvcs.dll
2011-04-29 16:49:54 ----A---- C:\Windows\system32\win32k.sys
2011-04-29 16:49:50 ----A---- C:\Windows\system32\sdclt.exe
2011-04-29 16:49:12 ----A---- C:\Windows\system32\MP4SDECD.DLL
2011-04-29 16:49:07 ----A---- C:\Windows\system32\vbscript.dll
2011-04-29 16:49:07 ----A---- C:\Windows\system32\jscript.dll
2011-04-29 16:49:00 ----A---- C:\Windows\system32\inetcomm.dll
2011-04-29 16:48:55 ----A---- C:\Windows\system32\mfc40u.dll
2011-04-29 16:48:55 ----A---- C:\Windows\system32\mfc40.dll
2011-04-29 16:48:51 ----A---- C:\Windows\system32\rtutils.dll
2011-04-29 16:48:40 ----A---- C:\Windows\system32\wmpmde.dll
2011-04-29 16:48:35 ----A---- C:\Windows\system32\sbeio.dll
2011-04-29 16:48:35 ----A---- C:\Windows\system32\sbe.dll
2011-04-29 16:48:35 ----A---- C:\Windows\system32\EncDec.dll
2011-04-29 16:48:22 ----A---- C:\Windows\system32\quartz.dll
2011-04-29 16:48:15 ----A---- C:\Windows\system32\shell32.dll
2011-04-29 16:48:14 ----A---- C:\Windows\system32\shlwapi.dll
2011-04-29 16:48:06 ----A---- C:\Windows\system32\wmicmiplugin.dll
2011-04-29 16:48:06 ----A---- C:\Windows\system32\taskschd.dll
2011-04-29 16:48:06 ----A---- C:\Windows\system32\schedsvc.dll
2011-04-29 16:48:05 ----A---- C:\Windows\system32\taskeng.exe
2011-04-29 16:48:05 ----A---- C:\Windows\system32\taskcomp.dll
2011-04-29 16:47:49 ----A---- C:\Windows\system32\consent.exe
2011-04-29 16:47:42 ----A---- C:\Windows\system32\msxml3.dll
2011-04-29 16:47:31 ----A---- C:\Windows\system32\Faultrep.dll
2011-04-29 16:47:30 ----A---- C:\Windows\system32\wersvc.dll
2011-04-29 16:47:22 ----A---- C:\Windows\system32\emdmgmt.dll
2011-04-29 16:47:21 ----A---- C:\Windows\system32\drivers\nwifi.sys
2011-04-29 16:47:21 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-04-29 16:47:21 ----A---- C:\Windows\system32\dataclen.dll
2011-04-29 16:47:21 ----A---- C:\Windows\system32\cdd.dll
2011-04-29 16:46:56 ----A---- C:\Windows\system32\tzres.dll
2011-04-29 16:44:46 ----A---- C:\Windows\system32\mstscax.dll
2011-04-29 16:44:45 ----A---- C:\Windows\system32\mstsc.exe
2011-04-29 16:44:25 ----A---- C:\Windows\system32\wshext.dll
2011-04-29 16:44:24 ----A---- C:\Windows\system32\wscript.exe
2011-04-29 16:44:24 ----A---- C:\Windows\system32\scrobj.dll
2011-04-29 16:44:24 ----A---- C:\Windows\system32\cscript.exe
2011-04-29 16:44:23 ----A---- C:\Windows\system32\scrrun.dll
2011-04-29 16:44:12 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-04-29 16:04:47 ----A---- C:\Windows\system32\comctl32.dll
2011-04-29 14:07:49 ----D---- C:\PerfLogs
2011-04-25 15:46:54 ----AD---- C:\ProgramData\TEMP
2011-04-22 17:05:48 ----A---- C:\Program Files\87F80.dll
2011-04-15 12:28:50 ----D---- C:\ProgramData\a

