Preventivka, moc díky!

[Kastab]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2012-09-14 12:29:47
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 211 GB (69%) free of 305 GB
Total RAM: 1023 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:30:09, on 14.9.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\windows\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Dokumenty\Downloads\World of Warcraft 3.3.5a (no install)\Wow.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Startup: Warcraft Config.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4695 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-05 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-05 157672]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-08-11 77824]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-08-21 4282728]
"ROC_roc_ssl_v12"=C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe / /PROMPT /CMPID=roc_ssl_v12 []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2012-08-30 15512424]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2012-08-30 108392]
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2012-08-30 1634112]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe [2012-09-01 116648]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-09-01 895376]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-04-11 3672384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /starttray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2012-06-26 1516632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2012-07-13 17418928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2012-09-01 895376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MBAMService"=2
"SkypeUpdate"=2
"ServiceLayer"=3

C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
Warcraft Config.lnk - C:\Gamesy\Warcraft III Reign of Chaos & The Frozen Throne\support\config.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Gamesy\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Gamesy\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Gamesy\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat"="C:\Gamesy\Electronic Arts\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Program Files\Garena Plus\Room\garena_room.exe"="C:\Program Files\Garena Plus\Room\garena_room.exe:*:Enabled:Garena"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"midi"=wdmaud.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\windows\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\windows\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.divxa32"=msaud32_divx.acm
"wave1"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer4"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-09-14 12:00:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA
2012-09-14 12:00:18 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2012-09-14 12:00:18 ----A---- C:\WINDOWS\system32\nvcolor.exe
2012-09-14 12:00:17 ----A---- C:\WINDOWS\system32\nvmctray.dll
2012-09-14 12:00:17 ----A---- C:\WINDOWS\system32\nvcpl.dll
2012-09-14 12:00:16 ----A---- C:\WINDOWS\system32\nvwddi.dll
2012-09-14 11:59:55 ----D---- C:\temp
2012-09-14 11:59:54 ----A---- C:\WINDOWS\system32\OpenCL.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvopencl.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvdispgenco32.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvdispco32.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2012-09-14 11:59:25 ----A---- C:\WINDOWS\system32\nvcuda.dll
2012-09-14 11:59:24 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2012-09-14 11:59:24 ----A---- C:\WINDOWS\system32\nvapi.dll
2012-09-14 08:21:17 ----D---- C:\Documents and Settings\Administrator\Data aplikací\GarenaPlus
2012-09-14 08:20:44 ----D---- C:\Program Files\Garena Plus
2012-09-14 08:20:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\GarenaMessenger
2012-09-14 08:15:49 ----D---- C:\Documents and Settings\Administrator\Data aplikací\My Battle for Middle-earth(tm) II Files
2012-09-14 01:57:09 ----D---- C:\WINDOWS\RegisteredPackages
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\psisdecd.dll
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\wstcodec.sys
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\streamip.sys
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\slip.sys
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\ndisip.sys
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\nabtsfec.sys
2012-09-14 01:56:40 ----A---- C:\WINDOWS\system32\drivers\msdv.sys
2012-09-14 01:56:39 ----A---- C:\WINDOWS\system32\drivers\mstee.sys
2012-09-14 01:56:39 ----A---- C:\WINDOWS\system32\drivers\mpe.sys
2012-09-14 01:56:39 ----A---- C:\WINDOWS\system32\drivers\ccdecode.sys
2012-09-14 01:56:39 ----A---- C:\WINDOWS\system32\drivers\bdasup.sys
2012-09-14 01:56:34 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2012-09-14 01:50:39 ----D---- C:\Program Files\Microsoft Games
2012-09-12 21:56:57 ----A---- C:\WINDOWS\game.ini
2012-09-12 21:53:30 ----D---- C:\Gamesy
2012-09-10 18:41:50 ----D---- C:\Program Files\PhotoScape
2012-09-09 19:13:14 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2012-09-09 19:13:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\DAEMON Tools Lite
2012-09-09 19:13:07 ----D---- C:\Program Files\DAEMON Tools Lite
2012-09-09 19:10:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2012-09-07 20:47:58 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll
2012-09-07 20:47:39 ----HD---- C:\Documents and Settings\Administrator\Data aplikací\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2012-09-07 17:46:09 ----D---- C:\Documents and Settings\Administrator\Data aplikací\.spoutcraft
2012-09-07 14:13:01 ----D---- C:\WINDOWS\Sun
2012-09-07 13:19:22 ----D---- C:\Documents and Settings\Administrator\Data aplikací\.minecraft
2012-09-06 16:31:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA Corporation
2012-09-05 20:16:39 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Opera
2012-09-05 20:16:28 ----D---- C:\Program Files\Opera
2012-09-05 19:58:02 ----D---- C:\WINDOWS\pss
2012-09-05 19:54:45 ----A---- C:\WINDOWS\system32\drivers\bhomalhm.sys
2012-09-05 19:08:15 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
2012-09-05 19:08:07 ----SHD---- C:\RECYCLER
2012-09-05 19:08:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2012-09-05 18:37:31 ----A---- C:\Boot.bak
2012-09-05 18:37:27 ----RASHD---- C:\cmdcons
2012-09-05 18:30:02 ----A---- C:\WINDOWS\zip.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\SWSC.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\SWREG.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\sed.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\PEV.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\NIRCMD.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\MBR.exe
2012-09-05 18:30:02 ----A---- C:\WINDOWS\grep.exe
2012-09-05 18:29:56 ----SD---- C:\ComboFix
2012-09-05 18:29:43 ----D---- C:\Qoobox
2012-09-05 18:29:02 ----D---- C:\WINDOWS\erdnt
2012-09-05 16:03:27 ----D---- C:\Program Files\trend micro
2012-09-05 16:02:57 ----D---- C:\rsit
2012-09-05 15:49:20 ----D---- C:\Program Files\Common Files\Java
2012-09-05 15:48:21 ----A---- C:\WINDOWS\system32\javaws.exe
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\javaw.exe
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\java.exe
2012-09-05 15:47:01 ----D---- C:\Program Files\Java
2012-09-04 22:07:06 ----D---- C:\Program Files\Valve
2012-09-04 20:43:51 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2012-09-04 20:43:39 ----D---- C:\Program Files\Common Files\Skype
2012-09-04 20:43:38 ----RD---- C:\Program Files\Skype
2012-09-04 20:43:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2012-09-04 12:28:08 ----A---- C:\WINDOWS\system32\drivers\PnkBstrK.sys
2012-09-04 12:23:19 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2012-09-04 12:23:10 ----D---- C:\WINDOWS\system32\LogFiles
2012-09-04 12:23:09 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2012-09-04 12:23:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PunkBuster
2012-09-04 12:13:03 ----D---- C:\Program Files\GamePark2
2012-09-04 11:34:56 ----SHD---- C:\WINDOWS\ftpcache
2012-09-04 11:31:01 ----D---- C:\Program Files\Activision
2012-09-04 11:30:05 ----D---- C:\Documents and Settings\Administrator\Data aplikací\NVIDIA
