velice pomalý pc

[Happygirl.]

Prosím o kontrolu, mám pocit že se mi tam usídlil někde nějaký vir:)Děkuji


Logfile of random's system information tool 1.09 (written by random/random)
Run by Luciuska at 2011-12-28 11:31:18
Microsoft Windows 7 Ultimate
System drive C: has 4 GB (11%) free of 40 GB
Total RAM: 3068 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:33:00, on 28.12.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe
C:\Program Files\Lexmark S300-S400 Series\ezprint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Explorer.exe
C:\Users\Luciuska\Downloads\RSIT.exe
C:\Program Files\trend micro\Luciuska.exe

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [lxeamon.exe] "C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark S300-S400 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: lxeaCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxeaserv.exe
O23 - Service: lxea_device - - C:\Windows\system32\lxeacoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

--
End of file - 4150 bytes

======Scheduled tasks folder======

C:\Windows\tasks\AWC AutoSweep.job
C:\Windows\tasks\AWC Startup.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-07-02 2202704]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-07-06 9394792]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"IObit Security 360"=C:\Program Files\IObit\IObit Security 360\IS360tray.exe [2010-06-11 1280344]
"lxeamon.exe"=C:\Program Files\Lexmark S300-S400 Series\lxeamon.exe [2011-01-24 770728]
"EzPrint"=C:\Program Files\Lexmark S300-S400 Series\ezprint.exe [2011-01-24 148280]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-04-29 1090952]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-26 2210608]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-12-28 11:15:13 ----ASH---- C:\pagefile.sys
2011-12-24 21:06:10 ----AH---- C:\Windows\system32\ezsidmv.dat
2011-12-24 09:14:23 ----D---- C:\Windows\Sun
2011-12-23 22:32:01 ----SHD---- C:\$RECYCLE.BIN
2011-12-23 22:31:55 ----A---- C:\ComboFix.txt
2011-12-23 22:19:36 ----D---- C:\ComboFix
2011-12-23 18:28:51 ----D---- C:\Program Files\Common Files\Java
2011-12-23 18:28:27 ----A---- C:\Windows\system32\javaws.exe
2011-12-23 18:28:27 ----A---- C:\Windows\system32\javaw.exe
2011-12-23 18:28:27 ----A---- C:\Windows\system32\java.exe
2011-12-13 20:32:52 ----D---- C:\Windows\system32\Logfiles
2011-12-13 20:32:03 ----N---- C:\bootsqm.dat
2011-12-13 20:30:05 ----D---- C:\found.001
2011-12-13 19:34:43 ----D---- C:\Lexmark ToolBar
2011-12-13 16:05:52 ----D---- C:\ProgramData\Ezprint
2011-12-12 13:31:48 ----D---- C:\ProgramData\Lx_cats
2011-12-12 13:28:46 ----A---- C:\Windows\system32\lxeavs.dll
2011-12-12 13:28:44 ----A---- C:\Windows\system32\lxeacoin.dll
2011-12-12 13:28:36 ----A---- C:\Windows\system32\lxk_gf.dll
2011-12-12 13:28:36 ----A---- C:\Windows\system32\lxeagcfg.dll
2011-12-12 13:28:35 ----A---- C:\Windows\system32\lxeacuir.dll
2011-12-12 13:28:35 ----A---- C:\Windows\system32\lxeacui.dll
2011-12-12 13:27:35 ----D---- C:\Program Files\Abbyy FineReader 6.0 Sprint
2011-12-12 13:27:19 ----A---- C:\Windows\system32\LXEAwupd.exe
2011-12-12 13:27:19 ----A---- C:\Windows\system32\LXEAwupd.dll
2011-12-12 13:26:28 ----D---- C:\Program Files\Lexmark
2011-12-12 13:26:07 ----D---- C:\Program Files\Lexmark Printable Web
2011-12-12 13:25:58 ----AH---- C:\Windows\system32\lxearwrd.ini
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeausb1.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\LXEAinst.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeainpa.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\lxeaiesc.dll
2011-12-12 13:25:43 ----A---- C:\Windows\system32\LXEAhcp.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeaserv.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeapmui.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxealmpm.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeajswr.dll
2011-12-12 13:25:42 ----A---- C:\Windows\system32\lxeainsb.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeainsr.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeains.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeaih.exe
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeahbn3.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeagrd.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeacur.dll
2011-12-12 13:25:41 ----A---- C:\Windows\system32\lxeacub.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacu.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacoms.exe
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacomm.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacomc.dll
2011-12-12 13:25:40 ----A---- C:\Windows\system32\lxeacfg.exe
2011-12-12 13:25:40 ----A---- C:\Windows\system32\LXEAcfg.dll
2011-12-12 13:25:22 ----A---- C:\ProgramData\UpdaterLog.txt
2011-12-12 13:25:08 ----D---- C:\Program Files\Lexmark S300-S400 Series
2011-12-12 13:25:08 ----A---- C:\Windows\system32\LXEAsmr.dll
2011-12-12 13:25:08 ----A---- C:\Windows\system32\LXEAsm.dll
2011-12-04 15:51:19 ----D---- C:\Users\Luciuska\AppData\Roaming\Nero
2011-12-04 15:45:18 ----D---- C:\ProgramData\Nero
2011-12-04 15:38:33 ----D---- C:\Program Files\Microsoft Silverlight
2011-12-04 15:24:39 ----D---- C:\Program Files\Conduit
2011-12-04 15:24:24 ----D---- C:\Users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 14:58:41 ----D---- C:\Users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 14:58:28 ----D---- C:\ProgramData\ashampoo

