Z nicoho nic mi trhaju hry(original),po odstraneni disku

[martinerik]

PREPACTE ze zas ja,poobede som dal prec stary HDD a zacali mi trhat z nicoho nic hry,neviem ci to s tym suvisi...Dakujem pekne



Logfile of random's system information tool 1.09 (written by random/random)
Run by Martin at 2013-02-18 21:05:57
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 5 GB (17%) free of 30 GB
Total RAM: 1023 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:06:10, on 18. 2. 2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\PnkBstrB.exe
D:\Downloaded\RSIT.exe
C:\Program Files\trend micro\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4697 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\04ec4ov3.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk/"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.265 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Documents and Settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\04ec4ov3.default\searchplugins\
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-09-27 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-09-27 13918208]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-10-30 4297136]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2007-05-28 16132608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
C:\PROGRA~1\WINDOW~2\WINDOW~1.EXE [2010-01-14 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2
"TeamViewer8"=2
"ose"=2
"odserv"=2
"nvsvc"=2
"NMSAccess"=2
"NetTcpPortSharing"=2
"MozillaMaintenance"=2
"Microsoft Office Groove Audit Service"=2
"idsvc"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2010-01-14 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2010-01-14 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2010-01-14 304128]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe"="C:\Program Files\AVAST Software\Avast\AvastUI.exe:*:Enabled:avast! Free Antivirus"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Electronic Arts\Medal of Honor\Binaries\moh.exe"="C:\Program Files\Electronic Arts\Medal of Honor\Binaries\moh.exe:*:Enabled:Medal of Honor™"
"D:\BATTLEFIELD\BFBC2Updater.exe"="D:\BATTLEFIELD\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\BATTLEFIELD\BFBC2Game.exe"="D:\BATTLEFIELD\BFBC2Game.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\Documents and Settings\Martin\Local Settings\Data aplikací\Facebook\Video\Skype\FacebookVideoCalling.exe"="C:\Documents and Settings\Martin\Local Settings\Data aplikací\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-02-18 19:08:25 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2013-02-18 16:30:28 ----D---- C:\WINDOWS\temp
2013-02-18 16:30:26 ----A---- C:\ComboFix.txt
2013-02-09 22:32:36 ----A---- C:\WINDOWS\system32\drivers\PnkBstrK.sys
2013-02-09 22:32:35 ----A---- C:\Documents and Settings\Martin\Data aplikací\PnkBstrK.sys
2013-02-09 22:32:14 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2013-02-09 22:32:11 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2013-02-09 22:32:10 ----A---- C:\WINDOWS\system32\pbsvc_bc2.exe
2013-02-09 22:32:06 ----D---- C:\WINDOWS\system32\LogFiles
2013-02-06 13:54:56 ----D---- C:\Program Files\Mozilla Firefox
2013-02-02 21:10:10 ----A---- C:\WINDOWS\system32\drivers\42832499.sys
2013-02-02 21:00:20 ----D---- C:\WINDOWS\Minidump
2013-01-30 20:33:38 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\DSS
2013-01-30 20:24:22 ----D---- C:\Program Files\Electronic Arts
2013-01-30 20:15:49 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2013-01-30 20:15:38 ----D---- C:\Documents and Settings\Martin\Data aplikací\DAEMON Tools Lite
2013-01-30 20:15:33 ----D---- C:\Program Files\DAEMON Tools Lite
2013-01-30 20:14:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2013-01-27 20:55:16 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-01-27 19:20:01 ----A---- C:\DAF-interface-resetlog.txt
2013-01-27 17:46:55 ----D---- C:\WINDOWS\system32\NtmsData
2013-01-27 16:58:28 ----D---- C:\Documents and Settings\Martin\Data aplikací\Malwarebytes
2013-01-27 16:58:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2013-01-27 16:58:20 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2013-01-27 16:58:20 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2013-01-26 18:11:45 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2013-01-26 18:11:45 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2013-01-26 18:11:42 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2013-01-26 18:11:41 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2013-01-26 18:11:40 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2013-01-26 18:11:39 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2013-01-26 18:11:39 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2013-01-26 18:11:38 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2013-01-26 18:11:19 ----A---- C:\WINDOWS\system32\aswBoot.exe
2013-01-26 12:45:53 ----A---- C:\WINDOWS\avastSS.scr
2013-01-26 12:45:33 ----D---- C:\Program Files\AVAST Software
2013-01-26 12:17:07 ----A---- C:\Boot.bak
2013-01-26 12:16:59 ----RASHD---- C:\cmdcons
2013-01-26 12:15:48 ----A---- C:\WINDOWS\zip.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\SWXCACLS.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\SWSC.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\SWREG.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\sed.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\PEV.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\NIRCMD.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\MBR.exe
2013-01-26 12:15:48 ----A---- C:\WINDOWS\grep.exe
2013-01-26 12:15:39 ----D---- C:\Qoobox
2013-01-26 12:15:28 ----D---- C:\WINDOWS\erdnt
2013-01-26 12:09:41 ----A---- C:\AdwCleaner[R5].txt
2013-01-26 11:13:35 ----SHD---- C:\WINDOWS\CSC
2013-01-25 21:32:47 ----A---- C:\AdwCleaner[S1].txt
2013-01-25 21:32:23 ----A---- C:\AdwCleaner[R4].txt
2013-01-25 21:16:09 ----A---- C:\AdwCleaner[R3].txt
2013-01-25 21:15:21 ----A---- C:\AdwCleaner[R2].txt
2013-01-25 21:14:44 ----A---- C:\AdwCleaner[R1].txt
2013-01-25 20:17:36 ----D---- C:\rsit
2013-01-25 20:17:36 ----D---- C:\Program Files\trend micro
2013-01-25 19:56:18 ----D---- C:\WINDOWS\pss

======List of files/folders modified in the last 1 month======

2013-02-18 21:05:45 ----D---- C:\WINDOWS\Prefetch
2013-02-18 20:22:06 ----D---- C:\WINDOWS\system32
2013-02-18 19:12:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-02-18 19:08:57 ----D---- C:\WINDOWS\system32\ias
2013-02-18 19:08:56 ----D---- C:\WINDOWS\Registration
2013-02-18 19:08:51 ----D---- C:\WINDOWS
2013-02-18 19:08:34 ----D---- C:\WINDOWS\Debug
2013-02-18 16:29:03 ----A---- C:\WINDOWS\system.ini
2013-02-18 16:27:02 ----D---- C:\WINDOWS\system32\drivers
2013-02-18 16:27:02 ----D---- C:\WINDOWS\AppPatch
2013-02-18 16:26:56 ----D---- C:\Program Files\Common Files
2013-02-18 16:23:53 ----D---- C:\WINDOWS\system32\CatRoot2
2013-02-17 19:38:36 ----D---- C:\Documents and Settings\Martin\Data aplikací\vlc
2013-02-17 18:54:28 ----D---- C:\Documents and Settings\Martin\Data aplikací\TeraCopy
2013-02-13 21:02:53 ----RD---- C:\Program Files
2013-02-13 18:26:51 ----RSD---- C:\WINDOWS\assembly
2013-02-13 18:26:07 ----A---- C:\WINDOWS\system32\MRT.exe
2013-02-13 18:26:00 ----HD---- C:\WINDOWS\inf
2013-02-13 18:25:57 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-02-13 18:25:54 ----D---- C:\WINDOWS\ie8updates
2013-02-13 18:25:52 ----HD---- C:\WINDOWS\$hf_mig$
2013-02-13 18:25:39 ----SHD---- C:\WINDOWS\Installer
2013-02-13 18:25:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2013-02-13 18:23:11 ----D---- C:\Program Files\Internet Explorer
2013-02-13 18:22:42 ----D---- C:\WINDOWS\Microsoft.NET
2013-02-13 18:19:53 ----D---- C:\WINDOWS\WinSxS
2013-02-13 08:44:44 ----D---- C:\Documents and Settings\Martin\Data aplikací\dvdcss
2013-02-12 23:38:50 ----SHD---- C:\System Volume Information
2013-02-12 23:38:50 ----D---- C:\WINDOWS\system32\Restore
2013-02-12 21:56:43 ----D---- C:\Documents and Settings\Martin\Data aplikací\uTorrent
2013-02-10 20:11:42 ----D---- C:\WINDOWS\Logs
2013-02-09 22:09:02 ----D---- C:\WINDOWS\system32\DirectX
2013-02-06 18:46:31 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-01-30 20:34:17 ----D---- C:\Program Files\NVIDIA Corporation
2013-01-28 06:50:53 ----D---- C:\Program Files\Common Files\Adobe
2013-01-27 22:57:59 ----RASH---- C:\boot.ini
2013-01-27 22:57:59 ----A---- C:\WINDOWS\win.ini
2013-01-27 20:56:11 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2013-01-27 19:23:42 ----D---- C:\WINDOWS\security
2013-01-26 18:11:41 ----SD---- C:\WINDOWS\Tasks
2013-01-26 18:11:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2013-01-26 12:59:08 ----D---- C:\WINDOWS\system32\drivers\etc
2013-01-26 11:20:20 ----D---- C:\Documents and Settings
2013-01-26 04:55:43 ----A---- C:\WINDOWS\system32\oleaut32.dll
2013-01-25 21:45:35 ----D---- C:\WINDOWS\SoftwareDistribution
2013-01-25 20:21:04 ----D---- C:\Program Files\SpeedFan
2013-01-25 19:48:23 ----D---- C:\Program Files\JDownloader
2013-01-25 19:46:44 ----D---- C:\Program Files\Hewlett-Packard

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 42832499;42832499; C:\WINDOWS\system32\DRIVERS\42832499.sys [2013-01-27 133208]
R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2010-01-14 61824]
R0 speedfan;speedfan; C:\WINDOWS\system32\speedfan.sys [2011-03-18 25240]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-10-30 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-10-30 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-10-30 738504]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-10-30 361032]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-10-30 54232]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2013-01-30 242240]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-10-30 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-10-30 97608]
R2 rspndr;Odpovídající zařízení zjišťování topologie linkové vrstvy; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2010-01-14 62848]
R2 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2012-06-03 5504]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2010-01-14 60800]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-05-30 4424192]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2010-01-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-09-28 7655872]
R3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-12-14 85120]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2010-01-14 32384]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2009-05-12 122240]
S1 DumpDrv;Crash Dump Driver; C:\WINDOWS\system32\drivers\DumpDrv.sys [2010-01-14 9472]
S3 catchme;catchme; \??\C:\DOCUME~1\Martin\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2010-01-14 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2010-01-14 82944]
S4 exFat;exFat; C:\WINDOWS\system32\drivers\exFat.sys [2010-01-14 133632]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-10-30 44808]
R2 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2013-02-09 76888]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2013-02-18 282296]
R2 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2010-01-14 14848]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S4 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-02-06 115608]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2012-06-03 71096]
S4 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-09-27 172100]
S4 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S4 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 TeamViewer8;TeamViewer 8; C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
S4 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2010-01-14 913920]

-----------------EOF-----------------

[Rudy]

Zdravím!
Dejte log comboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[martinerik]

Dik,kazdy dobry skutok sa Vam vrati


ComboFix 13-02-18.02 - Martin . 02. 2013 18:22:34.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1023.514 [GMT 1:00]
Running from: c:\documents and settings\Martin\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2013-01-19 to 2013-02-19 )))))))))))))))))))))))))))))))
.
.
2013-02-09 22:14 . 2013-02-18 19:21 282296 ----a-w- c:\windows\system32\PnkBstrB.xtr
2013-02-09 22:14 . 2013-02-09 22:14 -------- d-----w- c:\documents and settings\Martin\Local Settings\Data aplikací\PunkBuster
2013-02-09 21:32 . 2013-02-18 19:22 139048 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-09 21:32 138056 ----a-w- c:\documents and settings\Martin\Data aplikací\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-18 19:21 282296 ----a-w- c:\windows\system32\PnkBstrB.exe
2013-02-09 21:32 . 2013-02-18 18:26 282296 ----a-w- c:\windows\system32\PnkBstrB.ex0
2013-02-09 21:32 . 2013-02-09 22:25 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-02-09 21:32 . 2013-02-09 21:32 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2013-02-09 21:32 . 2013-02-18 18:08 -------- d-----w- c:\windows\system32\LogFiles
2013-02-02 20:10 . 2013-01-27 18:51 133208 ----a-w- c:\windows\system32\drivers\42832499.sys
2013-01-31 12:59 . 2013-01-31 12:59 -------- d-sh--w- c:\documents and settings\Martin\IECompatCache
2013-01-30 19:33 . 2013-01-30 19:33 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\DSS
2013-01-30 19:24 . 2013-01-30 19:24 -------- d-----w- c:\program files\Electronic Arts
2013-01-30 19:15 . 2013-01-30 19:15 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-01-30 19:15 . 2013-02-02 17:17 -------- d-----w- c:\documents and settings\Martin\Data aplikací\DAEMON Tools Lite
2013-01-30 19:15 . 2013-01-30 19:15 -------- d-----w- c:\program files\DAEMON Tools Lite
2013-01-30 19:14 . 2013-01-30 19:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2013-01-27 16:46 . 2013-01-31 19:48 -------- d-----w- c:\windows\system32\NtmsData
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\Martin\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-01-27 15:58 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-26 17:11 . 2012-10-30 22:51 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-01-26 17:11 . 2012-10-30 22:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-01-26 17:11 . 2012-10-30 22:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-01-26 17:11 . 2012-10-30 22:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-01-26 17:11 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-01-26 17:11 . 2012-10-30 22:51 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2013-01-26 17:11 . 2012-10-30 22:51 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys
2013-01-26 17:11 . 2012-10-30 22:51 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2013-01-26 17:11 . 2012-10-30 22:50 227648 ----a-w- c:\windows\system32\aswBoot.exe
2013-01-26 11:45 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2013-01-26 11:45 . 2013-01-26 17:11 -------- d-----w- c:\program files\AVAST Software
2013-01-26 10:20 . 2013-01-26 10:20 -------- d-----w- c:\documents and settings\Administrator
2013-01-25 19:17 . 2013-02-18 20:06 -------- d-----w- c:\program files\trend micro
2013-01-25 19:17 . 2013-01-25 19:17 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-26 03:55 . 2008-04-14 11:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-07 07:24 . 2010-01-14 15:01 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:23 . 2009-08-04 17:23 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2010-01-14 15:02 1876224 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2010-01-14 15:01 1294848 ----a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 11:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:18 . 2010-01-14 15:02 920064 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:17 . 2010-01-14 15:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:17 . 2010-01-14 15:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:03 . 2010-01-14 15:00 385024 ----a-w- c:\windows\system32\html.iec
2012-12-16 12:31 . 2010-01-14 14:59 290560 ----a-w- c:\windows\system32\atmfd.dll
2013-02-06 12:55 . 2013-02-06 12:54 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2010-01-14 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-05-28 08:32 16132608 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2 (0x2)
"TeamViewer8"=2 (0x2)
"ose"=2 (0x2)
"odserv"=2 (0x2)
"nvsvc"=2 (0x2)
"NMSAccess"=2 (0x2)
"NetTcpPortSharing"=2 (0x2)
"MozillaMaintenance"=2 (0x2)
"Microsoft Office Groove Audit Service"=2 (0x2)
"idsvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVAST Software\\Avast\\AvastUI.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor\\Binaries\\moh.exe"=
"d:\\BATTLEFIELD\\BFBC2Updater.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\BATTLEFIELD\\BFBC2Game.exe"=
"c:\\Documents and Settings\\Martin\\Local Settings\\Data aplikací\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
.
R0 42832499;42832499;c:\windows\system32\drivers\42832499.sys [2. 2. 2013 21:10 133208]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [26. 1. 2013 18:11 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26. 1. 2013 18:11 361032]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [30. 1. 2013 20:15 242240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26. 1. 2013 18:11 21256]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14. 1. 2010 16:04 9472]
S4 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [4. 1. 2013 9:10 3467768]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-19 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-26 22:50]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\04ec4ov3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - ExtSQL: 2013-01-26 18:11; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-19 18:26
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1452)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-19 18:28:07
ComboFix-quarantined-files.txt 2013-02-19 17:28
ComboFix2.txt 2013-02-18 15:30
ComboFix3.txt 2013-02-12 22:45
ComboFix4.txt 2013-01-27 21:17
ComboFix5.txt 2013-02-19 17:21
.
Pre-Run: 5 411 778 560
Post-Run: 5 399 658 496
.
- - End Of File - - 08078CF136DEF62B7895B21053FCF903

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\system32\drivers\42832499.sys

Driver::
42832499

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[martinerik]

pc pipal,ze combofix nieco nasiel..malware...


ComboFix 13-02-18.02 - Martin . 02. 2013 22:41:32.8.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1023.556 [GMT 1:00]
Running from: c:\documents and settings\Martin\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Martin\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
file zipped: c:\windows\system32\drivers\42832499.sys
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\42832499.sys
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_42832499
-------\Service_42832499
.
.
((((((((((((((((((((((((( Files Created from 2013-01-19 to 2013-02-19 )))))))))))))))))))))))))))))))
.
.
2013-02-09 22:14 . 2013-02-19 18:15 282296 ----a-w- c:\windows\system32\PnkBstrB.xtr
2013-02-09 22:14 . 2013-02-09 22:14 -------- d-----w- c:\documents and settings\Martin\Local Settings\Data aplikací\PunkBuster
2013-02-09 21:32 . 2013-02-19 18:15 139048 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-09 21:32 138056 ----a-w- c:\documents and settings\Martin\Data aplikací\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-19 18:15 282296 ----a-w- c:\windows\system32\PnkBstrB.exe
2013-02-09 21:32 . 2013-02-19 18:00 282296 ----a-w- c:\windows\system32\PnkBstrB.ex0
2013-02-09 21:32 . 2013-02-09 22:25 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-02-09 21:32 . 2013-02-09 21:32 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2013-02-09 21:32 . 2013-02-19 18:15 -------- d-----w- c:\windows\system32\LogFiles
2013-01-31 12:59 . 2013-01-31 12:59 -------- d-sh--w- c:\documents and settings\Martin\IECompatCache
2013-01-30 19:33 . 2013-01-30 19:33 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\DSS
2013-01-30 19:24 . 2013-01-30 19:24 -------- d-----w- c:\program files\Electronic Arts
2013-01-30 19:15 . 2013-01-30 19:15 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-01-30 19:15 . 2013-02-02 17:17 -------- d-----w- c:\documents and settings\Martin\Data aplikací\DAEMON Tools Lite
2013-01-30 19:15 . 2013-01-30 19:15 -------- d-----w- c:\program files\DAEMON Tools Lite
2013-01-30 19:14 . 2013-01-30 19:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2013-01-27 16:46 . 2013-01-31 19:48 -------- d-----w- c:\windows\system32\NtmsData
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\Martin\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-01-27 15:58 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-26 17:11 . 2012-10-30 22:51 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-01-26 17:11 . 2012-10-30 22:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-01-26 17:11 . 2012-10-30 22:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-01-26 17:11 . 2012-10-30 22:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-01-26 17:11 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-01-26 17:11 . 2012-10-30 22:51 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2013-01-26 17:11 . 2012-10-30 22:51 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys
2013-01-26 17:11 . 2012-10-30 22:51 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2013-01-26 17:11 . 2012-10-30 22:50 227648 ----a-w- c:\windows\system32\aswBoot.exe
2013-01-26 11:45 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2013-01-26 11:45 . 2013-01-26 17:11 -------- d-----w- c:\program files\AVAST Software
2013-01-26 10:20 . 2013-01-26 10:20 -------- d-----w- c:\documents and settings\Administrator
2013-01-25 19:17 . 2013-02-18 20:06 -------- d-----w- c:\program files\trend micro
2013-01-25 19:17 . 2013-01-25 19:17 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-26 03:55 . 2008-04-14 11:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-07 07:24 . 2010-01-14 15:01 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:23 . 2009-08-04 17:23 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2010-01-14 15:02 1876224 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2010-01-14 15:01 1294848 ----a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 11:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:18 . 2010-01-14 15:02 920064 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:17 . 2010-01-14 15:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:17 . 2010-01-14 15:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:03 . 2010-01-14 15:00 385024 ----a-w- c:\windows\system32\html.iec
2012-12-16 12:31 . 2010-01-14 14:59 290560 ----a-w- c:\windows\system32\atmfd.dll
2013-02-06 12:55 . 2013-02-06 12:54 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2010-01-14 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-05-28 08:32 16132608 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2 (0x2)
"TeamViewer8"=2 (0x2)
"ose"=2 (0x2)
"odserv"=2 (0x2)
"nvsvc"=2 (0x2)
"NMSAccess"=2 (0x2)
"NetTcpPortSharing"=2 (0x2)
"MozillaMaintenance"=2 (0x2)
"Microsoft Office Groove Audit Service"=2 (0x2)
"idsvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVAST Software\\Avast\\AvastUI.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor\\Binaries\\moh.exe"=
"d:\\BATTLEFIELD\\BFBC2Updater.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\BATTLEFIELD\\BFBC2Game.exe"=
"c:\\Documents and Settings\\Martin\\Local Settings\\Data aplikací\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [26. 1. 2013 18:11 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26. 1. 2013 18:11 361032]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [30. 1. 2013 20:15 242240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26. 1. 2013 18:11 21256]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14. 1. 2010 16:04 9472]
S4 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [4. 1. 2013 9:10 3467768]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-19 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-26 22:50]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\04ec4ov3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - ExtSQL: 2013-01-26 18:11; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-19 22:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2428)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\netdde.exe
c:\windows\system32\msdtc.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\sessmgr.exe
c:\windows\system32\locator.exe
c:\windows\system32\rsvp.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2013-02-19 22:50:22 - machine was rebooted
ComboFix-quarantined-files.txt 2013-02-19 21:50
ComboFix2.txt 2013-02-19 17:28
ComboFix3.txt 2013-02-18 15:30
ComboFix4.txt 2013-02-12 22:45
ComboFix5.txt 2013-02-19 21:40
.
Pre-Run: 5 114 916 864
Post-Run: 5 131 259 904
.
- - End Of File - - 9EA0E3DCE659ABB9A4C78A2BCA41638B
Upload was successful

[Rudy]

Smazáno. Nastala nějaká změna?

[martinerik]

ANo ano dakujem pekne Vsetko dobre prajem

[Rudy]

Děkuji za přání a vy nemáte zač!

[martinerik]

Prepacte ale zas mam ten problem,nehnevajte sa
Ak by ste bol ochotny sa pozriet...treba aj rsit?aj videa na yt trhaju


ComboFix 13-02-18.02 - Martin . 02. 2013 19:28:49.9.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.1023.592 [GMT 1:00]
Running from: c:\documents and settings\Martin\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Files Created from 2013-01-24 to 2013-02-24 )))))))))))))))))))))))))))))))
.
.
2013-02-24 17:47 . 2013-02-24 17:47 -------- d-----w- c:\documents and settings\Martin\Local Settings\Data aplikací\ArmA 2
2013-02-24 17:09 . 2013-02-24 17:42 -------- d-----w- c:\windows\LastGood
2013-02-20 17:05 . 2013-02-22 20:35 -------- d-----w- c:\documents and settings\Martin\Data aplikací\uTorrent
2013-02-09 22:14 . 2013-02-23 18:51 282296 ----a-w- c:\windows\system32\PnkBstrB.xtr
2013-02-09 22:14 . 2013-02-09 22:14 -------- d-----w- c:\documents and settings\Martin\Local Settings\Data aplikací\PunkBuster
2013-02-09 21:32 . 2013-02-23 18:51 139048 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-09 21:32 138056 ----a-w- c:\documents and settings\Martin\Data aplikací\PnkBstrK.sys
2013-02-09 21:32 . 2013-02-23 18:51 282296 ----a-w- c:\windows\system32\PnkBstrB.exe
2013-02-09 21:32 . 2013-02-23 18:34 282296 ----a-w- c:\windows\system32\PnkBstrB.ex0
2013-02-09 21:32 . 2013-02-09 22:25 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-02-09 21:32 . 2013-02-09 21:32 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2013-02-09 21:32 . 2013-02-23 17:13 -------- d-----w- c:\windows\system32\LogFiles
2013-01-31 12:59 . 2013-01-31 12:59 -------- d-sh--w- c:\documents and settings\Martin\IECompatCache
2013-01-30 19:33 . 2013-01-30 19:33 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\DSS
2013-01-30 19:24 . 2013-01-30 19:24 -------- d-----w- c:\program files\Electronic Arts
2013-01-30 19:15 . 2013-01-30 19:15 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-01-30 19:15 . 2013-02-24 16:55 -------- d-----w- c:\documents and settings\Martin\Data aplikací\DAEMON Tools Lite
2013-01-30 19:15 . 2013-01-30 19:15 -------- d-----w- c:\program files\DAEMON Tools Lite
2013-01-30 19:14 . 2013-01-30 19:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2013-01-27 16:46 . 2013-01-31 19:48 -------- d-----w- c:\windows\system32\NtmsData
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\Martin\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-01-27 15:58 . 2013-01-27 15:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-01-27 15:58 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-26 17:11 . 2012-10-30 22:51 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-01-26 17:11 . 2012-10-30 22:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-01-26 17:11 . 2012-10-30 22:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-01-26 17:11 . 2012-10-30 22:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-01-26 17:11 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-01-26 17:11 . 2012-10-30 22:51 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2013-01-26 17:11 . 2012-10-30 22:51 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys
2013-01-26 17:11 . 2012-10-30 22:51 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2013-01-26 17:11 . 2012-10-30 22:50 227648 ----a-w- c:\windows\system32\aswBoot.exe
2013-01-26 11:45 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2013-01-26 11:45 . 2013-01-26 17:11 -------- d-----w- c:\program files\AVAST Software
2013-01-26 10:20 . 2013-01-26 10:20 -------- d-----w- c:\documents and settings\Administrator
2013-01-25 19:17 . 2013-02-18 20:06 -------- d-----w- c:\program files\trend micro
2013-01-25 19:17 . 2013-01-25 19:17 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-26 03:55 . 2008-04-14 11:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-07 07:24 . 2010-01-14 15:01 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:23 . 2009-08-04 17:23 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2010-01-14 15:02 1876224 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2010-01-14 15:01 1294848 ----a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 11:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:18 . 2010-01-14 15:02 920064 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:17 . 2010-01-14 15:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:17 . 2010-01-14 15:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:03 . 2010-01-14 15:00 385024 ----a-w- c:\windows\system32\html.iec
2012-12-16 12:31 . 2010-01-14 14:59 290560 ----a-w- c:\windows\system32\atmfd.dll
2013-02-06 12:55 . 2013-02-06 12:54 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . FF876311F58C86EC3E1A24F585949C25 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2010-01-14 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-05-28 08:32 16132608 ------r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2 (0x2)
"TeamViewer8"=2 (0x2)
"ose"=2 (0x2)
"odserv"=2 (0x2)
"nvsvc"=2 (0x2)
"NMSAccess"=2 (0x2)
"NetTcpPortSharing"=2 (0x2)
"MozillaMaintenance"=2 (0x2)
"Microsoft Office Groove Audit Service"=2 (0x2)
"idsvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVAST Software\\Avast\\AvastUI.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor\\Binaries\\moh.exe"=
"d:\\BATTLEFIELD\\BFBC2Updater.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\BATTLEFIELD\\BFBC2Game.exe"=
"c:\\Documents and Settings\\Martin\\Local Settings\\Data aplikací\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
"c:\\Documents and Settings\\Martin\\Data aplikací\\uTorrent\\uTorrent.exe"=
"d:\\Bohemia Interactive\\arma2.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [26. 1. 2013 18:11 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26. 1. 2013 18:11 361032]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [30. 1. 2013 20:15 242240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26. 1. 2013 18:11 21256]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [14. 1. 2010 16:04 9472]
S4 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [4. 1. 2013 9:10 3467768]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-24 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-01-26 22:50]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Martin\Data aplikací\Mozilla\Firefox\Profiles\04ec4ov3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - ExtSQL: 2013-01-26 18:11; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-24 19:32
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-606747145-1177238915-1417001333-1004\Software\SecuROM\License information*]
"datasecu"=hex:14,13,2e,0b,6f,f9,ef,72,ac,25,14,0c,c8,0b,b4,1f,4e,47,0a,87,8f,
32,51,74,84,77,a2,14,4c,58,f4,c0,fa,fe,1e,cb,18,c8,27,cf,ae,d7,1f,a9,30,aa,\
"rkeysecu"=hex:b2,27,18,85,f2,3c,9c,f5,ea,c0,11,d2,e2,66,b3,74
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3768)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-24 19:34:17
ComboFix-quarantined-files.txt 2013-02-24 18:34
ComboFix2.txt 2013-02-19 21:50
ComboFix3.txt 2013-02-19 17:28
ComboFix4.txt 2013-02-18 15:30
ComboFix5.txt 2013-02-24 18:27
.
Pre-Run: 4 067 676 160
Post-Run: 5 216 624 640
.
- - End Of File - - C91859D7CE7904B2AD7678639DE37BC5

[Rudy]

Log je OK. Zkuste obnovu systému k datu, kdy korketně fungoval.

[martinerik]

A nepridem o data ?

[martinerik]

TIETO CHYBY MI VYHADZUJE spravca...neustale mi zamrza pc..dik moc


Agent architektury NAP (Network Access Protection) nedokázal určit, u kterých autorit pro registraci stavu má žádat o certifikát stavu.
V případě změny sítě nebo (jsou-li nakonfigurovány zásady skupiny) změny konfigurace bude docházet k dalším pokusům o získání certifikátu stavu. V opačném případě nebudou uskutečněny žádné další pokusy.
O další informace požádejte správce autority pro registraci stavu.

Rozhraní {95874956-C763-45D1-B513-2554EE70EA14} se Správcem směrovačů pro protokol IP nelze přidat. Došlo k následující chybě: Funkci nelze dokončit.

Služba Přístup k zařízením standardu HID byla ukončena s následující chybou:
Uvedený modul nebyl nalezen.

Služba Windows Driver Foundation - User-mode Driver Framework byla ukončena s následující chybou:
Zařízení připojené k systému nefunguje.

Tento počítač je nakonfigurován jako člen pracovní skupiny, nikoliv jako člen domény. Přihlašovací služba Netlogon nepotřebuje být spuštěna v této konfiguraci.

[Rudy]

Přijdete pouze o eventuální instalace mezi dneškem a bodem obnovy. Jinak o nic.