======List of files/folders modified in the last 1 months======

2011-04-30 21:03:10 ----D---- C:\Windows\Prefetch
2011-04-30 21:03:09 ----RD---- C:\Program Files
2011-04-30 21:03:00 ----D---- C:\Windows\Temp
2011-04-30 20:47:40 ----D---- C:\Windows
2011-04-30 18:25:35 ----D---- C:\Windows\Logs
2011-04-30 17:36:09 ----D---- C:\Windows\Microsoft.NET
2011-04-30 17:35:44 ----RSD---- C:\Windows\assembly
2011-04-30 17:17:01 ----D---- C:\Program Files\Mozilla Firefox
2011-04-30 17:15:25 ----D---- C:\Windows\winsxs
2011-04-30 17:09:47 ----D---- C:\Windows\System32
2011-04-30 17:09:46 ----D---- C:\Windows\inf
2011-04-30 17:09:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-04-30 17:03:25 ----D---- C:\Windows\system32\drivers
2011-04-30 17:01:36 ----D---- C:\Windows\AppPatch
2011-04-30 15:37:31 ----SHD---- C:\Windows\Installer
2011-04-30 15:37:31 ----SHD---- C:\Config.Msi
2011-04-30 15:31:54 ----D---- C:\Windows\system32\catroot
2011-04-30 15:30:31 ----SHD---- C:\System Volume Information
2011-04-30 14:46:16 ----HD---- C:\ProgramData
2011-04-30 13:51:29 ----D---- C:\Windows\rescache
2011-04-30 13:49:25 ----D---- C:\Program Files\Common Files
2011-04-30 13:40:28 ----D---- C:\Windows\system32\catroot2
2011-04-30 13:24:01 ----A---- C:\Windows\system32\acovcnt.exe
2011-04-30 11:43:42 ----D---- C:\Windows\system32\cs-CZ
2011-04-30 11:35:35 ----D---- C:\Windows\system32\en-US
2011-04-30 11:34:44 ----D---- C:\Program Files\Microsoft.NET
2011-04-30 11:19:19 ----D---- C:\Program Files\Windows Media Player
2011-04-30 11:19:16 ----D---- C:\Program Files\Windows Mail
2011-04-30 11:19:11 ----D---- C:\Program Files\Internet Explorer
2011-04-30 11:19:09 ----D---- C:\Program Files\Movie Maker
2011-04-30 11:19:08 ----D---- C:\Windows\PolicyDefinitions
2011-04-30 11:19:02 ----D---- C:\Windows\system32\wbem
2011-04-30 11:19:01 ----D---- C:\Windows\ehome
2011-04-30 11:18:50 ----RSD---- C:\Windows\Fonts
2011-04-29 17:40:06 ----D---- C:\Program Files\Common Files\microsoft shared
2011-04-29 17:39:38 ----D---- C:\Program Files\Windows Sidebar
2011-04-29 17:35:31 ----D---- C:\Program Files\Common Files\Java
2011-04-29 17:11:27 ----D---- C:\Program Files\Java
2011-04-29 16:46:52 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-04-29 16:45:26 ----D---- C:\ProgramData\Symantec
2011-04-29 16:17:28 ----D---- C:\Users\Maruska\AppData\Roaming\OpenOffice.org2
2011-04-29 15:53:22 ----HD---- C:\Windows\system32\GroupPolicy
2011-04-29 15:23:24 ----D---- C:\ProgramData\Microsoft Help
2011-04-29 15:18:05 ----D---- C:\Windows\Debug
2011-04-29 14:53:54 ----D---- C:\Windows\Tasks
2011-04-29 14:30:25 ----SHD---- C:\Boot
2011-04-29 14:29:42 ----ASH---- C:\Program Files\desktop.ini
2011-04-29 14:13:46 ----D---- C:\Program Files\Windows Calendar
2011-04-29 14:13:34 ----D---- C:\Program Files\Windows Collaboration
2011-04-29 14:13:33 ----D---- C:\Program Files\Windows Journal
2011-04-29 14:13:31 ----D---- C:\Program Files\Windows Photo Gallery
2011-04-29 14:13:14 ----D---- C:\Program Files\Common Files\System
2011-04-29 14:13:13 ----D---- C:\Program Files\Windows Defender
2011-04-29 14:13:10 ----D---- C:\Windows\servicing
2011-04-29 14:12:59 ----D---- C:\Windows\MSAgent
2011-04-29 14:12:56 ----D---- C:\Windows\L2Schemas
2011-04-29 14:12:56 ----D---- C:\Windows\IME
2011-04-29 14:12:56 ----D---- C:\Windows\DigitalLocker
2011-04-29 14:12:53 ----D---- C:\Windows\system32\ko-KR
2011-04-29 14:12:53 ----D---- C:\Windows\system32\da-DK
2011-04-29 14:12:53 ----D---- C:\Windows\system32\com
2011-04-29 14:12:52 ----D---- C:\Windows\system32\it-IT
2011-04-29 14:12:52 ----D---- C:\Windows\system32\el-GR
2011-04-29 14:12:52 ----D---- C:\Windows\system32\de-DE
2011-04-29 14:12:51 ----D---- C:\Windows\system32\oobe
2011-04-29 14:12:49 ----D---- C:\Windows\system32\sysprep
2011-04-29 14:12:49 ----D---- C:\Windows\system32\migration
2011-04-29 14:12:37 ----D---- C:\Windows\system32\AdvancedInstallers
2011-04-29 14:12:36 ----D---- C:\Windows\system32\sv-SE
2011-04-29 14:12:36 ----D---- C:\Windows\system32\setup
2011-04-29 14:12:36 ----D---- C:\Windows\system32\ru-RU
2011-04-29 14:12:36 ----D---- C:\Windows\system32\ias
2011-04-29 14:12:36 ----D---- C:\Windows\system32\he-IL
2011-04-29 14:12:36 ----D---- C:\Windows\system32\fr-FR
2011-04-29 14:12:35 ----D---- C:\Windows\system32\fi-FI
2011-04-29 14:12:34 ----D---- C:\Windows\system32\cs
2011-04-29 14:12:22 ----D---- C:\Windows\system32\SLUI
2011-04-29 14:12:22 ----D---- C:\Windows\system32\pt-PT
2011-04-29 14:12:22 ----D---- C:\Windows\system32\hu-HU
2011-04-29 14:12:18 ----D---- C:\Windows\system32\zh-CN
2011-04-29 14:12:18 ----D---- C:\Windows\system32\manifeststore
2011-04-29 14:12:18 ----D---- C:\Windows\system32\es-ES
2011-04-29 14:12:17 ----D---- C:\Windows\system32\zh-TW
2011-04-29 14:12:17 ----D---- C:\Windows\system32\pl-PL
2011-04-29 14:12:17 ----D---- C:\Windows\system32\ja-JP
2011-04-29 14:12:16 ----D---- C:\Windows\system32\ro-RO
2011-04-29 14:12:14 ----D---- C:\Windows\system32\drivers\cs-CZ
2011-04-29 14:12:06 ----D---- C:\Windows\system32\tr-TR
2011-04-29 14:11:58 ----D---- C:\Windows\system32\nl-NL
2011-04-29 14:11:58 ----D---- C:\Windows\system32\nb-NO
2011-04-29 14:11:58 ----D---- C:\Windows\system32\ar-SA
2011-04-29 14:11:53 ----D---- C:\Windows\system32\migwiz
2011-04-29 14:11:50 ----D---- C:\Windows\system32\pt-BR
2011-04-29 14:08:06 ----D---- C:\Windows\Boot
2011-04-29 14:07:55 ----D---- C:\Windows\system32\Boot
2011-04-29 13:58:23 ----D---- C:\Windows\system32\drivers\UMDF
2011-04-29 13:48:29 ----D---- C:\Windows\system32\RTCOM
2011-04-29 13:05:47 ----A---- C:\Windows\system32\ifxcardm.dll
2011-04-29 13:05:25 ----A---- C:\Windows\system32\axaltocm.dll
2011-04-26 14:27:52 ----D---- C:\Program Files\ATK Hotkey
2011-04-25 14:20:59 ----D---- C:\Program Files\WinRAR
2011-04-25 11:54:41 ----D---- C:\Windows\system32\Tasks
2011-04-24 21:31:43 ----A---- C:\Windows\NeroDigital.ini
2011-04-22 17:05:52 ----D---- C:\Program Files\Windows NT
2011-04-18 15:46:44 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-04-18 25432]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-04-18 441176]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-04-18 307288]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-04-18 49240]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2007-11-14 395312]
R1 InCDPass;InCDPass; C:\Windows\system32\drivers\InCDPass.sys [2007-03-26 37040]
R1 incdrm;InCD Reader; C:\Windows\system32\drivers\InCDRm.sys [2007-03-26 39472]
R1 Tosrfcom;Bluetooth RFCOMM; C:\Windows\System32\Drivers\tosrfcom.sys [2005-08-02 64896]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-04-18 19544]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2006-11-14 43520]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-06-19 737280]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 1899008]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-07-18 1841312]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2007-01-23 50176]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2005-05-26 839724]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-22 181304]
R3 tosporte;Bluetooth COM Port; C:\Windows\system32\DRIVERS\tosporte.sys [2006-10-11 41600]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
R4 InCDfs;InCD File System; C:\Windows\system32\drivers\InCDFs.sys [2007-03-26 108592]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-10-19 19456]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2006-11-02 220160]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2006-11-02 29184]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 1899008]
S3 ipswuio;ipswuio; C:\Windows\System32\DRIVERS\ipswuio.sys []
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2008-03-29 21248]
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2008-03-29 20096]
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945BG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2006-10-14 4422560]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-19 49664]
S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2006-11-02 44544]
S3 se45bus;Sony Ericsson Device 069 driver (WDM); C:\Windows\system32\DRIVERS\se45bus.sys [2006-11-30 61536]
S3 se45mdfl;Sony Ericsson Device 069 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\se45mdfl.sys [2006-11-30 9360]
S3 se45mdm;Sony Ericsson Device 069 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\se45mdm.sys [2006-11-30 97088]
S3 tosrfbd;Bluetooth RFBUS; C:\Windows\system32\DRIVERS\tosrfbd.sys [2006-12-01 113792]
S3 tosrfbnp;Bluetooth RFBNEP; C:\Windows\System32\Drivers\tosrfbnp.sys [2006-11-21 36480]
S3 Tosrfhid;Bluetooth RFHID; C:\Windows\system32\DRIVERS\Tosrfhid.sys [2006-10-06 73600]
S3 tosrfnds;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 Tosrfusb;Bluetooth USB Controller; C:\Windows\system32\DRIVERS\tosrfusb.sys [2006-10-28 40960]
S3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2006-11-02 41064]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-02-06 94208]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-04-18 42184]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 InCDsrv;InCD Helper; C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe [2007-03-26 864816]
S3 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-03-26 779824]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-26 267824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
S3 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-11-01 77824]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