======List of files/folders modified in the last 1 month======

2011-12-28 11:32:53 ----D---- C:\Windows\temp
2011-12-28 11:32:12 ----D---- C:\Program Files\trend micro
2011-12-28 11:23:15 ----D---- C:\Windows\System32
2011-12-28 11:23:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-12-28 11:23:13 ----D---- C:\Windows\inf
2011-12-28 11:20:24 ----D---- C:\Windows\system32\Tasks
2011-12-28 11:19:59 ----D---- C:\Windows\system32\drivers
2011-12-28 11:19:38 ----RD---- C:\Program Files
2011-12-28 11:19:06 ----SHD---- C:\Windows\Installer
2011-12-28 11:19:05 ----D---- C:\Windows
2011-12-28 11:19:05 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-12-28 11:19:05 ----D---- C:\Config.Msi
2011-12-28 11:18:59 ----D---- C:\Program Files\Zoner
2011-12-28 11:17:08 ----D---- C:\Windows\Prefetch
2011-12-28 11:01:04 ----D---- C:\Program Files\Common Files
2011-12-28 10:59:55 ----SHD---- C:\System Volume Information
2011-12-28 10:56:58 ----RSD---- C:\Windows\Fonts
2011-12-28 10:56:39 ----D---- C:\Windows\system32\DriverStore
2011-12-28 10:56:39 ----D---- C:\Windows\system32\catroot
2011-12-28 10:56:34 ----D---- C:\Windows\twain_32
2011-12-28 10:56:22 ----D---- C:\ProgramData
2011-12-28 09:00:34 ----D---- C:\Users\Luciuska\AppData\Roaming\uTorrent
2011-12-28 08:28:32 ----D---- C:\Windows\cs-CZ
2011-12-27 14:12:04 ----D---- C:\Users\Luciuska\AppData\Roaming\Skype
2011-12-27 13:48:39 ----D---- C:\Users\Luciuska\AppData\Roaming\skypePM
2011-12-27 12:00:35 ----D---- C:\Windows\Minidump
2011-12-25 16:25:19 ----D---- C:\Windows\system32\catroot2
2011-12-25 15:42:02 ----D---- C:\Users\Luciuska\AppData\Roaming\SMS posílač Treca
2011-12-25 15:27:45 ----D---- C:\Program Files\QIP
2011-12-25 15:27:38 ----D---- C:\Program Files\PhotoFiltre
2011-12-23 22:31:59 ----D---- C:\Qoobox
2011-12-23 22:29:31 ----A---- C:\Windows\system.ini
2011-12-23 22:29:21 ----D---- C:\Windows\system32\drivers\etc
2011-12-23 22:28:31 ----D---- C:\Program Files\Your Product
2011-12-23 22:25:06 ----D---- C:\Windows\AppPatch
2011-12-23 22:11:11 ----D---- C:\Windows\system32\NDF
2011-12-23 18:28:14 ----D---- C:\Program Files\Java
2011-12-23 08:41:14 ----D---- C:\Users\Luciuska\AppData\Roaming\vlc
2011-12-21 11:54:15 ----D---- C:\Program Files\SMS posílač Treca
2011-12-13 16:09:22 ----SD---- C:\Users\Luciuska\AppData\Roaming\Microsoft
2011-12-04 15:38:44 ----SD---- C:\ProgramData\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor32;nvstor32; C:\Windows\system32\DRIVERS\nvstor32.sys [2009-08-04 213024]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 16184]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-14 691696]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2009-06-28 59904]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-07-06 3132712]
R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2010-04-30 134256]
R3 netr28;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28.sys [2010-05-17 793440]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2010-06-21 105576]
R3 NVNET;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmf6232.sys [2010-08-12 298216]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2009-06-28 17920]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2009-07-13 1068032]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
R3 WSDPrintDevice;WSD Print Support via UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 aqkjcm43;aqkjcm43; C:\Windows\system32\drivers\aqkjcm43.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 catchme;catchme; \??\C:\Users\Luciuska\AppData\Local\Temp\catchme.sys []
S3 epmntdrv;epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [2010-07-15 14216]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [2010-07-15 8456]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\Windows\system32\DRIVERS\s115bus.sys [2007-04-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s115mdm.sys [2007-04-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s115obex.sys [2007-04-23 98568]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 84992]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2011-01-15 30208]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vpnva;Cisco AnyConnect VPN Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2011-02-11 19680]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
R2 IS360service;IS360service; C:\Program Files\IObit\IObit Security 360\IS360srv.exe [2010-06-11 312152]
R2 lxea_device;lxea_device; C:\Windows\system32\lxeacoms.exe [2010-04-14 598696]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 129640]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 vpnagent;Cisco AnyConnect VPN Agent; C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-02-11 603896]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 lxeaCATSCustConnectService;lxeaCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxeaserv.exe [2010-04-14 193192]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-07-02 33584]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-31 1343400]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji
Vas log se studuje a pracuje se na nem .
Prosim o strpeni!

