Rootkit

[Ahoj22]

Dobry vecer,mam problem s rootkitom,neda sa vymazat,nevie ho vymazat ani mbam,combofix sa zakazdym sekne,avast ho tiez nevie vymazat,najde ho iba pri spustenom systeme a oznaci ho za podozrivy subor. posielam log z rsit .Dakujem
umiestnenie rootkita: C:\Windows\System32\drivers\yajyy.sys - neda sa otestovat na virustotale

C:\Users\Dávid\AppData\Local\Windows Server\kfqsmr.dll - http://www.virustotal.com/analisis/86de ... 1267923896

Logfile of random's system information tool 1.06 (written by random/random)
Run by Dávid at 2010-03-07 18:36:15
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 122 GB (41%) free of 295 GB
Total RAM: 3068 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:36:22, on 7. 3. 2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Comodo\Dragon\dragon.exe
C:\Program Files\Comodo\Dragon\dragon.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\a-squared Free\a2free.exe
C:\Users\Dávid\Documents\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Dávid.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{3ADE4F4E-491A-4B4C-B0A1-CB6E7594214B}: NameServer = 213.151.200.31 213.151.208.162
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f85b771c\aestsrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: @C:\Program Files\DigitalPersona\Bin\DpHostW.exe,-128 (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f85b771c\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: Validity VCS Fingerprint Service (vcsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vcsFPService.exe

--
End of file - 7056 bytes

======Scheduled tasks folder======

C:\Windows\tasks\HPCeeScheduleForDávid.job
C:\Windows\tasks\User_Feed_Synchronization-{6864FB7A-FCE4-4EF2-8CB5-3D09240F67A2}.job
C:\Windows\tasks\User_Feed_Synchronization-{80FEAF31-1710-46C9-BBD2-8C198E3A7BA1}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DpAgent"=C:\Program Files\DigitalPersona\Bin\dpagent.exe [2008-12-10 842816]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2008-10-10 206128]
"WirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2009-01-23 484408]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-02-02 835584]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-01-07 429392]
"SmartMenu"=C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [2009-01-08 915000]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2009-10-26 15872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer for HP TouchSmart]
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2008-12-25 189736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDAgent]
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe [2008-11-28 1148200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09 75008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7.0\ICQ.exe [2010-02-14 133368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-01-07 429392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2009-07-23 13797920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartMenu]
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [2009-01-08 915000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
C:\Program Files\IDT\WDM\sttray.exe [2009-01-28 483420]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSMAgent]
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [2008-12-25 1316136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [2008-11-14 218408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [2008-06-13 210216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-12-03 218408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDIRShortCut]
C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [2008-12-03 218408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [2009-01-12 210216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WPCUMI]
C:\Windows\system32\WpcUmi.exe [2006-11-02 176128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
DPPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmadmin]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmboot.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmload.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmserver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ip6fw.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NtLmSsp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpcdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpwd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SRService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\tdpipe.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\tdtcp.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\termservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoLogoff"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2010-03-07 18:31:36 ----D---- C:\Program Files\a-squared Free
2010-03-07 18:05:31 ----D---- C:\rsit
2010-03-07 17:46:35 ----D---- C:\Program Files\Unlocker
2010-03-07 17:26:53 ----A---- C:\Windows\NIRCMD.exe
2010-03-07 17:23:46 ----A---- C:\Windows\SWXCACLS.exe
2010-03-07 16:39:37 ----D---- C:\Program Files\Trend Micro
2010-03-07 15:55:25 ----D---- C:\Program Files\TrendMicro
2010-03-07 15:36:25 ----A---- C:\Windows\system32\aswBoot.exe
2010-03-07 14:57:50 ----A---- C:\Windows\ntbtlog.txt
2010-03-07 14:38:04 ----D---- C:\Program Files\Alwil Software
2010-03-07 14:31:18 ----RSHD---- C:\RECYCLER
2010-03-07 13:51:34 ----D---- C:\Program Files\WinClamAVShield
2010-03-06 22:10:46 ----A---- C:\Windows\system32\CmdLineExt.dll
2010-03-06 21:37:48 ----D---- C:\Program Files\Comodo
2010-03-06 21:26:01 ----A---- C:\Windows\system32\browserchoice.exe
2010-03-06 20:48:34 ----D---- C:\Users\Dávid\AppData\Roaming\ESET
2010-03-06 20:22:07 ----D---- C:\Program Files\Eset
2010-03-06 20:09:01 ----D---- C:\Program Files\Common Files\SWF Studio
2010-03-06 20:07:47 ----D---- C:\Users\Dávid\AppData\Roaming\Disney Interactive
2010-03-06 20:07:47 ----D---- C:\Program Files\Disney Interactive
2010-03-06 20:07:24 ----A---- C:\Windows\disney.ini
2010-03-06 20:04:43 ----D---- C:\Program Files\PC Connectivity Solution
2010-03-06 01:14:57 ----D---- C:\ProgramData\Comodo Downloader
2010-03-05 20:55:38 ----D---- C:\ProgramData\WindowsSearch
2010-02-28 16:07:56 ----D---- C:\Program Files\Zaklínač - Rozšířená edice
2010-02-28 14:27:04 ----D---- C:\ProgramData\Avira
2010-02-28 12:57:30 ----A---- C:\caisslog.txt
2010-02-28 11:50:25 ----D---- C:\Users\Dávid\AppData\Roaming\Kaspersky_Key_Finder_(KKF
2010-02-28 11:20:50 ----D---- C:\Users\Dávid\AppData\Roaming\InstallShield
2010-02-28 00:45:10 ----D---- C:\ProgramData\Kaspersky Lab
2010-02-27 20:54:33 ----D---- C:\ProgramData\Lavasoft
2010-02-27 14:12:50 ----D---- C:\ProgramData\IObit
2010-02-27 14:00:36 ----D---- C:\ProgramData\Norton
2010-02-27 14:00:12 ----D---- C:\ProgramData\NortonInstaller
2010-02-26 21:30:55 ----D---- C:\Users\Dávid\AppData\Roaming\Kingsoft
2010-02-26 21:26:49 ----D---- C:\ProgramData\Kingsoft
2010-02-26 17:50:24 ----D---- C:\Program Files\Opera 10.50 Beta
2010-02-26 17:26:58 ----D---- C:\Users\Dávid\AppData\Roaming\Songbird2
2010-02-26 17:26:40 ----A---- C:\Windows\system32\GEARAspi.dll
2010-02-26 17:26:08 ----D---- C:\Program Files\Songbird
2010-02-25 11:54:04 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-02-24 22:11:28 ----SHD---- C:\$RECYCLE.BIN
2010-02-24 22:11:24 ----D---- C:\Windows\temp
2010-02-24 12:26:26 ----A---- C:\Users\Dávid\AppData\Roaming\736B.tmp
2010-02-24 12:13:54 ----A---- C:\Windows\system32\aswB7B2.tmp
2010-02-24 11:01:30 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-24 11:01:29 ----A---- C:\Windows\system32\secproc.dll
2010-02-24 11:01:23 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-24 11:01:23 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-24 11:01:22 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-24 11:01:22 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-24 11:01:21 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-24 11:01:20 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-24 11:01:20 ----A---- C:\Windows\system32\msdrm.dll
2010-02-24 10:30:13 ----A---- C:\Windows\system32\tzres.dll
2010-02-24 10:08:31 ----A---- C:\Windows\system32\gameux.dll
2010-02-24 10:08:24 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-02-24 10:08:21 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-02-24 10:06:26 ----A---- C:\Windows\system32\jscript.dll
2010-02-19 22:50:11 ----D---- C:\ProgramData\Google
2010-02-14 14:12:17 ----A---- C:\Windows\system32\win_utilman.exe
2010-02-14 14:12:06 ----A---- C:\Windows\system32\ezUPBHook.dll
2010-02-14 14:12:06 ----A---- C:\Windows\system32\ezUninst.exe
2010-02-14 14:12:06 ----A---- C:\Windows\system32\ezShellStart.exe
2010-02-14 14:12:06 ----A---- C:\Windows\system32\ezSetup.exe
2010-02-14 14:12:06 ----A---- C:\Windows\system32\ezMAPIHelper.exe
2010-02-09 22:54:38 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-09 22:54:38 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-09 22:53:55 ----A---- C:\Windows\system32\quartz.dll
2010-02-09 22:53:53 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-09 22:53:53 ----A---- C:\Windows\system32\msyuv.dll
2010-02-09 22:53:53 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-09 22:53:52 ----A---- C:\Windows\system32\msrle32.dll
2010-02-09 22:53:52 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-09 22:53:50 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-09 22:53:49 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-09 22:53:49 ----A---- C:\Windows\system32\avifil32.dll
2010-02-08 22:00:12 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-08 21:46:16 ----D---- C:\Program Files\Microsoft Visual Studio
2010-02-08 21:45:30 ----D---- C:\Program Files\Microsoft.NET
2010-02-08 21:38:21 ----D---- C:\ProgramData\Microsoft Help

======List of files/folders modified in the last 1 months======

2010-03-07 18:31:53 ----RD---- C:\Program Files
2010-03-07 18:31:53 ----D---- C:\Windows\system32\drivers
2010-03-07 18:12:22 ----D---- C:\Users\Dávid\AppData\Roaming\Skype
2010-03-07 17:31:08 ----D---- C:\Windows\system32\config
2010-03-07 17:31:08 ----D---- C:\boot
2010-03-07 17:30:52 ----D---- C:\Windows\ERDNT
2010-03-07 17:28:35 ----D---- C:\Windows\System32
2010-03-07 17:26:53 ----D---- C:\Windows
2010-03-07 17:16:22 ----D---- C:\Windows\Prefetch
2010-03-07 16:07:41 ----D---- C:\Users\Dávid\AppData\Roaming\skypePM
2010-03-07 15:55:26 ----SHD---- C:\Windows\Installer
2010-03-07 15:45:00 ----RD---- C:\Windows\Offline Web Pages
2010-03-07 15:30:34 ----D---- C:\ProgramData
2010-03-07 15:22:47 ----D---- C:\ProgramData\Alwil Software
2010-03-07 15:02:29 ----D---- C:\Windows\Minidump
2010-03-07 15:00:22 ----RSD---- C:\Windows\Fonts
2010-03-07 13:59:28 ----D---- C:\Windows\Tasks
2010-03-07 13:37:43 ----D---- C:\Windows\system32\catroot
2010-03-07 13:37:43 ----D---- C:\Windows\inf
2010-03-06 21:37:59 ----D---- C:\Windows\system32\Tasks
2010-03-06 21:26:17 ----D---- C:\Windows\winsxs
2010-03-06 20:47:29 ----D---- C:\Windows\system32\catroot2
2010-03-06 20:25:39 ----A---- C:\Windows\system32\ezsvc7x.dll
2010-03-06 20:09:01 ----D---- C:\Program Files\Common Files
2010-03-06 20:08:59 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-06 20:05:32 ----D---- C:\ProgramData\Installations
2010-03-06 20:05:31 ----D---- C:\Program Files\DIFX
2010-03-06 20:05:30 ----DC---- C:\Windows\system32\DRVSTORE
2010-03-06 20:04:39 ----D---- C:\Program Files\Nokia
2010-03-06 20:01:38 ----D---- C:\Program Files\Common Files\Nokia
2010-03-05 21:28:20 ----D---- C:\Windows\DigitalLocker
2010-03-03 11:24:44 ----D---- C:\Windows\Web
2010-03-02 22:40:29 ----D---- C:\Users\Dávid\AppData\Roaming\ICQ
2010-02-28 17:07:16 ----D---- C:\Program Files\Electronic Arts
2010-02-28 17:07:03 ----RSD---- C:\Windows\assembly
2010-02-28 15:12:40 ----D---- C:\Program Files\ICQ7.0
2010-02-28 15:07:19 ----A---- C:\ProgramData\HPWALog.txt
2010-02-28 13:01:50 ----D---- C:\Program Files\Opera
2010-02-28 01:39:41 ----D---- C:\Program Files\Windows Media Player
2010-02-27 23:31:52 ----SD---- C:\Users\Dávid\AppData\Roaming\Microsoft
2010-02-27 21:21:39 ----D---- C:\Windows\pss
2010-02-27 21:21:39 ----D---- C:\Windows\L2Schemas
2010-02-27 20:18:57 ----D---- C:\Windows\Globalization
2010-02-27 17:00:47 ----D---- C:\Windows\Registration
2010-02-27 14:02:16 ----SHD---- C:\System Volume Information
2010-02-26 22:03:06 ----D---- C:\Program Files\MSN Messenger
2010-02-26 21:59:39 ----D---- C:\Windows\tapi
2010-02-26 19:36:29 ----D---- C:\Windows\WindowsMobile
2010-02-26 17:50:38 ----D---- C:\Users\Dávid\AppData\Roaming\Opera
2010-02-26 17:27:44 ----D---- C:\Users\Dávid\AppData\Roaming\Mozilla
2010-02-26 16:00:24 ----D---- C:\Windows\Setup
2010-02-24 22:06:02 ----A---- C:\Windows\system.ini
2010-02-24 21:57:13 ----D---- C:\Windows\AppPatch
2010-02-24 21:47:54 ----D---- C:\Windows\cs-CZ
2010-02-24 14:55:36 ----RSD---- C:\Windows\Media
2010-02-24 13:24:19 ----D---- C:\Windows\PCHEALTH
2010-02-24 11:54:34 ----D---- C:\Windows\rescache
2010-02-24 11:26:51 ----D---- C:\Windows\system32\sk-SK
2010-02-24 11:26:51 ----D---- C:\Windows\system32\cs-CZ
2010-02-24 09:16:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-23 19:07:34 ----HD---- C:\Windows\system32\GroupPolicyUsers
2010-02-22 15:28:41 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-14 20:21:18 ----D---- C:\Program Files\CCleaner
2010-02-14 14:27:08 ----D---- C:\ProgramData\Temp
2010-02-14 14:16:27 ----D---- C:\Windows\Debug
2010-02-14 14:09:59 ----D---- C:\My Downloads
2010-02-12 21:26:27 ----D---- C:\ProgramData\CyberLink
2010-02-09 23:29:20 ----D---- C:\Program Files\Common Files\microsoft shared
2010-02-09 23:28:49 ----D---- C:\Program Files\Microsoft Works
2010-02-09 23:26:25 ----A---- C:\Windows\win.ini
2010-02-09 23:26:24 ----D---- C:\Program Files\Common Files\System
2010-02-09 23:00:14 ----D---- C:\Program Files\Windows Mail
2010-02-08 21:52:01 ----D---- C:\Windows\ShellNew
2010-02-08 21:46:20 ----D---- C:\Program Files\Microsoft Office
2010-02-08 20:20:15 ----D---- C:\Windows\Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/08/04 11:21:03]; \??\C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [2008-11-28 87536]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328]
R3 Accelerometer;HP Accelerometer; C:\Windows\system32\DRIVERS\Accelerometer.sys [2008-03-27 34664]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-08-04 1880056]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2008-06-23 80424]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2008-06-23 81960]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2008-06-23 16168]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2008-12-30 57856]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-12-23 15664]

[Rudy]

Zkuste spustit ComboFix v nouz. režimu.

[Ahoj22]

Combofix som v nudzovom rezime spustil...aj mi vypisal ze mi dane subory(malware) odstranil,ale log nevytvoril....a ako mi nabehol win tak som siel overit ci ich naozaj vymazal, ale su tam stale. Pred tym ako som Vam pisal sa mi stiahli aktualizacie na asquared s jadrom ikarusa, mozem spustit skenovanie, alebo navrhujete nieco ine?

[Rudy]

Log by měl být v C:\combofix.txt.

[Ahoj22]

zial tam je iba toto :
ComboFix 10-03-06.08 - Dávid . 03. 2010 19:05:55.6.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.421.1051.18.3068.2587 [GMT 1:00]
Running from: C:\Users\Dávid\Documents\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\RECYCLER\S-1-5-21-1943005934-9416174092-448597851-0705
C:\Windows\system32\drivers\yajyy.sys . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_yajyy
-------\Service_yajyy




a virusy ktore zmazem rucne sa tam znovu objavia,ked ich chcem odtestovat na virustotale vypise ze sluzba uz nebezi alebo zariadenie uz nie je pripojene...

[Rudy]

Našel ho, ale sestřelil poze ovladač. Zkuste ho spustit ještě jednou, uvidíme, zda se něco změní.

[Ahoj22]

ok,idem na to,ale bude to trvat asi dlhsie cca 30 min,potom sa ozvem,zatial dakujem

[Ahoj22]

no uz som po combofixe,nic sa nezmenilo,az na to ze niektore subory z neho uplne zmizli ,a vysledok ziadny....a teraz vazne...mate nejake ine riesenie?
a ten zapchast (co som testoval v prvom prispevku) chrani subor taskeng v zlozke system32,ked ho vymazem s unlockerom je o5 s5

[Rudy]

PC je opravdu silně zavirován. Zkuste na to pustit AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 .

[Ahoj22]

prave som si nainstaloval kis 7 je nutny aj avptool? alebo staci len prejst pc kasperskym? dakujem.

[Rudy]

Stačí Kašperákem. Zkuste vyléčit, co půjde.

[Ahoj22]

Tak uz je sken zapnuty a vyzera to celkom slubne,zatial len dva trojany,ale je len 10% skenu.

[Rudy]

Nechte dojet do konce a pak se uvidí.

[Ahoj22]

uz konecne mam log z combofixu

ComboFix 10-03-06.08 - Dávid . 03. 2010 0:50.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.421.1051.18.3068.1794 [GMT 1:00]
Running from: c:\users\Dávid\Documents\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Internet Security *enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\yajyy.sys
c:\progra~1\KASPER~1\KASPER~1.0\r3hook.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_yajyy
-------\Service_yajyy


((((((((((((((((((((((((( Files Created from 2010-02-08 to 2010-03-08 )))))))))))))))))))))))))))))))
.

2010-03-08 00:00 . 2010-03-08 00:00 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-08 00:00 . 2010-03-08 00:00 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-03-08 00:00 . 2010-03-08 00:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-07 23:47 . 2010-03-07 23:48 -------- d-----w- C:\32788R22FWJFW
2010-03-07 20:02 . 2010-03-07 21:00 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-03-07 20:02 . 2010-03-07 21:00 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-03-07 20:01 . 2010-03-07 20:01 -------- d-----w- c:\program files\Kaspersky Lab
2010-03-07 17:31 . 2010-03-07 17:52 -------- d-----w- c:\program files\a-squared Free
2010-03-07 17:05 . 2010-03-07 17:05 -------- d-----w- C:\rsit
2010-03-07 16:46 . 2010-03-07 18:42 -------- d-----w- c:\program files\Unlocker
2010-03-07 15:39 . 2010-03-07 15:39 -------- d-----w- c:\program files\Trend Micro
2010-03-07 14:55 . 2010-03-07 14:55 -------- d-----w- c:\program files\TrendMicro
2010-03-07 13:38 . 2010-03-07 14:36 -------- d-----w- c:\program files\Alwil Software
2010-03-07 13:14 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-07 12:51 . 2010-03-07 13:14 -------- d-----w- c:\program files\WinClamAVShield
2010-03-06 21:10 . 2010-03-06 21:10 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-06 20:37 . 2010-03-06 20:37 -------- d-----w- c:\program files\Comodo
2010-03-06 20:26 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-03-06 19:22 . 2010-03-06 20:19 -------- d-----w- c:\program files\Eset
2010-03-06 19:09 . 2010-03-06 19:09 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-03-06 19:07 . 2010-03-06 19:07 -------- d-----w- c:\program files\Disney Interactive
2010-03-06 19:05 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-03-06 19:04 . 2010-03-06 19:04 -------- d-----w- c:\program files\PC Connectivity Solution
2010-03-06 00:41 . 2010-03-06 09:38 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-03-06 00:14 . 2010-03-06 00:25 -------- d-----w- c:\programdata\Comodo Downloader
2010-02-28 15:07 . 2010-02-28 15:32 -------- d-----w- c:\program files\Zaklínač - Rozšířená edice
2010-02-27 23:45 . 2010-03-07 23:08 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-27 23:45 . 2010-03-08 00:04 6352672 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-27 19:54 . 2010-02-27 20:16 -------- d-----w- c:\programdata\Lavasoft
2010-02-27 13:12 . 2010-02-27 13:12 -------- d-----w- c:\programdata\IObit
2010-02-27 13:00 . 2010-02-27 13:04 -------- d-----w- c:\programdata\Norton
2010-02-27 13:00 . 2010-02-27 13:00 -------- d-----w- c:\programdata\NortonInstaller
2010-02-26 20:45 . 2010-02-26 20:45 17920 ----a-w- c:\windows\system32\ATSpy.sys
2010-02-26 20:26 . 2010-02-26 20:39 -------- d-----w- c:\programdata\Kingsoft
2010-02-26 16:50 . 2010-02-26 16:50 -------- d-----w- c:\program files\Opera 10.50 Beta
2010-02-26 16:26 . 2009-12-23 11:03 15664 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-26 16:26 . 2009-12-23 11:03 109360 ----a-w- c:\windows\system32\GEARAspi.dll
2010-02-26 16:26 . 2010-02-26 16:26 -------- d-----w- c:\program files\Songbird
2010-02-24 10:01 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-24 10:01 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-24 10:01 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-24 10:01 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-24 10:01 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-24 10:01 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-24 10:01 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-24 10:01 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-24 10:01 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-24 09:30 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 09:08 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-24 09:08 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-24 09:08 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-02-14 13:12 . 2009-04-11 06:28 638976 ----a-w- c:\windows\system32\win_utilman.exe
2010-02-14 13:12 . 2010-02-14 13:12 93640 ----a-w- c:\windows\system32\ezUninst.exe
2010-02-14 13:12 . 2010-02-14 13:12 51656 ----a-w- c:\windows\system32\ezUPBHook.dll
2010-02-14 13:12 . 2010-02-14 13:12 271304 ----a-w- c:\windows\system32\ezSetup.exe
2010-02-14 13:12 . 2010-02-14 13:12 18376 ----a-w- c:\windows\system32\ezMAPIHelper.exe
2010-02-14 13:12 . 2010-02-14 13:12 115656 ----a-w- c:\windows\system32\ezShellStart.exe
2010-02-09 21:55 . 2009-12-08 20:01 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-09 21:55 . 2009-12-08 17:26 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2010-02-09 21:54 . 2009-12-11 11:43 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-09 21:54 . 2009-12-11 11:43 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-09 21:54 . 2009-12-08 20:01 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-09 21:54 . 2009-12-08 20:01 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-09 21:53 . 2009-12-04 18:29 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-02-09 21:53 . 2009-12-04 18:30 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-02-09 21:53 . 2009-12-04 18:28 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-02-09 21:53 . 2009-12-04 18:28 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-02-09 21:53 . 2009-12-04 18:28 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-02-09 21:53 . 2009-12-04 18:28 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-02-09 21:53 . 2009-12-04 18:28 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-02-09 21:53 . 2009-12-04 18:28 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-02-09 21:53 . 2009-12-04 18:27 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-02-09 21:53 . 2009-12-04 15:56 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-09 21:53 . 2009-12-04 15:56 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-09 16:29 . 2010-02-09 16:29 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-02-08 20:45 . 2010-02-08 20:45 -------- d-----w- c:\program files\Microsoft.NET
2010-02-08 20:38 . 2010-02-09 22:30 -------- d-----w- c:\programdata\Microsoft Help
2010-02-06 21:28 . 2010-02-06 21:28 -------- d-----w- c:\program files\OpenOffice.org 3
2010-02-06 21:27 . 2010-02-06 21:27 -------- d-----w- C:\OpenOffice.org 3.0 (cs) Installation Files
2010-02-06 18:45 . 2010-02-06 18:45 -------- d-----w- c:\programdata\Nokia
2010-02-06 18:45 . 2010-02-06 18:45 -------- d-----w- c:\programdata\PC Suite
2010-02-06 18:34 . 2010-02-06 18:34 -------- d-----w- c:\programdata\NokiaMusic
2010-02-06 18:33 . 2010-02-06 18:33 -------- d-----w- c:\program files\Common Files\muvee Technologies
2010-02-06 18:31 . 2010-03-06 19:01 -------- d-----w- c:\program files\Common Files\Nokia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-08 00:03 . 2010-03-07 19:59 31871 ----a-w- c:\programdata\nvModes.dat
2010-03-08 00:01 . 2010-02-27 23:45 87056 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-08 00:00 . 2009-03-30 03:39 2140 ----a-w- c:\windows\bthservsdp.dat
2010-03-07 14:22 . 2010-02-05 15:28 -------- d-----w- c:\programdata\Alwil Software
2010-03-06 19:25 . 2009-03-30 05:20 588472 ----a-w- c:\windows\system32\ezsvc7x.dll
2010-03-06 19:23 . 2010-01-13 19:20 573968 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-03-06 19:08 . 2009-03-30 04:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-06 19:05 . 2009-09-24 17:35 -------- d-----w- c:\programdata\Installations
2010-03-06 19:05 . 2009-08-04 08:46 -------- d-----w- c:\program files\DIFX
2010-03-06 19:04 . 2009-09-03 15:42 -------- d-----w- c:\program files\Nokia
2010-03-06 18:59 . 2010-03-06 18:59 3351812 ----a-w- c:\programdata\Installations\{D043E0F8-5EFA-4102-A863-08F39D9DF2F4}\Installer\CommonCustomActions\msxml6Exec.exe
2010-03-06 18:59 . 2010-03-06 18:59 36864 ----a-w- c:\programdata\Installations\{D043E0F8-5EFA-4102-A863-08F39D9DF2F4}\Installer\CommonCustomActions\Sleep.exe
2010-03-06 18:59 . 2010-03-06 18:59 3203453 ----a-w- c:\programdata\Installations\{D043E0F8-5EFA-4102-A863-08F39D9DF2F4}\Installer\CommonCustomActions\vcredistExec.exe
2010-03-06 18:59 . 2010-03-06 19:00 34814832 ----a-w- c:\programdata\Installations\{D043E0F8-5EFA-4102-A863-08F39D9DF2F4}\NokiaSoftwareUpdaterSetup_2.4.5SK.exe
2010-02-28 16:07 . 2009-09-18 13:12 -------- d-----w- c:\program files\Electronic Arts
2010-02-28 15:32 . 2010-02-28 15:07 -------- d-----w- c:\program files\Zaklínač - Rozšířená edice
2010-02-28 14:12 . 2010-01-27 15:27 -------- d-----w- c:\program files\ICQ7.0
2010-02-28 12:01 . 2009-09-03 16:03 -------- d-----w- c:\program files\Opera
2010-02-26 21:03 . 2009-09-03 15:01 -------- d-----w- c:\program files\MSN Messenger
2010-02-24 08:16 . 2009-10-03 13:19 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-22 14:28 . 2009-09-06 16:33 54846 ----a-w- c:\windows\system32\perfh01B.dat
2010-02-22 14:28 . 2009-09-06 16:33 14630 ----a-w- c:\windows\system32\perfc01B.dat
2010-02-22 14:28 . 2009-03-30 12:59 598674 ----a-w- c:\windows\system32\perfh005.dat
2010-02-22 14:28 . 2009-03-30 12:59 118290 ----a-w- c:\windows\system32\perfc005.dat
2010-02-14 19:21 . 2009-09-03 16:11 -------- d-----w- c:\program files\CCleaner
2010-02-14 13:12 . 2009-03-30 05:20 6644 ----a-w- c:\windows\system32\ezdigsgn.dat
2010-02-12 20:26 . 2009-03-30 05:03 -------- d-----w- c:\programdata\CyberLink
2010-02-09 22:28 . 2009-09-03 15:03 -------- d-----w- c:\program files\Microsoft Works
2010-02-09 22:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-04 16:39 . 2010-02-04 16:39 -------- d-----w- c:\programdata\Downloaded Installations
2010-02-01 10:36 . 2010-02-01 10:36 -------- d-----w- c:\program files\Managed DirectX (0901)
2010-01-31 21:58 . 2009-09-17 18:11 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-31 21:57 . 2009-09-18 13:08 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-01-30 17:15 . 2009-03-30 04:16 -------- d-----w- c:\programdata\Hewlett-Packard
2010-01-29 14:37 . 2010-01-29 14:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-28 18:35 . 2009-09-03 15:02 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-28 15:23 . 2009-09-04 13:34 -------- d-----w- c:\programdata\ESTsoft
2010-01-28 15:12 . 2010-01-28 15:11 -------- d-----w- c:\programdata\WinZip
2010-01-27 15:28 . 2009-10-19 17:01 -------- d-----w- c:\programdata\ICQ
2010-01-26 17:19 . 2010-01-26 17:19 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
2010-01-24 11:30 . 2009-03-30 04:16 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-22 14:12 . 2009-12-29 15:16 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-21 13:53 . 2010-01-21 13:53 18048 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2010-01-14 23:08 . 2010-01-14 22:46 59664 ----a-w- c:\windows\system32\drivers\TfSysMon.sys
2010-01-14 23:08 . 2010-01-14 22:46 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys
2010-01-14 23:08 . 2010-01-14 22:45 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys
2010-01-08 23:05 . 2010-01-08 23:05 -------- d-----w- c:\programdata\Malwarebytes
2010-01-07 15:07 . 2010-01-29 14:37 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-29 14:37 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 06:38 . 2010-01-29 17:13 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-29 17:13 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-01-29 17:13 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-01-29 17:13 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-30 10:30 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-12-30 10:30 . 2009-12-30 10:30 660480 ----a-w- c:\windows\system32\nmwcdcocls.dll
2009-12-30 10:30 . 2009-12-30 10:30 7936 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2009-12-30 10:30 . 2009-12-30 10:30 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2009-12-30 10:30 . 2009-09-03 15:42 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-12-16 17:11 . 2009-12-16 17:11 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-12-16 15:53 . 2009-12-16 15:53 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-16 15:53 . 2009-12-16 15:53 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2009-03-30 13:15 . 2009-03-30 13:03 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2008-12-10 842816]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-10-10 206128]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-01-23 484408]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-02 835584]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-01-08 915000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer for HP TouchSmart]
2008-12-25 11:41 189736 ------w- c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDAgent]
2008-11-28 16:04 1148200 ------w- c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-10-09 06:58 75008 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 13:34 54576 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-02-14 13:43 133368 ----a-w- c:\program files\ICQ7.0\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 08:16 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-01-07 15:07 429392 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-07-23 14:39 13797920 ----a-w- c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartMenu]
2009-01-08 12:00 915000 ----a-w- c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSMAgent]
2008-12-25 11:41 1316136 ------w- c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2008-11-14 20:02 218408 ------w- c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2008-06-13 16:11 210216 ------w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2008-12-03 20:15 218408 ------w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDIRShortCut]
2008-12-03 20:15 218408 ------w- c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-01-12 21:54 210216 ------w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"VistaSp2"=hex(b):16,21,0b,cb,0f,2f,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1830891854-264945127-3529894935-1000]
"EnableNotificationsRef"=dword:00000002
"EnableNotifications"=dword:00000001

R3 ATSpy;ATSpy;c:\windows\system32\ATSpy.sys [2010-02-26 17920]
R3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\DRIVERS\gan_adapter.sys [2006-08-28 10664]
R3 LarkScan;LarkScan;c:\program files\Lark Anti-Spyware\LarkScan.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-31 691696]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2007-04-04 20760]
S2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2010-03-07 1858144]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f85b771c\aestsrv.exe [2008-11-17 81920]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-01-07 236368]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-12-23 365952]
S2 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2008-11-26 296320]
S2 TVSched;TV Task Scheduler (TVTS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2008-11-26 116096]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-01-22 1045808]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-12-04 222512]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-12-30 57856]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-01-07 19160]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-09-24 45600]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-02-27 c:\windows\Tasks\HPCeeScheduleForDávid.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-03-30 09:34]

2010-01-06 c:\windows\Tasks\User_Feed_Synchronization-{6864FB7A-FCE4-4EF2-8CB5-3D09240F67A2}.job
- c:\windows\system32\msfeedssync.exe [2010-01-29 04:56]

2010-03-07 c:\windows\Tasks\User_Feed_Synchronization-{80FEAF31-1710-46C9-BBD2-8C198E3A7BA1}.job
- c:\windows\system32\msfeedssync.exe [2010-01-29 04:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 01:04
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys hal.dll >>UNKNOWN [0x863321F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8b04ad24
\Driver\ACPI -> acpi.sys @ 0x807b9d68
\Driver\atapi -> 0x863321f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,27,0d,ec,c0,9f,af,1a,4a,9c,fe,0f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,27,0d,ec,c0,9f,af,1a,4a,9c,fe,0f,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,27,0d,ec,c0,9f,af,1a,4a,9c,fe,0f,\

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.URL"

[HKEY_USERS\S-1-5-21-1830891854-264945127-3529894935-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:18,8f,33,ee,24,30,5d,9c,c6,7d,84,42,b4,2c,22,26,43,45,6c,1a,3f,a1,55,
8a,64,f3,a7,e5,92,4e,f5,8b,6a,d7,55,64,9a,ae,ce,c1,61,b1,01,b7,8e,9e,09,9f,\
"??"=hex:ac,2c,66,f5,3e,71,e0,ed,6f,de,e1,54,35,d9,42,77

[HKEY_USERS\S-1-5-21-1830891854-264945127-3529894935-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:49,8b,d4,d2,13,7d,2e,f3,18,0d,3d,e7,9b,7e,20,d6,de,3e,67,14,47,
9c,0c,70,51,00,51,d3,20,6e,81,8e,ee,99,92,56,bf,32,30,28,bd,c9,d0,b5,25,62,\
"rkeysecu"=hex:38,2b,81,61,ca,60,5a,a9,b9,80,70,42,99,20,16,05

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(720)
c:\windows\system32\DPPWDFLT.dll

- - - - - - - > 'Explorer.exe'(4244)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
c:\program files\DigitalPersona\Bin\DpoSet.dll
c:\program files\Nokia\Nokia Photos\mvBurnerDll\mcspmpeg.ax
c:\program files\Nokia\Nokia Photos\mvBurnerDll\mcmpegin.dll
c:\program files\Nokia\Nokia Photos\mvBurnerDll\mcdsmpeg.ax
c:\program files\Nokia\Nokia Photos\mvBurnerDll\mcmpgdec.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f85b771c\STacSV.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\hpqToaster.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\MsiExec.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\MsiExec.exe
c:\windows\system32\MsiExec.exe
.
**************************************************************************
.
Completion time: 2010-03-08 01:15:34 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-08 00:15

Pre-Run: 134 392 516 608 bytes free
Post-Run: 134 024 695 808 bytes free

- - End Of File - - 61F1E2DC19CAADEE529A91B038C93090

[Rudy]

Rootkit byl smazán. Ještě prověřte MBR: http://www2.gmer.net/mbr/mbr.exe a dejte log.