[vyosek]

Nejakou tu havet si tam chovate

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Lukvot]

Děkuji za pomoc, postupoval jsem dle vašeho návodu. Zde log z Combofix:

ComboFix 11-05-02.02 - Maruska 02.05.2011 19:43:43.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.1015.357 [GMT 2:00]
Spuštěný z: c:\users\Maruska\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Windows NT\DATA
c:\programdata\a\AppData\Local\Temp\Macromedia\swfupdate\swFUpdate.dll
c:\users\Maruska\AppData\Roaming\chrtmp
c:\users\Maruska\AppData\Roaming\Mikrotik
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\advtool.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\advtool.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\dhcp.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\dhcp.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\hotspot.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\hotspot.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\ntp.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\ntp.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\ppp.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\ppp.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\roteros.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\roteros.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\roting2.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\roting2.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\secure.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\secure.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\system.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\system.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\wlan2.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\wlan2.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\wproxy2.crc
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\ns2.9.46\wproxy2.dll
c:\users\Maruska\AppData\Roaming\Mikrotik\Winbox\winbox.cfg
c:\windows\ndl.dl
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\wibrf.jpg
c:\windows\wiybr.png
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-02 do 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-04-30 19:03 . 2011-04-30 19:03 -------- d-----w- c:\program files\trend micro
2011-04-30 19:03 . 2011-04-30 19:03 -------- d-----w- C:\rsit
2011-04-30 18:47 . 2011-04-30 18:47 -------- d---a-w- c:\windows\rundll16.exe
2011-04-30 18:47 . 2011-04-30 18:47 -------- d---a-w- c:\windows\logo1_.exe
2011-04-30 15:17 . 2011-04-14 16:38 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-04-30 15:17 . 2011-04-14 16:38 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-30 15:17 . 2011-04-14 16:38 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-30 15:17 . 2011-04-14 16:38 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-30 15:17 . 2011-04-14 16:38 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-04-30 15:17 . 2011-04-14 16:38 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-30 15:17 . 2011-04-14 16:38 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-30 15:17 . 2011-04-14 16:38 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-30 15:17 . 2010-01-01 08:00 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-30 15:17 . 2010-01-01 08:00 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-30 13:30 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2011-04-30 12:46 . 2011-04-30 12:46 -------- d-----w- c:\programdata\WindowsSearch
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\VDLL.DLL
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\system32\runouce.exe
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\RUNDL132.EXE
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\logo_1.exe
2011-04-30 11:49 . 2011-04-30 11:49 632064 ----a-w- c:\windows\system32\msvcr80.dll
2011-04-30 11:49 . 2011-04-30 11:49 554240 ----a-w- c:\windows\system32\msvcp80.dll
2011-04-30 11:49 . 2011-04-30 11:49 34048 ----a-w- c:\windows\system32\eEmpty.exe
2011-04-30 11:49 . 2011-04-30 11:49 -------- d-----w- c:\program files\Common Files\MicroWorld
2011-04-30 11:48 . 2011-04-30 11:49 -------- d-----w- c:\programdata\MicroWorld
2011-04-30 11:45 . 2011-03-03 14:56 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-30 11:45 . 2011-03-03 13:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-29 16:35 . 2010-04-14 17:46 80896 ----a-w- c:\windows\system32\MSNP.ax
2011-04-29 16:35 . 2010-04-14 17:47 293376 ----a-w- c:\windows\system32\psisdecd.dll
2011-04-29 16:35 . 2010-04-14 17:47 217088 ----a-w- c:\windows\system32\psisrndr.ax
2011-04-29 16:30 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-04-29 16:30 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-04-29 16:30 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-04-29 16:30 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-04-29 16:30 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-04-29 16:24 . 2009-10-09 21:56 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2011-04-29 15:41 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-29 15:41 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-29 15:41 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-29 15:41 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-29 15:41 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-29 15:40 . 2011-04-18 17:13 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-29 15:39 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
2011-04-29 15:39 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-04-29 15:39 . 2011-04-29 15:39 -------- d-----w- c:\programdata\AVAST Software
2011-04-29 15:39 . 2011-04-29 15:39 -------- d-----w- c:\program files\AVAST Software
2011-04-29 15:12 . 2011-04-29 15:11 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-04-29 15:12 . 2011-04-29 15:11 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-29 15:01 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2011-04-29 15:01 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2011-04-29 15:00 . 2011-03-02 14:49 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-04-29 15:00 . 2009-05-04 10:11 25088 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-04-29 14:54 . 2010-09-06 16:24 125952 ----a-w- c:\windows\system32\srvsvc.dll
2011-04-29 14:54 . 2010-09-06 16:23 17920 ----a-w- c:\windows\system32\netevent.dll
2011-04-29 14:53 . 2010-04-16 16:10 501760 ----a-w- c:\windows\system32\usp10.dll
2011-04-29 14:53 . 2010-10-12 15:48 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2011-04-29 14:53 . 2010-10-12 13:52 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2011-04-29 14:53 . 2010-10-12 13:52 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2011-04-29 14:53 . 2010-08-10 15:02 274432 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 14:53 . 2011-02-16 15:29 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-04-29 14:53 . 2011-02-16 13:24 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-04-29 14:53 . 2010-06-16 15:12 72704 ----a-w- c:\windows\system32\fontsub.dll
2011-04-29 14:53 . 2010-12-28 14:57 409600 ----a-w- c:\windows\system32\odbc32.dll
2011-04-29 14:53 . 2010-12-28 14:56 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-04-29 14:51 . 2011-02-18 13:31 304640 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-29 14:51 . 2011-02-18 13:31 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-29 14:51 . 2011-02-18 13:31 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-29 14:51 . 2010-04-05 16:07 67072 ----a-w- c:\windows\system32\asycfilt.dll
2011-04-29 14:51 . 2010-06-28 16:15 1315840 ----a-w- c:\windows\system32\ole32.dll
2011-04-29 14:51 . 2010-06-28 14:31 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-04-29 14:51 . 2010-08-17 13:32 126464 ----a-w- c:\windows\system32\spoolsv.exe
2011-04-29 14:49 . 2011-03-03 12:53 2040832 ----a-w- c:\windows\system32\win32k.sys
2011-04-29 14:49 . 2010-12-14 15:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
2011-04-29 14:49 . 2010-06-17 17:15 10926592 ----a-w- c:\program files\Movie Maker\MOVIEMK.dll
2011-04-29 14:49 . 2010-06-17 15:49 150016 ----a-w- c:\program files\Movie Maker\MOVIEMK.exe
2011-04-29 14:49 . 2010-04-05 16:08 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
2011-04-29 14:49 . 2011-02-16 15:35 430080 ----a-w- c:\windows\system32\vbscript.dll
2011-04-29 14:49 . 2011-03-03 15:00 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 14:47 . 2010-10-18 14:01 81920 ----a-w- c:\windows\system32\consent.exe
2011-04-29 14:47 . 2010-06-11 15:30 1257472 ----a-w- c:\windows\system32\msxml3.dll
2011-04-29 14:47 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll
2011-04-29 14:47 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll
2011-04-29 14:47 . 2008-06-26 03:29 565248 ----a-w- c:\windows\system32\emdmgmt.dll
2011-04-29 14:47 . 2008-08-02 03:26 36864 ----a-w- c:\windows\system32\cdd.dll
2011-04-29 14:47 . 2008-08-02 01:01 625152 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-04-29 14:47 . 2008-06-26 03:29 45056 ----a-w- c:\windows\system32\dataclen.dll
2011-04-29 14:47 . 2008-05-20 02:07 148480 ----a-w- c:\windows\system32\drivers\nwifi.sys
2011-04-29 14:46 . 2010-10-28 12:56 2048 ----a-w- c:\windows\system32\tzres.dll
2011-04-29 14:44 . 2011-03-03 10:49 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-29 14:44 . 2010-12-17 16:43 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-04-29 14:44 . 2010-12-17 15:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-04-29 14:44 . 2008-05-08 21:59 90112 ----a-w- c:\windows\system32\wshext.dll
2011-04-29 14:44 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\wshom.ocx
2011-04-29 14:44 . 2008-05-08 21:59 180224 ----a-w- c:\windows\system32\scrobj.dll
2011-04-29 14:44 . 2008-05-08 21:59 155648 ----a-w- c:\windows\system32\wscript.exe
2011-04-29 14:44 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\cscript.exe
2011-04-29 14:44 . 2008-05-08 21:59 172032 ----a-w- c:\windows\system32\scrrun.dll
2011-04-29 14:44 . 2010-06-16 15:59 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-04-29 14:04 . 2010-08-31 15:40 531968 ----a-w- c:\windows\system32\comctl32.dll
2011-04-29 13:20 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{07C0D45E-16EC-4611-9134-3B8A59E239A3}\mpengine.dll
2011-04-29 12:07 . 2011-04-29 12:07 -------- d-----w- C:\PerfLogs
2011-04-15 10:28 . 2011-04-15 10:28 -------- d-----w- c:\programdata\a
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-30 11:24 . 2007-10-24 00:00 45056 ----a-w- c:\windows\system32\acovcnt.exe
2011-04-29 11:05 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-04-29 11:05 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-03-03 14:56 . 2011-04-30 11:45 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 14:56 . 2011-04-30 11:45 459776 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 14:56 . 2011-04-30 11:45 2153984 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 14:56 . 2011-04-30 11:45 541696 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-02-02 16:11 . 2009-10-03 05:31 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-14 16:38 . 2011-04-30 15:17 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-24 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-24 129560]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MultiFrame.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MultiFrame.lnk
backup=c:\windows\pss\MultiFrame.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 18:51 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-26 19:12 161328 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-07-06 03:06 4669440 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
2008-08-15 16:33 1473536 ----a-w- c:\program files\TO2SSM\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
Obsah adresáře 'Naplánované úlohy'
.
2011-05-02 c:\windows\Tasks\User_Feed_Synchronization-{D3FB69CC-AC06-4795-98D6-4F3CFBC968B9}.job
- c:\windows\system32\msfeedssync.exe [2008-11-20 07:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.inbox.com/homepage.aspx?tbid=80093&lng=cs
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Maruska\AppData\Roaming\Mozilla\Firefox\Profiles\9lsg5q40.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=sf&tmpl=11&tbid=80093&language=cs&qkw=
FF - prefs.js: network.proxy.type - 4
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-02 19:58
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(672)
c:\progra~2\a\AppData\Local\Temp\MACROM~1\SWFUPD~1\swfupdate.dll
.
- - - - - - - > 'lsass.exe'(620)
c:\progra~2\a\AppData\Local\Temp\MACROM~1\SWFUPD~1\swfupdate.dll
.
Celkový čas: 2011-05-02 20:03:01
ComboFix-quarantined-files.txt 2011-05-02 18:02
.
Před spuštěním: 7 761 907 712
Po spuštění: 8 345 608 192
.
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - E7E11F42805DE36701ECA5366516DD32