[vyosek]

Poprosim i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

Predpokladam, ze ten NOD32 mate legalni = zakoupena licence

ComboFix vam poradil kdo prosim vizte pravidla fora - bod 3 http://www.viry.cz/forum/viewtopic.php?f=12&t=5601

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Poprosim i o log z ComboFixu kdyz uz jej mate - je umisten v c:\combofix.txt

Perou se vam tam dva bezpecnostni softy - NOD a ten kram od IOBit, ktery dle meho nepatri do PC - vizte dale

Odinstalujte IObit Security 360 a nasledne i vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

[Happygirl.]

info.txt logfile of random's system information tool 1.08 2010-10-28 12:00:12

======Uninstall list======

-->MsiExec /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe -maintain activex
Adobe Reader 8.2.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A82000000003}
Ape Ripper 5.2.2-->"C:\Program Files\Ape Ripper\unins000.exe"
ATI Catalyst Install Manager-->msiexec /q/x{FD1E62F4-33DC-87C5-8C4A-77D2D8D5ACB8} REBOOT=ReallySuppress
CDex - Open Source Digital Audio CD Extractor-->C:\Program Files\CDex\uninstall.exe
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
EASEUS Partition Master 6.1.1 Home Edition-->"C:\Program Files\EASEUS\EASEUS Partition Master 6.1.1 Home Edition\unins000.exe"
ENE CIR Receiver Driver-->C:\PROGRA~1\DIFX\198A84B0EB590201\DPInst.exe /u C:\Windows\System32\DriverStore\FileRepository\enecir.inf_x86_neutral_ccbb7e1951a44bab\enecir.inf
Flac Ripper 4.0.1-->"C:\Program Files\Flac Ripper\unins000.exe"
Java(TM) 6 Update 22-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022FF}
JMicron Flash Media Controller Driver-->"C:\Program Files\JMicron\JMCR_DIR\setup.exe" delpkg
Magic FLAC to MP3 Converter 3.72-->"C:\Program Files\FLAC to MP3 Converter\unins000.exe"
Microsoft Office Access MUI (Czech) 2007-->MsiExec.exe /X{90120000-0015-0405-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Czech) 2007-->MsiExec.exe /X{90120000-0016-0405-0000-0000000FF1CE}
Microsoft Office Groove MUI (Czech) 2007-->MsiExec.exe /X{90120000-00BA-0405-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Czech) 2007-->MsiExec.exe /X{90120000-0044-0405-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Czech) 2007-->MsiExec.exe /X{90120000-00A1-0405-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Czech) 2007-->MsiExec.exe /X{90120000-001A-0405-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Czech) 2007-->MsiExec.exe /X{90120000-0018-0405-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Czech) 2007-->MsiExec.exe /X{90120000-002C-0405-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Czech) 2007-->MsiExec.exe /X{90120000-0019-0405-0000-0000000FF1CE}
Microsoft Office Shared MUI (Czech) 2007-->MsiExec.exe /X{90120000-006E-0405-0000-0000000FF1CE}
Microsoft Office Word MUI (Czech) 2007-->MsiExec.exe /X{90120000-001B-0405-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
NVIDIA Display Control Panel-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{8A809006-C25A-4A3A-9DAB-94659BCDB107}
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Ralink RT2860 Wireless LAN Card-->C:\Program Files\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SMS posílač Treca-->"C:\Program Files\SMS posílač Treca\unins000.exe"
Sony Ericsson PC Suite 6.011.00-->"C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe" -runfromtemp -l0x0009 -removeonly
VLC media player 1.1.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vypalovač CD / DVD / Blu-ray / HD-DVD 1.25-->"C:\Program Files\Vypalovač\unins000.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Your Product-->"C:\Windows\Your Product\uninstall.exe" "/U:C:\Program Files\Your Product\Uninstall\uninstall.xml"

======System event log======

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Diagnostic Policy Service byl změněn na: stopped
Record Number: 5
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6005
Message: Služba Event Log byla spuštěna.
Record Number: 4
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.01. 7600 Multiprocessor Free.
Record Number: 3
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 6011
Message: Název tohoto počítače v systémech DNS a NetBIOS byl změněn z 37L4247D28-05 na WIN-PQEFBV0KC8K.
Record Number: 2
Source Name: EventLog
Time Written: 20100731150927.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Microsoft Software Shadow Copy Provider byl změněn na: stopped
Record Number: 1
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: 37L4247D28-05
Event Code: 900
Message: Služba Ochrana softwaru se spouští.

Record Number: 5
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20100731151154.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20100731150936.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 3
Source Name: Microsoft-Windows-WMI
Time Written: 20100731150933.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.


Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20100731150928.570400-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: 37L4247D28-05
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 1
Source Name: Microsoft-Windows-EventSystem
Time Written: 20100731150928.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: 37L4247D28-05
Event Code: 4735
Message: Byla změněna zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Změněné atributy:
Název účtu SAM: -
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.983200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4731
Message: Byla vytvořena zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Nová skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Atributy:
Název účtu SAM: Backup Operators
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.983200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.

Počet prvků: 0
ID zásady: 0x32155
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150904.702400-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4624
Message: Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 0

Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x4
Název procesu:

Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150903.267200-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4608
Message: Spouští se systém Windows.

Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100731150903.220400-000
Event Type: Úspěšný audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;c:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Common Files\Teleca Shared
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=17
"PROCESSOR_IDENTIFIER"=x86 Family 17 Model 3 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0301

-----------------EOF-----------------



ComboFix 11-12-23.01 - Luciuska 23.12.2011 22:21:03.13.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3068.2105 [GMT 1:00]
Spuštěný z: c:\users\Luciuska\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Your Product\Uninstall
c:\program files\Your Product\Uninstall\IRIMG1.JPG
c:\program files\Your Product\Uninstall\IRIMG2.JPG
c:\program files\Your Product\Uninstall\uninstall.dat
c:\program files\Your Product\Uninstall\uninstall.xml
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-23 do 2011-12-23 )))))))))))))))))))))))))))))))
.
.
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Luciuska\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-23 21:29 . 2011-12-23 21:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-23 19:00 . 2011-12-23 19:00 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\offreg.dll
2011-12-23 17:28 . 2011-12-23 17:28 -------- d-----w- c:\program files\Common Files\Java
2011-12-13 19:32 . 2011-12-13 19:35 -------- d-----w- c:\windows\system32\Logfiles
2011-12-13 19:30 . 2011-12-13 19:30 -------- d-----w- C:\found.001
2011-12-13 18:34 . 2011-12-13 18:34 -------- d-----w- c:\users\Luciuska\AppData\Local\AskToolbar
2011-12-13 18:34 . 2011-12-13 18:34 -------- d-----w- C:\Lexmark ToolBar
2011-12-13 15:05 . 2011-12-13 15:05 -------- d-----w- c:\programdata\Ezprint
2011-12-13 12:53 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\mpengine.dll
2011-12-12 12:31 . 2011-12-19 09:11 -------- d-----w- c:\programdata\Lx_cats
2011-12-12 12:30 . 2009-11-04 13:14 157696 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxeadrpp.dll
2011-12-12 12:28 . 2008-03-05 02:55 40960 ----a-w- c:\windows\system32\lxeavs.dll
2011-12-12 12:28 . 2010-04-13 19:41 442368 ----a-w- c:\windows\system32\lxeacoin.dll
2011-12-12 12:28 . 2009-11-09 07:59 86016 ----a-w- c:\windows\system32\lxeagcfg.dll
2011-12-12 12:28 . 2008-04-30 06:32 983121 ----a-w- c:\windows\system32\lxk_gf.dll
2011-12-12 12:28 . 2009-10-21 10:06 110592 ----a-w- c:\windows\system32\lxeacuir.dll
2011-12-12 12:28 . 2009-10-21 10:06 294912 ----a-w- c:\windows\system32\lxeacui.dll
2011-12-12 12:27 . 2011-12-12 12:28 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2011-12-12 12:27 . 2010-04-14 20:45 213672 ----a-w- c:\windows\system32\LXEAwupd.exe
2011-12-12 12:27 . 2010-02-22 10:08 372736 ----a-w- c:\windows\system32\LXEAwupd.dll
2011-12-12 12:26 . 2011-12-12 12:28 -------- d-----w- c:\program files\Lexmark
2011-12-12 12:26 . 2011-12-13 18:34 -------- d-----w- c:\program files\Lexmark Toolbar
2011-12-12 12:26 . 2011-12-12 12:26 -------- d-----w- c:\program files\Lexmark Printable Web
2011-12-04 14:51 . 2011-12-04 14:51 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Nero
2011-12-04 14:45 . 2011-12-04 14:45 -------- d-----w- c:\programdata\Nero
2011-12-04 14:45 . 2011-12-04 14:45 -------- d-----w- c:\program files\Common Files\Nero
2011-12-04 14:44 . 2011-12-04 14:45 -------- d-----w- c:\program files\Nero
2011-12-04 14:38 . 2011-12-04 14:38 -------- d-----w- c:\program files\Microsoft Silverlight
2011-12-04 14:37 . 2011-12-04 14:37 -------- d-----w- c:\program files\Ask.com
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Local\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\FreeOnlineRadioPlayerRecorder
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 14:24 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2011-12-04 14:24 . 2005-02-24 10:51 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2011-12-04 14:24 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\All Free Disc Burner
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Local\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\programdata\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\program files\Ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 04:54 . 2010-10-21 10:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f999a48b-1950-4d81-9971-79018f807b4b}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-21 11:17 1233288 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f999a48b-1950-4d81-9971-79018f807b4b}]
2011-05-09 08:49 176936 ----a-w- c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f999a48b-1950-4d81-9971-79018f807b4b}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]
"{F999A48B-1950-4D81-9971-79018F807B4B}"= "c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-07-06 9394792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2010-06-11 1280344]
"lxeamon.exe"="c:\program files\Lexmark S300-S400 Series\lxeamon.exe" [2011-01-24 770728]
"EzPrint"="c:\program files\Lexmark S300-S400 Series\ezprint.exe" [2011-01-24 148280]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-12-23 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2011-04-02 12:11]
.
2011-12-23 c:\windows\Tasks\AWC Startup.job
- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2011-04-02 08:38]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
- c:\users\Luciuska\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-31 15:34]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
- c:\users\Luciuska\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-31 15:34]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: vsb.cz\vpn
TCP: DhcpNameServer = 10.0.0.138
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,3e,2e,33,f1,c2,6e,4c,91,ef,e1,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,3e,2e,33,f1,c2,6e,4c,91,ef,e1,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2011-12-23 22:31:55
ComboFix-quarantined-files.txt 2011-12-23 21:31
ComboFix2.txt 2011-10-07 08:30
ComboFix3.txt 2011-08-20 09:27
ComboFix4.txt 2011-03-20 08:01
ComboFix5.txt 2011-12-23 21:19
.
Před spuštěním: 1 202 757 632
Po spuštění: 1 850 224 640
.
- - End Of File - - 04585B33AC6779282126E938F1517B5A



Combofix mi poradil kamarád co pracuje s počítači, ale jestli to byla chyba, tak se předem omlouvám. Jinak progamy odinstaluji.

[vyosek]

Chyba je pokud s ComboFixem kamarad neumi = neumi precist log a napsat skript na docisteni

Predpokladam, ze ten NOD32 mate legalni = zakoupena licence

[Happygirl.]

ano, legální. Chtěla bych se zeptat zda teda jsou zde nějaké problémy ohledně virů?

[vyosek]

Hlidejte si volne misto na disku, pokud je pod 10 GB, system se dusi

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\users\Luciuska\AppData\Local\AskToolbar
  C:\Lexmark ToolBar
  c:\program files\IObit
  c:\program files\Ask.com
  
  RegLock::
  [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
  
  File::
  c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll
  C:\Windows\tasks\AWC AutoSweep.job
  C:\Windows\tasks\AWC Startup.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
  
  Driver::
  IS360service
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{f999a48b-1950-4d81-9971-79018f807b4b}"=-
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{f999a48b-1950-4d81-9971-79018f807b4b}"=-
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  "{F999A48B-1950-4D81-9971-79018F807B4B}"=-
  [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  [-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  [-HKEY_CLASSES_ROOT\clsid\{f999a48b-1950-4d81-9971-79018f807b4b}]
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "IObit Security 360"=-
  "SunJavaUpdateSched"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
  
  ClearJavaCache::
  
  AtJob::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[Happygirl.]

ComboFix 11-12-28.02 - Luciuska 28.12.2011 12:05:28.14.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3068.2026 [GMT 1:00]
Spuštěný z: c:\users\Luciuska\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Luciuska\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\FreeOnlineRadioPlayerRecorder\prxtbFree.dll"
"c:\windows\tasks\AWC AutoSweep.job"
"c:\windows\tasks\AWC Startup.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Lexmark ToolBar
c:\lexmark toolbar\Apps\Toolbar\CZECH\resource.dll
c:\lexmark toolbar\Apps\Toolbar\CZECH\setupres.dll
c:\lexmark toolbar\Apps\Toolbar\CZECH\tbsched.exe
c:\lexmark toolbar\Apps\Toolbar\setup.exe
c:\lexmark toolbar\Apps\Toolbar\toolband.dll
c:\users\Luciuska\AppData\Local\AskToolbar
c:\users\Luciuska\AppData\Local\AskToolbar\Downloaded Program Files\Nero.dll
c:\users\Luciuska\AppData\Local\AskToolbar\Downloaded Program Files\Nero.inf
c:\windows\tasks\AWC AutoSweep.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001Core.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1101654690-487955039-4221684660-1001UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-28 do 2011-12-28 )))))))))))))))))))))))))))))))
.
.
2011-12-28 11:23 . 2011-12-28 11:26 -------- d-----w- c:\users\Luciuska\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-28 11:23 . 2011-12-28 11:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-28 10:19 . 2011-12-28 10:19 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\offreg.dll
2011-12-24 08:14 . 2011-12-24 08:14 -------- d-----w- c:\windows\Sun
2011-12-23 17:28 . 2011-12-23 17:28 -------- d-----w- c:\program files\Common Files\Java
2011-12-13 19:32 . 2011-12-13 19:35 -------- d-----w- c:\windows\system32\Logfiles
2011-12-13 19:30 . 2011-12-13 19:30 -------- d-----w- C:\found.001
2011-12-13 15:05 . 2011-12-13 15:05 -------- d-----w- c:\programdata\Ezprint
2011-12-13 12:53 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED724C98-29D8-4E42-831B-436C165B0007}\mpengine.dll
2011-12-12 12:31 . 2011-12-19 09:11 -------- d-----w- c:\programdata\Lx_cats
2011-12-12 12:30 . 2009-11-04 13:14 157696 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxeadrpp.dll
2011-12-12 12:28 . 2008-03-05 02:55 40960 ----a-w- c:\windows\system32\lxeavs.dll
2011-12-12 12:28 . 2010-04-13 19:41 442368 ----a-w- c:\windows\system32\lxeacoin.dll
2011-12-12 12:28 . 2009-11-09 07:59 86016 ----a-w- c:\windows\system32\lxeagcfg.dll
2011-12-12 12:28 . 2008-04-30 06:32 983121 ----a-w- c:\windows\system32\lxk_gf.dll
2011-12-12 12:28 . 2009-10-21 10:06 110592 ----a-w- c:\windows\system32\lxeacuir.dll
2011-12-12 12:28 . 2009-10-21 10:06 294912 ----a-w- c:\windows\system32\lxeacui.dll
2011-12-12 12:27 . 2011-12-12 12:28 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2011-12-12 12:27 . 2010-04-14 20:45 213672 ----a-w- c:\windows\system32\LXEAwupd.exe
2011-12-12 12:27 . 2010-02-22 10:08 372736 ----a-w- c:\windows\system32\LXEAwupd.dll
2011-12-12 12:26 . 2011-12-12 12:28 -------- d-----w- c:\program files\Lexmark
2011-12-12 12:26 . 2011-12-28 09:51 -------- d-----w- c:\program files\Lexmark Printable Web
2011-12-04 14:51 . 2011-12-04 14:51 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Nero
2011-12-04 14:45 . 2011-12-28 10:00 -------- d-----w- c:\programdata\Nero
2011-12-04 14:38 . 2011-12-04 14:38 -------- d-----w- c:\program files\Microsoft Silverlight
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\program files\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Local\Conduit
2011-12-04 14:24 . 2011-12-04 14:24 -------- d-----w- c:\users\Luciuska\AppData\Roaming\All Free Disc Burner
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Roaming\Ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\users\Luciuska\AppData\Local\ashampoo
2011-12-04 13:58 . 2011-12-04 13:58 -------- d-----w- c:\programdata\ashampoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 04:54 . 2010-10-21 10:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-07-06 9394792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"lxeamon.exe"="c:\program files\Lexmark S300-S400 Series\lxeamon.exe" [2011-01-24 770728]
"EzPrint"="c:\program files\Lexmark S300-S400 Series\ezprint.exe" [2011-01-24 148280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-17 218688]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
.
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: vsb.cz\vpn
TCP: DhcpNameServer = 192.168.2.1
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn.vsb.cz/CACHE/stc/1/binaries/vpnweb.cab
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\windows\system32\lxeacoms.exe
c:\windows\system32\nvvsvc.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Celkový čas: 2011-12-28 12:32:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-28 11:32
ComboFix2.txt 2011-12-23 21:31
ComboFix3.txt 2011-10-07 08:30
ComboFix4.txt 2011-08-20 09:27
ComboFix5.txt 2011-12-28 11:04
.
Před spuštěním: 5 384 237 056
Po spuštění: 5 248 057 344
.
- - End Of File - - 200A63734B01FAABEC0423C3DB2AE1D7



Vyskytla se chyba ohledně prohlížeče, že po kliknutí mi to ukazuje že je prohlížen v registrech klíče připravený k odstranění -> C:\Users\Luciuska\AppData\Local\Google\Chrome\Application\chrome.exe Pokus použít neplatnou operaci na klíč egistru, který je označen pro odstranění.

[vyosek]

Restartujte PC, melo by se to dat do kopy

Pak napiste co PC

[Happygirl.]

Na disku mám již 11 gb volného, a vše funguje parádně. Děkuji za pomoc:) a přeji krásný den:)

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden