Zavirované pc.. prosím o pomoc

[Iluzionista]

Dobrý večer,

mám podezření, že mám v počítači nějaký vir. Protože asi před hodinou mi skoro vůbec nešel internet. A teď už zase funguje. Dokonce i počítač se zapíná pomaleji.
Vkádám sem proto log z RSIT. Budu rád za každou pomoc.

Děkuji, Lukáš


Logfile of random's system information tool 1.06 (written by random/random)
Run by Lukáš at 2010-02-26 16:51:34
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 21 GB (61%) free of 35 GB
Total RAM: 1279 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:55:59, on 26.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Lukáš\Plocha\RSIT.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Lukáš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Lukáš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NY - Unknown owner - C:\DOCUME~1\LUK~1\LOCALS~1\Temp\NY.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SDYDAL - Unknown owner - C:\DOCUME~1\LUK~1\LOCALS~1\Temp\SDYDAL.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 6665 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Automatic troubleshooting.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Lukáš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-02-18 149968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-02-11 2756488]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-02-11 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll [2009-07-20 72208]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoResolveTrack"=
"NoResolveSearch"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
"C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-02-25 13:56:01 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\GRETECH
2010-02-24 21:57:17 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\gtk-2.0
2010-02-24 21:47:35 ----D---- C:\Program Files\GIMP-2.0
2010-02-24 17:01:12 ----D---- C:\Program Files\ICQ7.0
2010-02-24 09:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-23 19:49:32 ----D---- C:\Program Files\Microsoft Bootvis
2010-02-23 19:27:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\Ahead
2010-02-23 13:26:47 ----D---- C:\Program Files\DAEMON Tools Lite
2010-02-21 20:02:58 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\dvdcss
2010-02-21 19:34:43 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\vlc
2010-02-21 19:33:33 ----D---- C:\Program Files\GRETECH
2010-02-21 19:30:58 ----D---- C:\Program Files\VideoLAN
2010-02-21 19:30:34 ----D---- C:\Program Files\Comodo
2010-02-21 19:13:14 ----A---- C:\WINDOWS\system32\ShellManager310E2D762.dll
2010-02-21 11:57:23 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\QIP
2010-02-21 11:49:19 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-02-20 21:04:26 ----D---- C:\Program Files\ICQ6Toolbar
2010-02-20 18:08:52 ----D---- C:\Program Files\Microsoft Silverlight
2010-02-20 17:50:48 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-02-20 17:49:40 ----A---- C:\WINDOWS\system32\BtCoreIf.dll
2010-02-20 17:48:41 ----D---- C:\Program Files\Common Files\Logishrd
2010-02-19 15:42:08 ----D---- C:\Program Files\QIP
2010-02-19 14:26:44 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-02-19 14:26:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2010-02-19 13:36:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-02-19 13:35:34 ----D---- C:\Program Files\Common Files\Adobe
2010-02-19 12:30:41 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-19 12:26:04 ----D---- C:\Program Files\FileHippo.com
2010-02-19 12:21:58 ----D---- C:\Program Files\CCleaner
2010-02-19 12:13:12 ----D---- C:\rsit
2010-02-19 10:24:59 ----HD---- C:\WINDOWS\PIF
2010-02-19 01:34:28 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Malwarebytes
2010-02-19 01:33:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-02-19 01:32:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-19 00:46:01 ----SHD---- C:\RECYCLER
2010-02-19 00:21:33 ----D---- C:\WINDOWS\temp
2010-02-18 20:40:48 ----A---- C:\Boot.bak
2010-02-18 20:40:26 ----RASHD---- C:\cmdcons
2010-02-18 19:24:53 ----D---- C:\WINDOWS\ERDNT
2010-02-17 11:14:36 ----A---- C:\WINDOWS\system32\muweb.dll
2010-02-17 11:14:36 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-02-17 11:14:36 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-02-15 22:16:07 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-15 22:16:00 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-15 22:13:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-15 22:13:09 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-15 22:13:02 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-15 22:12:55 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-15 22:12:46 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-15 22:12:31 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-09 13:04:39 ----D---- C:\WINDOWS\nview
2010-02-09 13:04:39 ----A---- C:\WINDOWS\system32\nvudisp.exe
2010-02-07 21:03:05 ----A---- C:\WINDOWS\system32\MsiExec.exe.log
2010-02-07 20:59:42 ----D---- C:\Program Files\Common Files\Nero
2010-02-07 07:56:29 ----D---- C:\Program Files\Common Files\ODBC
2010-02-06 21:14:43 ----D---- C:\Program Files\trend micro
2010-02-06 16:24:30 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Gearbox Software
2010-02-06 13:41:08 ----D---- C:\Program Files\OO Software
2010-02-05 17:28:36 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Ancestry
2010-02-05 15:58:38 ----A---- C:\WINDOWS\ModemLog_Nokia 5130 XPressMusic USB Modem.txt
2010-02-05 15:46:56 ----D---- C:\WINDOWS\Globalization
2010-02-05 15:46:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\NokiaMusic
2010-02-05 15:41:41 ----HDC---- C:\WINDOWS\$NtUninstallWudf01007$
2010-02-05 15:34:09 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2010-02-05 15:34:02 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$
2010-02-05 15:33:41 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Nokia
2010-02-05 15:33:38 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\PC Suite
2010-02-05 15:33:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Suite
2010-02-05 15:32:02 ----D---- C:\Program Files\Common Files\PCSuite
2010-02-05 15:31:49 ----D---- C:\Program Files\Common Files\Nokia
2010-02-05 15:31:37 ----D---- C:\Program Files\DIFX
2010-02-05 15:31:20 ----D---- C:\Program Files\PC Connectivity Solution
2010-02-05 15:30:52 ----A---- C:\WINDOWS\system32\wdfcoinstaller01007.dll
2010-02-05 15:30:52 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2010-02-05 15:30:49 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2010-02-05 15:30:47 ----D---- C:\Program Files\Nokia
2010-02-05 15:28:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Installations
2010-01-30 11:50:16 ----SHD---- C:\WINDOWS\ftpcache
2010-01-29 14:59:33 ----A---- C:\WINDOWS\IsUn0405.exe
2010-01-27 22:15:14 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll

======List of files/folders modified in the last 1 months======

2010-02-26 16:51:47 ----D---- C:\WINDOWS\Prefetch
2010-02-26 16:35:15 ----D---- C:\WINDOWS
2010-02-26 16:33:03 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-26 16:32:58 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-26 04:02:11 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-02-24 21:47:35 ----D---- C:\Program Files
2010-02-24 17:04:27 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\ICQ
2010-02-24 17:03:27 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-24 16:38:29 ----D---- C:\WINDOWS\Minidump
2010-02-24 09:16:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 09:16:22 ----HD---- C:\WINDOWS\inf
2010-02-24 09:16:21 ----D---- C:\WINDOWS\system32
2010-02-24 09:16:20 ----D---- C:\WINDOWS\ie8updates
2010-02-24 09:15:38 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-23 19:57:57 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Ahead
2010-02-23 19:49:35 ----SHD---- C:\WINDOWS\Installer
2010-02-23 19:49:33 ----D---- C:\Config.Msi
2010-02-23 19:26:12 ----D---- C:\Program Files\Common Files\Ahead
2010-02-23 19:26:04 ----D---- C:\WINDOWS\system32\drivers
2010-02-23 19:23:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\Nero
2010-02-22 17:25:22 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-22 17:21:28 ----D---- C:\Program Files\Windows Media Player
2010-02-21 19:39:08 ----D---- C:\WINDOWS\system32\config
2010-02-21 19:39:07 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\uTorrent
2010-02-21 19:33:04 ----D---- C:\Program Files\Webteh
2010-02-21 19:19:41 ----D---- C:\Program Files\Nero
2010-02-21 18:55:39 ----D---- C:\Program Files\Ashampoo
2010-02-21 18:54:45 ----D---- C:\Program Files\Mozilla Firefox
2010-02-21 11:39:15 ----A---- C:\WINDOWS\win.ini
2010-02-21 11:37:23 ----D---- C:\WINDOWS\Help
2010-02-21 11:37:22 ----D---- C:\Program Files\Windows Media Connect 2
2010-02-21 02:11:42 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-02-21 02:11:31 ----D---- C:\WINDOWS\Debug
2010-02-20 21:04:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2010-02-20 17:56:56 ----D---- C:\WINDOWS\WinSxS
2010-02-20 17:52:35 ----D---- C:\Documents and Settings\All Users\Data aplikací\LogiShrd
2010-02-20 17:49:46 ----D---- C:\Program Files\Common Files\Logitech
2010-02-20 17:48:41 ----D---- C:\Program Files\Common Files
2010-02-20 16:21:34 ----SD---- C:\Documents and Settings\Lukáš\Data aplikací\Microsoft
2010-02-19 22:49:32 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Skype
2010-02-19 21:51:54 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\skypePM
2010-02-19 14:50:24 ----D---- C:\Program Files\Alwil Software
2010-02-19 14:37:59 ----RSD---- C:\WINDOWS\assembly
2010-02-19 14:36:24 ----RSD---- C:\WINDOWS\Fonts
2010-02-19 14:35:47 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-19 14:23:25 ----D---- C:\Program Files\DivX
2010-02-19 13:35:34 ----D---- C:\Program Files\Adobe
2010-02-19 12:10:56 ----A---- C:\WINDOWS\wincmd.ini
2010-02-19 10:32:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-02-19 00:42:17 ----SD---- C:\WINDOWS\Tasks
2010-02-19 00:42:02 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Mozilla
2010-02-19 00:23:55 ----A---- C:\WINDOWS\system.ini
2010-02-19 00:14:29 ----D---- C:\WINDOWS\AppPatch
2010-02-18 23:20:09 ----D---- C:\Program Files\Lavasoft
2010-02-18 23:16:34 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-18 22:26:36 ----D---- C:\Program Files\Internet Explorer
2010-02-18 20:40:48 ----RASH---- C:\boot.ini
2010-02-09 13:04:26 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-09 13:04:07 ----D---- C:\NVIDIA
2010-02-09 11:30:13 ----D---- C:\WINDOWS\system32\DirectX
2010-02-08 21:46:57 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\HP
2010-02-07 20:59:37 ----D---- C:\WINDOWS\Cursors
2010-02-07 10:35:43 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-02-06 20:54:12 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-06 20:43:07 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-02-06 18:49:11 ----D---- C:\Program Files\Skype
2010-02-05 20:09:04 ----D---- C:\Program Files\IrfanView
2010-02-05 17:16:56 ----A---- C:\WINDOWS\Irremote.ini
2010-02-05 17:11:32 ----D---- C:\SmartDraw
2010-02-05 15:42:19 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-02-01 20:26:20 ----A---- C:\WINDOWS\system32\MRT.exe
2010-01-31 00:35:45 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\DivX
2010-01-29 19:40:36 ----D---- C:\WINDOWS\system32\cs-cz

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-02-11 28880]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41600]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-02-11 162512]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-02-11 46672]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-02-11 19024]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-02-11 100432]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-02-11 23376]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2004-08-23 821760]
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2003-11-11 41984]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 aovo46nt;aovo46nt; C:\WINDOWS\system32\drivers\aovo46nt.sys []
S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-04-11 20496]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-10-06 22016]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-10-06 7936]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;Nokia USB Serial Port; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-12-18 1044808]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-30 602112]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe [2008-12-22 410976]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [2009-07-20 121360]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-05-16 271920]
S3 NY;NY; C:\DOCUME~1\LUK~1\LOCALS~1\Temp\NY.exe []
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SDYDAL;SDYDAL; C:\DOCUME~1\LUK~1\LOCALS~1\Temp\SDYDAL.exe []
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-01-15 435016]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Nevidím nic nebezpečného. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[Iluzionista]

Dobře, už skenuji. Je možné že zpomalení netu byla chyba poskytovatele internetu? (údržba sítě)
A jaké bezpečnostní programy by jste mi poradil?

[Rudy]

1. AV máte, můžete ještě doplnit o osobní firewall: http://www.viry.cz/forum/viewforum.php?f=41 .
2. Zpomalení netu samozřejmě může být i chyba na straně providera.

[Iluzionista]

Před chvilkou odrazil Avast 7 virů typu Rootkit... Před měsícem jsem s nimi měl velký problém.
A nejvíc zajímavé na tom je to, že avast mi viry ohlásil ve chvíli, když jsem nebyl na netu a koukal jsem na film.
Viděl jsem že poslední dobu letí Rootkit a security tool.. vlastně nejvíc příspěvků obsahuje prosby o pomoc, kdy je počítač napade Rootkity..
Vím jaké to je, mít v pc Rootkit.. CPU vytíženo na 100% a absolutní nemožnost otevřít nějakou složku. Prostě strašně pomalé.
Avast 5 mám chviličku a jsem naprosto spokojen. Je dokonce lepší než Avast 4.

[Rudy]

Až doskenujete MBAM, dejte log. pak bych ještě rád viděl logy Process a KernelModule z Icesword (antirootkit): http://www.viry.cz/forum/viewtopic.php?f=29&t=11394 .

[Iluzionista]

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3766
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.2.2010 22:25:32
mbam-log-2010-02-26 (22-25-32).txt

Typ kontroly: Kompletní kontrola (C:\|E:\|F:\|G:\|)
Zkontrolované objekty: 186180
Uplynulý čas: 1 hour(s), 19 minute(s), 37 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
E:\!záloha!\pálení\nero\Nero 8.3.2.1\keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.

[Iluzionista]

Process:

System Idle Process
System
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\alg.exe
C:\Program Files\QIP\qip.exe
C:\Documents and Settings\Luk ç\Plocha\IceSword122en\IceSword.exe

Kernel Module:

\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
vmqubfq.sys
spek.sys
\WINDOWS\System32\Drivers\WMILIB.SYS
\WINDOWS\System32\Drivers\SCSIPORT.SYS
ACPI.sys
pci.sys
isapnp.sys
viaide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
viamraid.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltmgr.sys
sr.sys
KSecDD.sys
WudfPf.sys
Ntfs.sys
NDIS.sys
viaagp1.sys
Mup.sys
\SystemRoot\system32\DRIVERS\amdk7.sys
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\cmuda.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\fetnd5b.sys
\SystemRoot\System32\Drivers\ak71nsrt.SYS
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\gameenum.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\sbfwim.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\i2omgmt.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\SbFw.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\drivers\sbhips.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\Aavmker4.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\LHidFilt.Sys
\SystemRoot\system32\DRIVERS\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\Wdf01000.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\aswMon2.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\HTTP.sys
\??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys
\SystemRoot\System32\Drivers\aswRdr.SYS
\SystemRoot\system32\drivers\kmixer.sys
\SystemRoot\System32\Drivers\IsDrv122.sys
\WINDOWS\system32\ntdll.dll
\Program Files\DAEMON Tools Lite\Engine.dll
C:\WINDOWS\System32\Drivers\sptd.sys

[Rudy]

Stáhněte ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe a uložte ho na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\System32\Drivers\ak71nsrt.SYS

Driver::
ak71nsrt

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkaz ze skriptu.

[šejba]

Ahoj, chtěl jsem se zeptat, avast mi našel v PC rootkit!! Co s tím mám dělat? stáhl jsem program hijackthis a scanoval jsem to, ale žádnej adresář jsem neměl červeně zbarvenej:( poraďte mi prosím... díky moc

[Iluzionista]

Takže jsem měl v pc nějaké viry?

[šejba]

tohle mi to vygeneruje:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:54:26, on 26.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\ICQ6.5\ICQ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Bára\Plocha\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [CNAP2 Launcher] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: winesm32.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winrkq32 - winrkq32.dll (file missing)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

--
End of file - 10695 bytes

[Iluzionista]

Šejba/ Už sem nepiš a udělej si vlastní topic. Neumíš snad číst!!!

[Iluzionista]

Zde je log

ComboFix 10-02-26.01 - Lukáš 26.02.2010 23:36:35.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1279.925 [GMT 1:00]
Spuštěný z: c:\documents and settings\Lukáš\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lukáš\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-26 do 2010-02-26 )))))))))))))))))))))))))))))))
.

2010-02-26 19:51 . 2010-02-26 19:51 -------- d-----w- c:\program files\Sunbelt Software
2010-02-26 17:29 . 2010-02-26 17:29 -------- d-----w- c:\program files\Common Files\Skype
2010-02-24 20:47 . 2010-02-24 20:47 -------- d-----w- c:\program files\GIMP-2.0
2010-02-24 16:01 . 2010-02-24 16:04 -------- d-----w- c:\program files\ICQ7.0
2010-02-23 18:49 . 2010-02-26 17:47 -------- d-----w- c:\program files\Microsoft Bootvis
2010-02-23 12:27 . 2010-02-23 12:27 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-23 12:26 . 2010-02-23 12:27 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-21 18:33 . 2010-02-21 18:33 -------- d-----w- c:\program files\GRETECH
2010-02-21 18:30 . 2010-02-21 18:30 -------- d-----w- c:\program files\VideoLAN
2010-02-21 18:30 . 2010-02-21 18:30 -------- d-----w- c:\program files\Comodo
2010-02-21 18:13 . 2008-02-28 12:26 1414440 ----a-w- c:\windows\system32\ShellManager310E2D762.dll
2010-02-20 20:04 . 2010-02-20 20:04 -------- d-----w- c:\program files\ICQ6Toolbar
2010-02-20 19:19 . 2010-02-20 19:19 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-02-20 17:08 . 2010-02-20 17:08 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-20 16:50 . 2008-04-14 03:21 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-20 16:50 . 2008-04-14 03:21 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-02-20 16:49 . 2009-07-20 11:25 301656 ----a-w- c:\windows\system32\BtCoreIf.dll
2010-02-20 16:48 . 2010-02-20 16:52 -------- d-----w- c:\program files\Common Files\Logishrd
2010-02-19 14:42 . 2010-02-21 11:02 -------- d-----w- c:\program files\QIP
2010-02-19 13:27 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-19 13:27 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-19 13:27 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-19 13:27 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-19 13:27 . 2010-02-11 18:38 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-19 13:27 . 2010-02-11 18:38 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-19 13:27 . 2010-02-11 18:38 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-19 13:26 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-19 13:26 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-19 12:35 . 2010-02-19 12:36 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-19 11:26 . 2010-02-19 11:26 -------- d-----w- c:\program files\FileHippo.com
2010-02-19 11:21 . 2010-02-26 17:32 -------- d-----w- c:\program files\CCleaner
2010-02-19 11:13 . 2010-02-19 11:13 -------- d-----w- C:\rsit
2010-02-19 09:24 . 2010-02-19 09:24 -------- d--h--w- c:\windows\PIF
2010-02-19 00:33 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-19 00:32 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-19 00:32 . 2010-02-19 00:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-17 10:25 . 2008-04-13 18:41 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-02-17 10:25 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-02-17 10:22 . 2001-08-17 19:13 27165 -c--a-w- c:\windows\system32\dllcache\fetnd5.sys
2010-02-17 10:22 . 2001-08-17 19:13 27165 ----a-w- c:\windows\system32\drivers\fetnd5.sys
2010-02-17 10:20 . 2008-04-13 18:45 52864 -c--a-w- c:\windows\system32\dllcache\dmusic.sys
2010-02-17 10:20 . 2008-04-13 18:45 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-02-17 10:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-02-17 10:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-02-17 10:14 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-02-17 10:14 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-02-09 12:04 . 2010-02-09 12:04 -------- d-----w- c:\windows\nview
2010-02-09 12:04 . 2008-05-16 13:01 446464 ----a-w- c:\windows\system32\nvudisp.exe
2010-02-08 19:24 . 2010-02-08 19:24 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-07 19:59 . 2010-02-21 18:20 -------- d-----w- c:\program files\Common Files\Nero
2010-02-07 18:39 . 2010-02-07 18:39 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-06 20:14 . 2010-02-26 15:55 -------- d-----w- c:\program files\trend micro
2010-02-06 12:41 . 2010-02-06 12:41 -------- d-----w- c:\program files\OO Software
2010-02-05 14:46 . 2010-02-05 16:10 -------- d-----w- c:\windows\Globalization
2010-02-05 14:40 . 2008-04-13 18:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-02-05 14:40 . 2008-04-13 18:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2010-02-05 14:34 . 2008-03-21 12:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-02-05 14:31 . 2010-02-26 17:50 -------- d-----w- c:\program files\Common Files\Nokia
2010-02-05 14:31 . 2010-02-05 14:31 -------- d-----w- c:\program files\DIFX
2010-02-05 14:31 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-02-05 14:31 . 2010-02-05 14:31 -------- d-----w- c:\program files\PC Connectivity Solution
2010-02-05 14:30 . 2009-10-06 10:52 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-01-30 10:50 . 2010-01-30 10:50 -------- d-sh--w- c:\windows\ftpcache
2010-01-29 13:59 . 1998-11-13 11:58 307200 ----a-w- c:\windows\IsUn0405.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 21:32 . 2010-01-17 14:37 -------- d-----w- c:\program files\Skype
2010-02-26 17:53 . 2004-08-18 12:00 77872 ----a-w- c:\windows\system32\perfc005.dat
2010-02-26 17:53 . 2004-08-18 12:00 428750 ----a-w- c:\windows\system32\perfh005.dat
2010-02-24 16:03 . 2010-01-02 11:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-23 18:26 . 2010-01-05 19:43 -------- d-----w- c:\program files\Common Files\Ahead
2010-02-21 18:33 . 2010-01-14 19:00 -------- d-----w- c:\program files\Webteh
2010-02-21 18:19 . 2010-01-05 19:43 -------- d-----w- c:\program files\Nero
2010-02-21 17:55 . 2010-01-10 09:59 -------- d-----w- c:\program files\Ashampoo
2010-02-21 10:37 . 2010-01-05 19:18 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-20 16:49 . 2010-01-11 18:49 -------- d-----w- c:\program files\Common Files\Logitech
2010-02-19 13:50 . 2010-01-02 12:33 -------- d-----w- c:\program files\Alwil Software
2010-02-19 13:23 . 2010-01-23 21:23 -------- d-----w- c:\program files\DivX
2010-02-18 22:20 . 2010-01-17 18:55 -------- d-----w- c:\program files\Lavasoft
2010-02-07 09:35 . 2010-01-17 19:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-06 19:43 . 2010-01-15 20:57 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-02-05 19:09 . 2010-01-17 14:33 -------- d-----w- c:\program files\IrfanView
2010-02-05 14:42 . 2010-02-05 14:42 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-02-05 14:42 . 2010-02-05 14:42 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2010-02-05 14:34 . 2010-02-05 14:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-02-05 14:34 . 2010-02-05 14:34 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-27 21:15 . 2010-01-27 21:15 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-01-25 17:21 . 2010-01-25 17:21 -------- d-----w- c:\program files\Archiving
2010-01-23 19:25 . 2010-01-02 11:43 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-18 19:39 . 2010-01-18 19:39 -------- d-----w- c:\program files\Common Files\ACTIV Software
2010-01-18 19:39 . 2010-01-18 19:39 -------- d-----w- c:\program files\ACTIV Software
2010-01-17 20:59 . 2010-01-17 20:59 -------- d-----w- c:\program files\Opera
2010-01-17 14:38 . 2010-01-17 14:38 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-14 18:28 . 2010-01-14 18:28 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-01-14 18:27 . 2010-01-14 18:28 737280 ----a-w- c:\windows\iun6002.exe
2010-01-12 15:46 . 2010-01-12 15:46 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-11 22:46 . 2010-01-11 21:19 126984 ----a-w- c:\windows\hpoins11.dat
2010-01-11 22:45 . 2010-01-11 21:00 -------- d-----w- c:\program files\HP
2010-01-11 22:44 . 2010-01-11 22:43 -------- d-----w- c:\program files\Common Files\HP
2010-01-11 22:42 . 2010-01-11 22:41 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-11 22:41 . 2010-01-11 22:41 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-01-11 18:54 . 2010-01-11 18:54 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-01-11 18:54 . 2010-01-11 18:54 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-01-11 18:51 . 2010-01-11 18:51 -------- d-----w- c:\program files\Common Files\LogiShared
2010-01-11 18:51 . 2010-01-11 18:51 127034 ------r- c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2010-01-11 18:51 . 2010-01-11 18:49 -------- d-----w- c:\program files\Logitech
2010-01-10 11:21 . 2010-01-02 11:14 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-10 11:21 . 2010-01-02 11:14 2684 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-10 11:15 . 2010-01-02 11:14 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-10 10:06 . 2010-01-10 10:06 -------- d-----w- c:\program files\MSBuild
2010-01-10 10:06 . 2010-01-10 10:06 -------- d-----w- c:\program files\Reference Assemblies
2010-01-10 09:59 . 2010-01-10 09:59 -------- d-----w- c:\program files\MSXML 6.0
2010-01-05 19:24 . 2010-01-05 19:24 0 ----a-w- c:\windows\nsreg.dat
2010-01-05 18:55 . 2010-01-05 18:55 0 ----a-w- c:\windows\ativpsrm.bin
2010-01-05 18:53 . 2010-01-02 12:43 -------- d-----w- c:\program files\ATI Technologies
2010-01-02 12:44 . 2010-01-02 12:44 -------- d-----w- c:\program files\Microsoft.NET
2010-01-02 11:52 . 2010-01-02 11:52 -------- d-----w- c:\program files\C-Media 3D Audio
2010-01-02 11:15 . 2010-01-02 11:15 -------- d-----w- c:\program files\microsoft frontpage
2010-01-02 11:11 . 2010-01-02 11:11 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-31 16:50 . 2004-08-18 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-18 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 23:14 . 2010-01-15 20:58 30536 ----a-w- c:\windows\system32\TURegOpt.exe
2009-12-17 23:08 . 2010-01-15 20:58 30024 ----a-w- c:\windows\system32\uxtuneup.dll
2009-12-17 07:42 . 2010-01-02 11:10 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-18 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2004-08-18 12:00 2191360 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2068224 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-18 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"= "c:\documents and settings\Lukáš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll" [2010-02-18 149968]

[HKEY_CLASSES_ROOT\clsid\{a55f9c95-2bb1-4ea2-bc77-dfaab78832ce}]
[HKEY_CLASSES_ROOT\qipbar.QIPBHO.1]
[HKEY_CLASSES_ROOT\qipbar.QIPBHO]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
2010-02-18 15:46 149968 ----a-w- c:\documents and settings\Lukáš\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 11:28 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ICQ"="c:\progra~1\ICQ6.5\ICQ.exe" silent
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"NokiaMServer"=c:\program files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19.2.2010 14:27 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19.2.2010 14:27 19024]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [18.12.2009 0:12 1044808]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.2.2010 13:27 691696]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [10.1.2010 10:59 410976]
S3 NY;NY;c:\docume~1\LUK~1\LOCALS~1\Temp\NY.exe --> c:\docume~1\LUK~1\LOCALS~1\Temp\NY.exe [?]
S3 SDYDAL;SDYDAL;c:\docume~1\LUK~1\LOCALS~1\Temp\SDYDAL.exe --> c:\docume~1\LUK~1\LOCALS~1\Temp\SDYDAL.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-02-26 c:\windows\Tasks\Automatic troubleshooting.job
- c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-17 23:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\3xjtvnaf.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - component: c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\3xjtvnaf.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}\components\qippipe.dll
FF - component: c:\documents and settings\Lukáš\Data aplikací\Mozilla\Firefox\Profiles\3xjtvnaf.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 23:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="2393EDEB511EA7437DCF9F432A25F7EB62915FE5CB9548B316362153AA458772A7C2301275E5664B177EE80A814413F088D57B3547580EB60299C5956AA383FDFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D5D575E7D6A3B9808FEBC9E127BECC74C75227F98638672422BFB6C201944D6251995E9DC183F4016143D36093EAF181E36744E38B102FC31ABA2C353EB37A3167C2522E0D612C315739D6626F21D98818F27049196F36D0D88C4FB7736EB3B6ADDAC869EBB7C5C437A63C51C7907C47A69A10A019BE2D247140CB156B63DAF10993F04EAE2CD3D28AEA431ECE6D30FCD8F1E52566D67030183F9842FD59A56A8EE418B138BE85A05F6CB8B11F17A2F77332ACED7DB2F94136E6119B29B84C685FDE9935417C5EEC79D153D757686A02468AB773EDDFA640955E81987B714DF324FC794E28D6EFA985313AFF8F59921372756C8378B219322970F3148FA70426ACB3B8D659903BC4FAB2CD07113E635474CB64261228984D179211181DB58D11DC177FE778936BE791C9994A416B7231F19AA66D581325F4027C5ED367320B8F0E407EFA5D1D0C7D9016971506AE6F6BC30E43D99AEAB9248AC71805C80AC643DCAC668F587ACE6E41A7CE0A32067FE529AEDD32C531D4BF87BF185DD64F7068FEDE6775FE5B86FC58B8A62C36B3ACE48461EB87DBCBD809668E5BD1925111227ACEB2FCACDF976D65B1BF94624793E3701A5FE725ADC68192EC2ECDF6C1A42F8C9AE23983F0656ACF50DAB39C5D1E6ED81873F654259FE2BE84E5C788949932DEADC6E1B63092D0C2911841DF18128EF5E1994222CA906AD9AA5D81C6CE7C6A11B762E190341DCECAAAF91E4E95FA6F295071F69F6D701B2A83833F8AB5562E548CE054F8F048CFE90BF657896D148E1864E03F1210037815C4A3FB182842E3F4591186C9AB6A422567097B385D5B85BF4436663D1D4369664F1D65C4C7AB6A4C9BA0F91D956556DDA4343E7E3FBE6318B8B76DA5099CCA14F9DD5028DD0CEC36D999A57AAEF1029628E85D7086807E9D4A261698A299085940B1D2269B80BFDB0D3EAC88AA70AD294FB82BBE8D28EC042D75C94116FD7590E4E10ACACF044E674E236649CB5BE1CFB875F3F2187B82427CB9E5598EF406A7850998AC35318450192359DA7646BEB0805480472688536BCF6E298F93D29B673CA2513C047E7987E83A6DA969492D90E996A9DC0E7B8CE9FA3E83F328238F187CF2316D94BD78F7D2C4B777837F935423F7992920ED7F64F71F41EE1FC53059CC109D4E773518F6F5369C201D42CFDC1C32C6094F82F6D30514F7ECEFCA7897E58CE06E96502B0AA17CA7F0508F66A0C48BCF517574E248B8C429D62E826CF6120715201D95B40"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Celkový čas: 2010-02-26 23:43:05
ComboFix-quarantined-files.txt 2010-02-26 22:43

Před spuštěním: Volných bajtů: 23 185 760 256
Po spuštění: Volných bajtů: 23 155 412 992

- - End Of File - - 0E7D389F85392FC8AC11FCEE3DBDCF96

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\docume~1\LUK~1\LOCALS~1\Temp\NY.exe
c:\docume~1\LUK~1\LOCALS~1\Temp\SDYDAL.exe

Driver::
NY
SDYDAL

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.