2012-09-03 21:53:17 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PhotoScape
2012-09-03 21:27:38 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2012-09-03 21:27:29 ----D---- C:\Program Files\MSXML 4.0
2012-09-03 21:25:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\LG Electronics
2012-09-03 20:46:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\SYSTEMAX Software Development
2012-09-03 20:46:37 ----D---- C:\Documents and Settings\Administrator\Data aplikací\SYSTEMAX Software Development
2012-09-03 20:45:08 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2012-09-03 20:33:19 ----D---- C:\Program Files\LG Electronics
2012-09-03 20:33:18 ----SHD---- C:\Config.Msi
2012-09-01 16:59:05 ----A---- C:\WINDOWS\ALCFDRTM.EXE
2012-09-01 16:59:03 ----D---- C:\WINDOWS\system32\Lang
2012-09-01 12:45:53 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Nokia
2012-09-01 12:45:52 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PC Suite
2012-09-01 12:45:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Suite
2012-09-01 12:37:04 ----D---- C:\Program Files\Common Files\PCSuite
2012-09-01 12:36:54 ----D---- C:\Program Files\Common Files\Nokia
2012-09-01 12:36:42 ----D---- C:\Program Files\DIFX
2012-09-01 12:36:41 ----A---- C:\WINDOWS\system32\drivers\pccsmcfd.sys
2012-09-01 12:36:33 ----D---- C:\Program Files\PC Connectivity Solution
2012-09-01 12:36:21 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-09-01 12:36:20 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2012-09-01 12:36:18 ----D---- C:\Program Files\Nokia
2012-09-01 12:35:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Installations
2012-09-01 12:08:58 ----A---- C:\WINDOWS\system32\ptpusb.dll
2012-09-01 12:08:57 ----A---- C:\WINDOWS\system32\ptpusd.dll
2012-09-01 12:08:56 ----A---- C:\WINDOWS\system32\drivers\usbscan.sys
2012-09-01 11:50:33 ----D---- C:\Documents and Settings\Administrator\Data aplikací\GRETECH
2012-09-01 11:45:24 ----A---- C:\Documents and Settings\Administrator\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-01 11:44:43 ----A---- C:\Documents and Settings\Administrator\Data aplikací\GDIPFONTCACHEV1.DAT
2012-09-01 11:38:57 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-09-01 11:38:56 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-09-01 11:38:55 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-09-01 11:38:55 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-09-01 11:38:53 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-09-01 11:38:24 ----A---- C:\WINDOWS\avastSS.scr
2012-09-01 11:38:23 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-09-01 11:38:05 ----D---- C:\Program Files\AVAST Software
2012-09-01 11:38:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-09-01 11:36:31 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-09-01 11:36:31 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-09-01 11:36:30 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-09-01 11:36:30 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-09-01 11:32:52 ----D---- C:\NVIDIA
2012-09-01 11:32:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2012-09-01 11:32:29 ----A---- C:\WINDOWS\system32\npDeployJava1.dll
2012-09-01 11:32:29 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-09-01 11:30:15 ----D---- C:\Program Files\GRETECH
2012-09-01 11:29:12 ----D---- C:\Program Files\uTorrent
2012-09-01 11:28:49 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2012-09-01 11:28:43 ----D---- C:\Documents and Settings\Administrator\Data aplikací\WinRAR
2012-09-01 11:28:41 ----D---- C:\Program Files\WinRAR
2012-09-01 11:27:24 ----D---- C:\Program Files\CCleaner
2012-09-01 11:24:58 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Sun
2012-09-01 11:23:27 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2012-09-01 11:19:52 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Google
2012-09-01 11:13:48 ----A---- C:\WINDOWS\system32\hidserv.dll
2012-09-01 11:13:47 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2012-09-01 11:11:44 ----A---- C:\WINDOWS\system32\drivers\mouhid.sys
2012-09-01 11:07:29 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys
2012-09-01 11:07:27 ----A---- C:\WINDOWS\system32\drivers\hidusb.sys

======List of files/folders modified in the last 1 month======

2012-09-14 12:17:03 ----D---- C:\WINDOWS\Temp
2012-09-14 12:02:30 ----D---- C:\WINDOWS\system32\CatRoot2
2012-09-14 12:02:23 ----HD---- C:\WINDOWS\inf
2012-09-14 12:02:21 ----D---- C:\WINDOWS
2012-09-14 12:01:05 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-09-14 12:00:34 ----D---- C:\Documents and Settings
2012-09-14 12:00:31 ----D---- C:\Program Files\NVIDIA Corporation
2012-09-14 12:00:27 ----D---- C:\WINDOWS\Help
2012-09-14 12:00:18 ----D---- C:\WINDOWS\system32\CatRoot
2012-09-14 12:00:18 ----D---- C:\WINDOWS\system32
2012-09-14 11:59:48 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-09-14 11:59:37 ----D---- C:\WINDOWS\system32\drivers
2012-09-14 11:59:01 ----D---- C:\WINDOWS\Prefetch
2012-09-14 08:20:44 ----RD---- C:\Program Files
2012-09-14 07:54:09 ----D---- C:\WINDOWS\system32\DirectX
2012-09-14 02:07:00 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2012-09-14 01:57:38 ----HD---- C:\Program Files\InstallShield Installation Information
2012-09-14 01:56:14 ----SHD---- C:\WINDOWS\Installer
2012-09-12 07:20:17 ----D---- C:\WINDOWS\Minidump
2012-09-10 18:23:10 ----A---- C:\WINDOWS\DUMP4e0a.tmp
2012-09-05 19:58:56 ----RASH---- C:\boot.ini
2012-09-05 19:58:56 ----A---- C:\WINDOWS\win.ini
2012-09-05 19:58:56 ----A---- C:\WINDOWS\system.ini
2012-09-05 18:42:42 ----D---- C:\WINDOWS\SoftwareDistribution
2012-09-05 18:39:56 ----D---- C:\WINDOWS\AppPatch
2012-09-05 18:39:53 ----D---- C:\Program Files\Common Files
2012-09-04 11:29:07 ----D---- C:\Program Files\Common Files\InstallShield
2012-09-03 21:27:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-09-03 21:27:30 ----D---- C:\WINDOWS\WinSxS
2012-09-01 17:35:19 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-09-01 11:49:00 ----D---- C:\WINDOWS\Debug
2012-09-01 11:38:54 ----SD---- C:\WINDOWS\Tasks
2012-09-01 11:38:49 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-08-30 21:10:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-08-21 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-08-21 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-08-21 729752]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-08-21 355632]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-08-21 54232]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2012-09-09 242240]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-08-21 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-08-21 97608]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-08-11 2324480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 lgbusenum;LG Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2012-08-30 12555680]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-01-13 33408]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-01-13 12928]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files\Garena Plus\Room\safedrv.sys []
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2010-10-21 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2010-10-21 20864]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2010-10-21 25216]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-08-21 44808]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2012-09-05 161768]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2012-08-30 164200]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2012-09-04 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2012-09-13 214520]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S4 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S4 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]

-----------------EOF-----------------

[Márty84]

Zdravim

Na logu se pracuje, bude to nejakou dobu trvat.

[Márty84]

Nejdete tento soubor C:\WINDOWS\system32\drivers\bhomalhm.sys a otestujte ho na virustotal a jotti http://forum.viry.cz/viewtopic.php?f=29&t=5846




Jestli bude Avast rvat, ze to chce otevrit v sandboxu, nedovolte to! Vyberte moznost Otevrit normalne
Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe , ulozte nejlepe na plochu a spustte.
Do leveho okna zkopirujte tento skript (vcetne te dvojtecky pred slovem commands)

Kód: Vybrat vše

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[RESETHOSTS]
[Purity]

:services
JavaQuickStarterService

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500UA.job

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ROC_roc_ssl_v12"=-
"SunJavaUpdateSched"=-
"KernelFaultCheck"=-
"NvMediaCenter"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
"uTorrent"=-
"DAEMON Tools Lite"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]

Kliknete na MoveIt a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu sem dejte log, ktery na vas vyskoci, nebo bude zde C:\_OTM\MovedFiles\xxxxxxxx_xxxxxx (misto tech x budou cisla, predstavujici datum a cas spusteni)



Edit by Motji//
Pro neaktivitu v tomto vlákně zamykám . Pro případné odemknutí topicu kontaktu některého z moderátorů na email.