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
  "DisableMonitoring"=dword:00000000
  [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
  [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
  
  DDS::
  uStart Page = hxxp://www.inbox.com/homepage.aspx?tbid=80093&lng=cs
  
  Firefox::
  FF - ProfilePath - c:\users\Maruska\AppData\Roaming\Mozilla\Firefox\Profiles\9lsg5q40.default\
  FF - prefs.js: keyword.URL - hxxp://toolbar.inbox.com/search/dispatc ... ge=cs&qkw=
  
  RegLock::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
  
  File::
  C:\Windows\tasks\User_Feed_Synchronization-{D3FB69CC-AC06-4795-98D6-4F3CFBC968B9}.job
  C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
  C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[Lukvot]

ComboFix 11-05-02.02 - Maruska 02.05.2011 20:44:59.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.1015.380 [GMT 2:00]
Spuštěný z: c:\users\Maruska\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Maruska\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job"
"c:\windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job"
"c:\windows\tasks\User_Feed_Synchronization-{D3FB69CC-AC06-4795-98D6-4F3CFBC968B9}.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\tasks\User_Feed_Synchronization-{D3FB69CC-AC06-4795-98D6-4F3CFBC968B9}.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-02 do 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-05-02 18:57 . 2011-05-02 19:00 -------- d-----w- c:\users\Maruska\AppData\Local\temp
2011-05-02 18:57 . 2011-05-02 18:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-30 19:03 . 2011-04-30 19:03 -------- d-----w- c:\program files\trend micro
2011-04-30 19:03 . 2011-04-30 19:03 -------- d-----w- C:\rsit
2011-04-30 18:47 . 2011-04-30 18:47 -------- d---a-w- c:\windows\rundll16.exe
2011-04-30 18:47 . 2011-04-30 18:47 -------- d---a-w- c:\windows\logo1_.exe
2011-04-30 15:17 . 2011-04-14 16:38 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-04-30 15:17 . 2011-04-14 16:38 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-30 15:17 . 2011-04-14 16:38 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-30 15:17 . 2011-04-14 16:38 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-30 15:17 . 2011-04-14 16:38 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-04-30 15:17 . 2011-04-14 16:38 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-30 15:17 . 2011-04-14 16:38 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-30 15:17 . 2011-04-14 16:38 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-30 15:17 . 2010-01-01 08:00 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-30 15:17 . 2010-01-01 08:00 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-30 13:30 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2011-04-30 12:46 . 2011-04-30 12:46 -------- d-----w- c:\programdata\WindowsSearch
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\VDLL.DLL
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\system32\runouce.exe
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\RUNDL132.EXE
2011-04-30 12:02 . 2011-04-30 12:02 -------- d---a-w- c:\windows\logo_1.exe
2011-04-30 11:49 . 2011-04-30 11:49 632064 ----a-w- c:\windows\system32\msvcr80.dll
2011-04-30 11:49 . 2011-04-30 11:49 554240 ----a-w- c:\windows\system32\msvcp80.dll
2011-04-30 11:49 . 2011-04-30 11:49 34048 ----a-w- c:\windows\system32\eEmpty.exe
2011-04-30 11:49 . 2011-04-30 11:49 -------- d-----w- c:\program files\Common Files\MicroWorld
2011-04-30 11:48 . 2011-04-30 11:49 -------- d-----w- c:\programdata\MicroWorld
2011-04-30 11:45 . 2011-03-03 14:56 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-30 11:45 . 2011-03-03 13:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-29 16:35 . 2010-04-14 17:46 80896 ----a-w- c:\windows\system32\MSNP.ax
2011-04-29 16:35 . 2010-04-14 17:47 293376 ----a-w- c:\windows\system32\psisdecd.dll
2011-04-29 16:35 . 2010-04-14 17:47 217088 ----a-w- c:\windows\system32\psisrndr.ax
2011-04-29 16:30 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-04-29 16:30 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-04-29 16:30 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-04-29 16:30 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-04-29 16:30 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-04-29 16:24 . 2009-10-09 21:56 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2011-04-29 15:41 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-29 15:41 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-29 15:41 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-29 15:41 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-29 15:41 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-29 15:40 . 2011-04-18 17:13 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-29 15:39 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
2011-04-29 15:39 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-04-29 15:39 . 2011-04-29 15:39 -------- d-----w- c:\programdata\AVAST Software
2011-04-29 15:39 . 2011-04-29 15:39 -------- d-----w- c:\program files\AVAST Software
2011-04-29 15:12 . 2011-04-29 15:11 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-04-29 15:12 . 2011-04-29 15:11 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-04-29 15:01 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2011-04-29 15:01 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2011-04-29 15:00 . 2011-03-02 14:49 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-04-29 15:00 . 2009-05-04 10:11 25088 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-04-29 14:54 . 2010-09-06 16:24 125952 ----a-w- c:\windows\system32\srvsvc.dll
2011-04-29 14:54 . 2010-09-06 16:23 17920 ----a-w- c:\windows\system32\netevent.dll
2011-04-29 14:53 . 2010-04-16 16:10 501760 ----a-w- c:\windows\system32\usp10.dll
2011-04-29 14:53 . 2010-10-12 15:48 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2011-04-29 14:53 . 2010-10-12 13:52 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2011-04-29 14:53 . 2010-10-12 13:52 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2011-04-29 14:53 . 2010-08-10 15:02 274432 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 14:53 . 2011-02-16 15:29 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-04-29 14:53 . 2011-02-16 13:24 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-04-29 14:53 . 2010-06-16 15:12 72704 ----a-w- c:\windows\system32\fontsub.dll
2011-04-29 14:53 . 2010-12-28 14:57 409600 ----a-w- c:\windows\system32\odbc32.dll
2011-04-29 14:53 . 2010-12-28 14:56 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-04-29 14:51 . 2011-02-18 13:31 304640 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-29 14:51 . 2011-02-18 13:31 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-29 14:51 . 2011-02-18 13:31 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-29 14:51 . 2010-04-05 16:07 67072 ----a-w- c:\windows\system32\asycfilt.dll
2011-04-29 14:51 . 2010-06-28 16:15 1315840 ----a-w- c:\windows\system32\ole32.dll
2011-04-29 14:51 . 2010-06-28 14:31 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-04-29 14:51 . 2010-08-17 13:32 126464 ----a-w- c:\windows\system32\spoolsv.exe
2011-04-29 14:49 . 2011-03-03 12:53 2040832 ----a-w- c:\windows\system32\win32k.sys
2011-04-29 14:49 . 2010-12-14 15:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
2011-04-29 14:49 . 2010-06-17 17:15 10926592 ----a-w- c:\program files\Movie Maker\MOVIEMK.dll
2011-04-29 14:49 . 2010-06-17 15:49 150016 ----a-w- c:\program files\Movie Maker\MOVIEMK.exe
2011-04-29 14:49 . 2010-04-05 16:08 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
2011-04-29 14:49 . 2011-02-16 15:35 430080 ----a-w- c:\windows\system32\vbscript.dll
2011-04-29 14:49 . 2011-03-03 15:00 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 14:47 . 2010-10-18 14:01 81920 ----a-w- c:\windows\system32\consent.exe
2011-04-29 14:47 . 2010-06-11 15:30 1257472 ----a-w- c:\windows\system32\msxml3.dll
2011-04-29 14:47 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll
2011-04-29 14:47 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll
2011-04-29 14:47 . 2008-06-26 03:29 565248 ----a-w- c:\windows\system32\emdmgmt.dll
2011-04-29 14:47 . 2008-08-02 03:26 36864 ----a-w- c:\windows\system32\cdd.dll
2011-04-29 14:47 . 2008-08-02 01:01 625152 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-04-29 14:47 . 2008-06-26 03:29 45056 ----a-w- c:\windows\system32\dataclen.dll
2011-04-29 14:47 . 2008-05-20 02:07 148480 ----a-w- c:\windows\system32\drivers\nwifi.sys
2011-04-29 14:46 . 2010-10-28 12:56 2048 ----a-w- c:\windows\system32\tzres.dll
2011-04-29 14:44 . 2011-03-03 10:49 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-29 14:44 . 2010-12-17 16:43 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-04-29 14:44 . 2010-12-17 15:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-04-29 14:44 . 2008-05-08 21:59 90112 ----a-w- c:\windows\system32\wshext.dll
2011-04-29 14:44 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\wshom.ocx
2011-04-29 14:44 . 2008-05-08 21:59 180224 ----a-w- c:\windows\system32\scrobj.dll
2011-04-29 14:44 . 2008-05-08 21:59 155648 ----a-w- c:\windows\system32\wscript.exe
2011-04-29 14:44 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\cscript.exe
2011-04-29 14:44 . 2008-05-08 21:59 172032 ----a-w- c:\windows\system32\scrrun.dll
2011-04-29 14:44 . 2010-06-16 15:59 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-04-29 14:04 . 2010-08-31 15:40 531968 ----a-w- c:\windows\system32\comctl32.dll
2011-04-29 13:20 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{07C0D45E-16EC-4611-9134-3B8A59E239A3}\mpengine.dll
2011-04-29 12:07 . 2011-04-29 12:07 -------- d-----w- C:\PerfLogs
2011-04-15 10:28 . 2011-04-15 10:28 -------- d-----w- c:\programdata\a
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-02 18:59 . 2007-10-24 00:00 45056 ----a-w- c:\windows\system32\acovcnt.exe
2011-04-29 11:05 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-04-29 11:05 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-03-03 14:56 . 2011-04-30 11:45 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 14:56 . 2011-04-30 11:45 459776 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 14:56 . 2011-04-30 11:45 2153984 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 14:56 . 2011-04-30 11:45 541696 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-02-02 16:11 . 2009-10-03 05:31 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-14 16:38 . 2011-04-30 15:17 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-24 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-24 129560]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MultiFrame.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MultiFrame.lnk
backup=c:\windows\pss\MultiFrame.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-07-06 03:06 4669440 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
2008-08-15 16:33 1473536 ----a-w- c:\program files\TO2SSM\McciTrayApp.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Maruska\AppData\Roaming\Mozilla\Firefox\Profiles\9lsg5q40.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 4
.
.
**************************************************************************
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory:
.
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\ATK Hotkey\ASLDRSrv.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\ATK Hotkey\Hcontrol.exe
c:\program files\ATKOSD2\ATKOSD2.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\Net4Switch\Net4Switch.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2011-05-02 21:11:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-05-02 19:10
ComboFix2.txt 2011-05-02 18:03
.
Před spuštěním: 8 324 354 048
Po spuštění: 8 304 742 400
.
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - B5B38BE177026592E90060C9927EA5C3

[vyosek]

Jak se chova PC

[Lukvot]

Počítač se výkonově zlepšil a přestal se bezdůvodně odpojovat od wifi. Jen mě trochu znervózňuje značná aktivita HDD (cca 5 až 10 min po startu systému vytrvale rachtá).

[vyosek]

Nemate zaple indexovani (takove to priblble hledani ve windows), vetsinou vpravo dole...

Uklidime a pripadne udelame dalsi testy

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Doporucuji provest defragmentaci disku

• Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
  • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
  • prepnete se do zalozky Nastroje
  • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
  • Toto provedte se vsemi disky
• Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
  • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
  • Kliknete na Analyzovat
  • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
  • Postup provedte se vsemi disky
• Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
  • Vyhodou programku je, ze se neinstaluje
  • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
  • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
  • Probehne analyza disku a nasledne i defragmentace

Napiste jak se chova PC

[Lukvot]

Děkuji za pomoc, zdá se že havěti jsme zakroutili krkem. Notebook se chová zcela normálně. Neutuchající disková aktivita po startu je zřejmě typickým projevem windows Vista. Ještě jednou Díky.

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy