Prosím o kontrolulogu, děkuji...

Zpráva

Rostoff · #1 Příspěvek od **Rostoff** » 10 bře 2010 19:40

Zdravím,

poprosil bych o kontrolu logu mých Win Vista, systém už mám dva roky bez údržby, takže počítám, že jsem za tu dobu nějakou havěť nachytal...

Logfile of random's system information tool 1.06 (written by random/random)
Run by Rostoff at 2010-03-10 19:22:12
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 25 GB (13%) free of 182 GB
Total RAM: 2038 MB (40% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:31, on 10.3.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Altap Salamander 2.5\salamand.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\SoftwareDistribution\Download\Install\wlsetup-web.exe
C:\Users\Rostoff\Desktop\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\trend micro\Rostoff.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3ACA7294-B470-4120-A378-818D4EAFC07C} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\SideBar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Altap Salamander 2.51.lnk = C:\Program Files\Altap Salamander 2.5\salamand.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NSUService - Sony Corporation - C:\Program Files\Sony\Network Utility\NSUService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8567 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{3D464134-FFD4-4416-8BC1-B50EC09BA5BD}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ACA7294-B470-4120-A378-818D4EAFC07C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-18 1008184]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2007-06-10 118784]
"ISBMgr.exe"=C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2007-06-12 317560]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-07-03 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-07-03 154136]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-06-26 137752]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-07-01 1447168]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-06-26 4489216]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\SideBar.exe [2009-04-11 1233920]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
C:\Program Files\Sony\Network Utility\LANUtil.exe [2008-11-05 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2007-06-26 4489216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-05-15 1830128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
oobefldr.dll,ShowWelcomeCenter []

C:\Users\Rostoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Altap Salamander 2.51.lnk - C:\Program Files\Altap Salamander 2.5\salamand.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-03-29 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-06-26 200704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
C:\Windows\system32\VESWinlogon.dll [2007-07-25 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\Windows\system32\rqRKCvUk

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-10 19:22:12 ----D---- C:\rsit
2010-03-10 19:22:12 ----D---- C:\Program Files\trend micro
2010-03-10 17:08:30 ----D---- C:\Program Files\Microsoft
2010-03-08 21:24:22 ----A---- C:\Windows\system32\mshtml.dll
2010-03-08 21:24:19 ----A---- C:\Windows\system32\ieframe.dll
2010-03-08 21:24:16 ----A---- C:\Windows\system32\iertutil.dll
2010-03-08 21:24:15 ----A---- C:\Windows\system32\urlmon.dll
2010-03-08 21:24:14 ----A---- C:\Windows\system32\wininet.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\occache.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\msfeeds.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\iedkcs32.dll
2010-03-08 21:24:10 ----A---- C:\Windows\system32\ieUnatt.exe
2010-03-08 21:24:10 ----A---- C:\Windows\system32\ieui.dll
2010-03-08 21:24:10 ----A---- C:\Windows\system32\iepeers.dll
2010-03-08 21:24:09 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-03-08 21:24:09 ----A---- C:\Windows\system32\iesysprep.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\msfeedssync.exe
2010-03-08 21:24:08 ----A---- C:\Windows\system32\jsproxy.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\iesetup.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\ie4uinit.exe
2010-03-08 21:24:07 ----A---- C:\Windows\system32\iernonce.dll
2010-03-08 21:24:03 ----A---- C:\Windows\system32\jscript.dll
2010-03-07 15:54:32 ----D---- C:\Update
2010-03-07 14:34:38 ----A---- C:\Windows\system32\mshtmled.dll
2010-03-07 14:34:38 ----A---- C:\Windows\system32\icardie.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\msls31.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\mshtmler.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\corpol.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\admparse.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\licmgr10.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\imgutil.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\ieakeng.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\dxtrans.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\dxtmsft.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\WinFXDocObj.exe
2010-03-07 14:34:35 ----A---- C:\Windows\system32\wextract.exe
2010-03-07 14:34:35 ----A---- C:\Windows\system32\webcheck.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\msrating.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\inseng.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\ieakui.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\ieaksie.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\pngfilt.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\mstime.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\ieapfltr.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\advpack.dll
2010-03-07 14:34:33 ----A---- C:\Windows\system32\vbscript.dll
2010-03-07 14:34:33 ----A---- C:\Windows\system32\url.dll
2010-03-07 14:34:31 ----A---- C:\Windows\system32\mshta.exe
2010-03-07 14:34:31 ----A---- C:\Windows\system32\iexpress.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\SetDepNx.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\PDMSetup.exe
2010-03-07 14:32:12 ----A---- C:\Windows\system32\browserchoice.exe
2010-03-07 14:26:18 ----D---- C:\!
2010-02-24 22:13:39 ----A---- C:\Windows\system32\tzres.dll
2010-02-24 22:12:42 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-24 22:12:41 ----A---- C:\Windows\system32\secproc.dll
2010-02-24 22:12:20 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-24 22:12:17 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-24 22:12:17 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-24 22:12:16 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-24 22:12:14 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-24 22:12:14 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-24 22:12:13 ----A---- C:\Windows\system32\msdrm.dll
2010-02-24 22:12:06 ----A---- C:\Windows\system32\gameux.dll
2010-02-24 22:12:03 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-02-24 22:12:03 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-02-16 21:29:08 ----D---- C:\ProgramData\Zylom

======List of files/folders modified in the last 1 months======

2010-03-10 19:22:31 ----D---- C:\Windows\Temp
2010-03-10 19:22:31 ----D---- C:\Windows\Prefetch
2010-03-10 19:22:12 ----RD---- C:\Program Files
2010-03-10 17:14:32 ----SHD---- C:\Windows\Installer
2010-03-10 17:14:24 ----D---- C:\ProgramData\Microsoft Help
2010-03-10 17:13:34 ----D---- C:\Windows\winsxs
2010-03-10 17:08:39 ----D---- C:\Program Files\Common Files\microsoft shared
2010-03-10 17:08:22 ----D---- C:\Windows\System32
2010-03-10 17:07:50 ----D---- C:\Windows\system32\catroot
2010-03-10 17:07:47 ----D---- C:\Windows\system32\catroot2
2010-03-10 17:04:33 ----SHD---- C:\System Volume Information
2010-03-09 00:02:34 ----D---- C:\Windows\system32\migration
2010-03-09 00:02:32 ----D---- C:\Program Files\Internet Explorer
2010-03-08 22:43:46 ----D---- C:\Users\Rostoff\AppData\Roaming\Skype
2010-03-08 22:04:25 ----D---- C:\Users\Rostoff\AppData\Roaming\skypePM
2010-03-07 16:16:52 ----D---- C:\Temp
2010-03-07 16:01:56 ----D---- C:\Program Files\Common Files\Sony Shared
2010-03-07 16:00:09 ----D---- C:\Program Files\Sony
2010-03-07 15:59:59 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-07 15:26:50 ----D---- C:\Windows\rescache
2010-03-07 15:20:38 ----D---- C:\ProgramData\Sony Corporation
2010-03-07 14:49:13 ----D---- C:\Windows\system32\cs-CZ
2010-03-07 14:48:55 ----D---- C:\Windows\PolicyDefinitions
2010-03-07 14:48:54 ----D---- C:\Windows\system32\en-US
2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe
2010-02-24 22:23:31 ----D---- C:\Windows\AppPatch
2010-02-24 22:23:28 ----RSD---- C:\Windows\Fonts
2010-02-24 09:16:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-21 19:51:16 ----A---- C:\Windows\NeroDigital.ini
2010-02-21 19:47:56 ----D---- C:\Windows\inf
2010-02-21 19:47:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-21 19:47:30 ----D---- C:\Program Files\MP Classic
2010-02-16 21:29:08 ----AHD---- C:\ProgramData
2010-02-13 17:41:08 ----AD---- C:\ProgramData\TEMP
2010-02-11 00:16:19 ----D---- C:\Windows\system32\drivers
2010-02-11 00:16:13 ----D---- C:\Program Files\Windows Mail

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DMICall;Sony DMI Call service; C:\Windows\system32\DRIVERS\DMICall.sys [2007-06-28 10216]
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2008-07-01 54280]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-29 9968]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2008-05-28 55024]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2008-07-01 71688]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-05-08 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-08 8192]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-10 140800]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-18 14208]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2008-07-01 30728]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-05-08 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-05-08 207360]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-06-26 1776128]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-06-26 1787816]
R3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-18 2251776]
R3 SNC;Sony Firmware Extension Parser Device; C:\Windows\System32\Drivers\SonyNC.sys [2006-11-06 27520]
R3 ti21sony;ti21sony; C:\Windows\system32\drivers\ti21sony.sys [2007-06-06 812544]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-05-08 659968]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-07-25 246784]
S3 at2eut00;at2eut00; C:\Windows\system32\drivers\at2eut00.sys []
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-06-15 705024]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-18 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 mbr;mbr; \??\C:\Users\Rostoff\AppData\Local\Temp\mbr.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-18 2225664]
S3 NPF;Netgroup Packet Filter; C:\Windows\system32\drivers\npf.sys [2008-09-28 42512]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2008-05-28 7408]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2007-02-14 128104]
S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\winusb.sys [2009-04-11 31616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 NSUService;NSUService; C:\Program Files\Sony\Network Utility\NSUService.exe [2008-11-03 299008]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 VAIO Event Service;VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [2007-07-25 182392]
R2 VCFw;VAIO Content Folder Watcher; C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-03-05 5189992]
R2 VzCdbSvc;VAIO Entertainment Database Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [2009-03-05 192512]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-05-08 386560]
R3 Vcsw;VAIO Entertainment UPnP Client Adapter; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [2009-03-05 313264]
R3 VUAgent;VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-07-01 19200]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-18 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-12-14 69632]
S3 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [2009-03-05 69632]
S3 VAIOMediaPlatform-IntegratedServer-AppServer;VAIO Media Integrated Server; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2007-06-20 2523136]
S3 VAIOMediaPlatform-IntegratedServer-HTTP;VAIO Media Integrated Server (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-IntegratedServer-UPnP;VAIO Media Integrated Server (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VAIOMediaPlatform-Mobile-Gateway;VAIO Media Gateway Server; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [2007-06-20 499712]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-11 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface; C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
S4 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-10 138168]
S4 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-12-14 57344]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 10 bře 2010 19:41

Zdravím

Na logu se pracuje, prosím o strpení.

#3 Příspěvek od **Caroprd111** » 10 bře 2010 19:45

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Obrázek

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Obrázek

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrází stránka s licenčnímy podmínkami, pokračujte stisknutím tlačítka "Ano"

Obrázek

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Obrázek

Během skenování může být počítač restartován.

Rostoff · #4 Příspěvek od **Rostoff** » 17 bře 2010 19:46

Zdravím.. omlouvám se, že reakce na sebe dala tak dlouho čekat, ale notebook byl bohužel v opravě

-------------------------------
ComboFix 10-03-16.05 - Rostoff 17.03.2010 19:00:12.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2038.1171 [GMT 1:00]
Spuštěný z: c:\users\Rostoff\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
SP: ESET Smart Security 3.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Norton 360 *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1177748209-1185544555-1007914565-500
c:\$recycle.bin\S-1-5-21-2122735422-1125903641-2288678591-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\users\Rostoff\AppData\Roaming\.#
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-17 do 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-17 18:07 . 2010-03-17 18:40 -------- d-----w- c:\users\Rostoff\AppData\Local\temp
2010-03-17 18:07 . 2010-03-17 18:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-10 18:22 . 2010-03-10 18:22 -------- d-----w- C:\rsit
2010-03-10 18:22 . 2010-03-10 18:22 -------- d-----w- c:\program files\trend micro
2010-03-10 16:08 . 2010-03-10 16:08 -------- d-----w- c:\program files\Microsoft
2010-03-10 16:06 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 16:06 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-10 16:06 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-07 13:32 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-03-07 13:26 . 2010-03-07 14:05 -------- d-----w- C:\!
2010-02-24 21:13 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 21:12 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-24 21:12 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-24 21:12 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-24 21:12 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-24 21:12 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-24 21:12 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-24 21:12 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-24 21:12 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-24 21:12 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-24 21:12 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-24 21:12 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-24 21:12 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-02-16 20:29 . 2010-02-16 20:29 -------- d-----w- c:\programdata\Zylom

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-17 18:08 . 2009-01-14 21:36 12 ----a-w- c:\windows\bthservsdp.dat
2010-03-17 17:32 . 2007-08-09 19:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-17 17:14 . 2008-07-10 23:57 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-03-17 17:08 . 2008-05-17 11:33 -------- d-----w- c:\program files\Azureus
2010-03-11 20:19 . 2008-03-05 23:15 -------- d-----w- c:\users\Rostoff\AppData\Roaming\Skype
2010-03-11 20:18 . 2008-05-16 23:23 -------- d-----w- c:\users\Rostoff\AppData\Roaming\skypePM
2010-03-10 19:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-03-10 16:14 . 2007-08-09 22:40 -------- d-----w- c:\programdata\Microsoft Help
2010-03-07 15:01 . 2007-08-09 22:32 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-03-07 15:00 . 2007-08-09 23:11 -------- d-----w- c:\program files\Sony
2010-03-07 14:20 . 2007-08-09 23:19 -------- d-----w- c:\programdata\Sony Corporation
2010-02-25 18:50 . 2008-02-25 20:25 109432 ----a-w- c:\users\Rostoff\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-24 08:16 . 2009-10-02 19:02 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-21 18:47 . 2007-08-09 22:51 602092 ----a-w- c:\windows\system32\perfh005.dat
2010-02-21 18:47 . 2007-08-09 22:51 116204 ----a-w- c:\windows\system32\perfc005.dat
2010-02-21 18:47 . 2008-03-05 21:53 -------- d-----w- c:\program files\MP Classic
2010-01-24 13:40 . 2010-01-24 13:25 -------- d-----w- c:\users\Rostoff\AppData\Roaming\DAEMON Tools Lite
2010-01-24 13:26 . 2010-01-24 13:25 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-01-24 13:26 . 2010-01-24 13:26 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-24 13:25 . 2010-01-24 13:25 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-01-23 13:14 . 2008-03-02 16:08 -------- d---a-w- c:\program files\Altap Salamander 2.5
2010-01-21 08:28 . 2008-02-27 22:54 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-06 15:38 . 2010-02-24 21:12 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-01-06 15:38 . 2010-02-24 21:12 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-01-06 15:38 . 2010-02-24 21:12 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-01-06 15:38 . 2010-02-24 21:12 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-01-06 11:08 . 2010-01-09 19:23 4726272 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\cooliris190.dll
2010-01-06 11:08 . 2010-01-09 19:23 103424 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2010-01-06 11:08 . 2010-01-09 19:23 57856 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2010-01-06 11:08 . 2010-01-09 19:23 545280 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2010-01-06 11:08 . 2010-01-09 19:23 4725760 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\cooliris192.dll
2010-01-06 11:08 . 2010-01-09 19:23 344064 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2010-01-06 11:08 . 2010-01-09 19:23 153600 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2010-01-02 06:38 . 2010-03-08 20:24 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-03-08 20:24 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-03-08 20:24 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-03-08 20:24 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\SideBar.exe" [2009-04-11 1233920]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-12 317560]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-03 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-03 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-26 137752]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-26 4489216]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-01 215552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

c:\users\Rostoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Altap Salamander 2.51.lnk - c:\program files\Altap Salamander 2.5\salamand.exe [2010-1-23 1697288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-07-25 02:26 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
2008-11-05 07:32 262144 ----a-w- c:\program files\Sony\Network Utility\LANUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-06-26 00:39 4489216 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-09 04:19 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:28 2153472 ----a-w- c:\windows\System32\oobefldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):95,7d,69,50,d6,fb,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1900278830-1809400025-4039645355-1000]
"EnableNotificationsRef"=dword:00000001

R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-24 691696]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2008-11-03 299008]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-03-05 5189992]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-06-06 812544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-03-17 c:\windows\Tasks\User_Feed_Synchronization-{3D464134-FFD4-4416-8BC1-B50EC09BA5BD}.job
- c:\windows\system32\msfeedssync.exe [2010-03-08 04:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.club-vaio.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\
FF - component: c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{3ACA7294-B470-4120-A378-818D4EAFC07C} - (no file)
MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1900278830-1809400025-4039645355-1000\Software\SecuROM\License information*]
"datasecu"=hex:71,55,91,92,fc,0a,7c,92,0c,2a,c2,a9,48,59,42,c7,e5,04,6b,2b,bb,
fc,60,7c,03,fb,09,73,99,84,39,ff,56,5d,12,0c,b0,0f,cc,42,7a,5e,66,f1,7e,35,\
"rkeysecu"=hex:c4,d8,a5,0e,98,1b,e0,98,8d,c5,8a,e4,08,75,55,2f

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b4
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3576)
c:\program files\Altap Salamander 2.5\plugins\salamext.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\igfxext.exe
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
c:\windows\system32\conime.exe
c:\program files\Sony\VAIO Update 5\VAIOUpdt.exe
c:\program files\Apoint\ApMsgFwd.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Apoint\Apntex.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2010-03-17 19:43:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-17 18:43

Před spuštěním: Volných bajtů: 25 886 965 760
Po spuštění: Volných bajtů: 25 547 665 408

- - End Of File - - 16D6E36FADD906C31D0886AD761FEF45

#5 Příspěvek od **Caroprd111** » 17 bře 2010 19:51

Norton 360 již nepoužíváte

Rostoff · #6 Příspěvek od **Rostoff** » 24 bře 2010 14:15

Byl kdysi nainstalován od výrobce notebooku, nikdy nepoužíván a hned odinstalován

Nicméně po něm evidentně nějaký bordel zbyl, všiml jsem si toho díky ComboFixu, který mi tvrdil, že rezidentně běží. Ve službách jsem ho sice nenašel, ale v registrech byl zakouslej dost, tak jsem je trochu pročistil.

Jinak používám ESET NOD32, trojkovou verzi.

#7 Příspěvek od **Caroprd111** » 24 bře 2010 14:21

Pokud nemáte, přesuňte Combofix na plochu

Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

SecCenter:: 
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
SP: Norton 360 *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}

RegLock::
[HKEY_USERS\S-1-5-21-1900278830-1809400025-4039645355-1000\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Rostoff · #8 Příspěvek od **Rostoff** » 25 bře 2010 14:34

Provedeno. Jen dvě věci: CF opět hlásil, že běží rezidentně Norton 360

Tak to už opravdu nevím, odkud ho mám vykopnout

Také mi CF oznámil, že už skončila zkušební doba a že jeho funkčnost je omezena. Nemám tedy toto provést znovu s novým CF?

---------------------------------
ComboFix 10-03-16.05 - Rostoff 25.03.2010 14:21:02.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2038.1288 [GMT 1:00]
Spuštěný z: c:\users\Rostoff\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Rostoff\Desktop\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *enabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-25 do 2010-03-25 )))))))))))))))))))))))))))))))
.

2010-03-25 13:22 . 2010-03-25 13:23 -------- d-----w- c:\users\Rostoff\AppData\Local\temp
2010-03-25 13:22 . 2010-03-25 13:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-25 13:22 . 2010-03-25 13:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-10 18:22 . 2010-03-10 18:22 -------- d-----w- C:\rsit
2010-03-10 18:22 . 2010-03-10 18:22 -------- d-----w- c:\program files\trend micro
2010-03-10 16:08 . 2010-03-10 16:08 -------- d-----w- c:\program files\Microsoft
2010-03-10 16:06 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 16:06 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-10 16:06 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-07 13:32 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-03-07 13:26 . 2010-03-07 14:05 -------- d-----w- C:\!
2010-02-24 21:13 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 21:12 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-24 21:12 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-02-24 21:12 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-24 21:12 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-24 21:12 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-02-24 21:12 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-24 21:12 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-24 21:12 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-24 21:12 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-02-24 21:12 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-02-24 21:12 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-02-24 21:12 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-25 13:07 . 2009-01-14 21:36 12 ----a-w- c:\windows\bthservsdp.dat
2010-03-20 15:55 . 2007-08-09 22:51 602092 ----a-w- c:\windows\system32\perfh005.dat
2010-03-20 15:55 . 2007-08-09 22:51 116204 ----a-w- c:\windows\system32\perfc005.dat
2010-03-20 10:42 . 2008-03-05 23:15 -------- d-----w- c:\users\Rostoff\AppData\Roaming\Skype
2010-03-20 09:38 . 2008-05-16 23:23 -------- d-----w- c:\users\Rostoff\AppData\Roaming\skypePM
2010-03-17 17:32 . 2007-08-09 19:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-17 17:14 . 2008-07-10 23:57 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-03-17 17:08 . 2008-05-17 11:33 -------- d-----w- c:\program files\Azureus
2010-03-10 19:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-03-10 16:14 . 2007-08-09 22:40 -------- d-----w- c:\programdata\Microsoft Help
2010-03-07 15:01 . 2007-08-09 22:32 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-03-07 15:00 . 2007-08-09 23:11 -------- d-----w- c:\program files\Sony
2010-03-07 14:20 . 2007-08-09 23:19 -------- d-----w- c:\programdata\Sony Corporation
2010-02-25 18:50 . 2008-02-25 20:25 109432 ----a-w- c:\users\Rostoff\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-24 09:16 . 2009-10-02 19:02 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-21 18:47 . 2008-03-05 21:53 -------- d-----w- c:\program files\MP Classic
2010-02-16 20:29 . 2010-02-16 20:29 -------- d-----w- c:\programdata\Zylom
2010-01-24 13:40 . 2010-01-24 13:25 -------- d-----w- c:\users\Rostoff\AppData\Roaming\DAEMON Tools Lite
2010-01-24 13:26 . 2010-01-24 13:25 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-01-24 13:26 . 2010-01-24 13:26 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-06 15:38 . 2010-02-24 21:12 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-01-06 15:38 . 2010-02-24 21:12 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll
2010-01-06 15:38 . 2010-02-24 21:12 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll
2010-01-06 15:38 . 2010-02-24 21:12 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-01-06 11:08 . 2010-01-09 19:23 4726272 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\cooliris190.dll
2010-01-06 11:08 . 2010-01-09 19:23 103424 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2010-01-06 11:08 . 2010-01-09 19:23 57856 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2010-01-06 11:08 . 2010-01-09 19:23 545280 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2010-01-06 11:08 . 2010-01-09 19:23 4725760 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\cooliris192.dll
2010-01-06 11:08 . 2010-01-09 19:23 344064 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2010-01-06 11:08 . 2010-01-09 19:23 153600 ----a-w- c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2010-01-02 06:38 . 2010-03-08 20:24 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-03-08 20:24 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-03-08 20:24 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-03-08 20:24 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\SideBar.exe" [2009-04-11 1233920]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Google Update"="c:\users\Rostoff\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-03-18 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-12 317560]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-03 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-03 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-26 137752]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-26 4489216]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-01 215552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

c:\users\Rostoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Altap Salamander 2.51.lnk - c:\program files\Altap Salamander 2.5\salamand.exe [2010-1-23 1697288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-07-25 02:26 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
2008-11-05 07:32 262144 ----a-w- c:\program files\Sony\Network Utility\LANUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-06-26 00:39 4489216 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-09 04:19 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:28 2153472 ----a-w- c:\windows\System32\oobefldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):95,7d,69,50,d6,fb,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1900278830-1809400025-4039645355-1000]
"EnableNotificationsRef"=dword:00000001

R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-01-24 691696]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2008-11-03 299008]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-03-05 5189992]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-06-06 812544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-03-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1900278830-1809400025-4039645355-1000Core.job
- c:\users\Rostoff\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 20:11]

2010-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1900278830-1809400025-4039645355-1000UA.job
- c:\users\Rostoff\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 20:11]

2010-03-25 c:\windows\Tasks\User_Feed_Synchronization-{3D464134-FFD4-4416-8BC1-B50EC09BA5BD}.job
- c:\windows\system32\msfeedssync.exe [2010-03-08 04:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.club-vaio.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\
FF - component: c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\users\Rostoff\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\Rostoff\AppData\Roaming\Mozilla\Firefox\Profiles\o98sv895.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-25 14:23
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1900278830-1809400025-4039645355-1000\Software\SecuROM\License information*]
"datasecu"=hex:71,55,91,92,fc,0a,7c,92,0c,2a,c2,a9,48,59,42,c7,e5,04,6b,2b,bb,
fc,60,7c,03,fb,09,73,99,84,39,ff,56,5d,12,0c,b0,0f,cc,42,7a,5e,66,f1,7e,35,\
"rkeysecu"=hex:c4,d8,a5,0e,98,1b,e0,98,8d,c5,8a,e4,08,75,55,2f
.
Celkový čas: 2010-03-25 14:29:02
ComboFix-quarantined-files.txt 2010-03-25 13:29
ComboFix2.txt 2010-03-17 18:43

Před spuštěním: Volných bajtů: 25 189 535 744
Po spuštění: Volných bajtů: 25 007 640 576

- - End Of File - - B3F460EB26F2D88018A4648F3509FFB2

#9 Příspěvek od **Caroprd111** » 25 bře 2010 14:38

Už by to mělo být v pořádku. Jak to vypadá s PC

Rostoff · #10 Příspěvek od **Rostoff** » 25 bře 2010 14:57

Až na to, že je tam pořád někde zakutěnej ten Norton 360, tak to vypadá v pohodě. Neporadíte, jak se ho zbavit. V nainstalovaných programech není, ve službách jsem ho nenašel (netvrdím, že tam někde není) a v registrech jsem byť jen zmínku o Nortonu nebo Symantecu vymazal.. tak nevím.

Rozhodopádně ale dík za pomoc.

#11 Příspěvek od **Caroprd111** » 25 bře 2010 14:59

Já jsem Nortona mazal skriptem do ComboFixu, mělo by to být v pořádku. Dejte nový log z RSIT.

Rostoff · #12 Příspěvek od **Rostoff** » 25 bře 2010 15:39

Aha, máte pravdu, teď už ho CF nehlásí. Ale pro jistotu ten log..
-------------------------------------

Logfile of random's system information tool 1.06 (written by random/random)
Run by Rostoff at 2010-03-25 15:37:52
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 25 GB (14%) free of 182 GB
Total RAM: 2038 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:00, on 25.3.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Program Files\Altap Salamander 2.5\salamand.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Taskmgr.exe
C:\Users\Rostoff\Desktop\RSIT.exe
C:\Program Files\trend micro\Rostoff.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\SideBar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Rostoff\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Altap Salamander 2.51.lnk = C:\Program Files\Altap Salamander 2.5\salamand.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NSUService - Sony Corporation - C:\Program Files\Sony\Network Utility\NSUService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7378 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1900278830-1809400025-4039645355-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1900278830-1809400025-4039645355-1000UA.job
C:\Windows\tasks\User_Feed_Synchronization-{3D464134-FFD4-4416-8BC1-B50EC09BA5BD}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-18 1008184]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2007-06-10 118784]
"ISBMgr.exe"=C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2007-06-12 317560]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2007-07-03 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2007-07-03 154136]
"Persistence"=C:\Windows\system32\igfxpers.exe [2007-06-26 137752]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-07-01 1447168]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-06-26 4489216]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\SideBar.exe [2009-04-11 1233920]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"Google Update"=C:\Users\Rostoff\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
C:\Program Files\Sony\Network Utility\LANUtil.exe [2008-11-05 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2007-06-26 4489216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
oobefldr.dll,ShowWelcomeCenter []

C:\Users\Rostoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Altap Salamander 2.51.lnk - C:\Program Files\Altap Salamander 2.5\salamand.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2007-06-26 200704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
C:\Windows\system32\VESWinlogon.dll [2007-07-25 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2010-03-25 14:29:08 ----SHD---- C:\$RECYCLE.BIN
2010-03-25 14:29:04 ----D---- C:\Windows\temp
2010-03-25 14:29:03 ----A---- C:\ComboFix.txt
2010-03-25 13:42:05 ----A---- C:\Windows\SWXCACLS.exe
2010-03-17 18:57:40 ----A---- C:\Windows\NIRCMD.exe
2010-03-17 18:57:38 ----A---- C:\Windows\PEV.exe
2010-03-17 18:57:37 ----A---- C:\Windows\zip.exe
2010-03-17 18:57:37 ----A---- C:\Windows\SWREG.exe
2010-03-17 18:57:36 ----A---- C:\Windows\SWSC.exe
2010-03-17 18:57:36 ----A---- C:\Windows\sed.exe
2010-03-17 18:57:36 ----A---- C:\Windows\grep.exe
2010-03-17 18:57:28 ----D---- C:\Windows\ERDNT
2010-03-17 18:04:19 ----D---- C:\Qoobox
2010-03-10 19:22:12 ----D---- C:\rsit
2010-03-10 19:22:12 ----D---- C:\Program Files\trend micro
2010-03-10 17:08:30 ----D---- C:\Program Files\Microsoft
2010-03-10 17:06:16 ----A---- C:\Windows\system32\nshhttp.dll
2010-03-10 17:06:06 ----A---- C:\Windows\system32\httpapi.dll
2010-03-08 21:24:22 ----A---- C:\Windows\system32\mshtml.dll
2010-03-08 21:24:19 ----A---- C:\Windows\system32\ieframe.dll
2010-03-08 21:24:16 ----A---- C:\Windows\system32\iertutil.dll
2010-03-08 21:24:15 ----A---- C:\Windows\system32\urlmon.dll
2010-03-08 21:24:14 ----A---- C:\Windows\system32\wininet.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\occache.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\msfeeds.dll
2010-03-08 21:24:13 ----A---- C:\Windows\system32\iedkcs32.dll
2010-03-08 21:24:10 ----A---- C:\Windows\system32\ieUnatt.exe
2010-03-08 21:24:10 ----A---- C:\Windows\system32\ieui.dll
2010-03-08 21:24:10 ----A---- C:\Windows\system32\iepeers.dll
2010-03-08 21:24:09 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-03-08 21:24:09 ----A---- C:\Windows\system32\iesysprep.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\msfeedssync.exe
2010-03-08 21:24:08 ----A---- C:\Windows\system32\jsproxy.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\iesetup.dll
2010-03-08 21:24:08 ----A---- C:\Windows\system32\ie4uinit.exe
2010-03-08 21:24:07 ----A---- C:\Windows\system32\iernonce.dll
2010-03-08 21:24:03 ----A---- C:\Windows\system32\jscript.dll
2010-03-07 14:34:38 ----A---- C:\Windows\system32\mshtmled.dll
2010-03-07 14:34:38 ----A---- C:\Windows\system32\icardie.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\msls31.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\mshtmler.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\corpol.dll
2010-03-07 14:34:37 ----A---- C:\Windows\system32\admparse.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\licmgr10.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\imgutil.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\ieakeng.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\dxtrans.dll
2010-03-07 14:34:36 ----A---- C:\Windows\system32\dxtmsft.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\WinFXDocObj.exe
2010-03-07 14:34:35 ----A---- C:\Windows\system32\wextract.exe
2010-03-07 14:34:35 ----A---- C:\Windows\system32\webcheck.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\msrating.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\inseng.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\ieakui.dll
2010-03-07 14:34:35 ----A---- C:\Windows\system32\ieaksie.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\pngfilt.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\mstime.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\ieapfltr.dll
2010-03-07 14:34:34 ----A---- C:\Windows\system32\advpack.dll
2010-03-07 14:34:33 ----A---- C:\Windows\system32\vbscript.dll
2010-03-07 14:34:33 ----A---- C:\Windows\system32\url.dll
2010-03-07 14:34:31 ----A---- C:\Windows\system32\mshta.exe
2010-03-07 14:34:31 ----A---- C:\Windows\system32\iexpress.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\SetDepNx.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2010-03-07 14:34:30 ----A---- C:\Windows\system32\PDMSetup.exe
2010-03-07 14:32:12 ----A---- C:\Windows\system32\browserchoice.exe
2010-03-07 14:26:18 ----D---- C:\!

======List of files/folders modified in the last 1 months======

2010-03-25 15:38:00 ----D---- C:\Windows\Prefetch
2010-03-25 15:24:41 ----SHD---- C:\System Volume Information
2010-03-25 14:29:46 ----D---- C:\Program Files\Mozilla Firefox
2010-03-25 14:29:05 ----D---- C:\Windows\system32\drivers
2010-03-25 14:29:04 ----D---- C:\Windows
2010-03-25 14:23:07 ----A---- C:\Windows\system.ini
2010-03-23 09:05:26 ----D---- C:\Windows\system32\catroot2
2010-03-20 17:26:42 ----D---- C:\Temp
2010-03-20 16:55:27 ----D---- C:\Windows\System32
2010-03-20 16:55:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-03-20 16:55:25 ----D---- C:\Windows\inf
2010-03-20 11:42:50 ----D---- C:\Users\Rostoff\AppData\Roaming\Skype
2010-03-20 10:38:28 ----D---- C:\Users\Rostoff\AppData\Roaming\skypePM
2010-03-18 21:11:41 ----D---- C:\Windows\Tasks
2010-03-18 21:11:41 ----D---- C:\Windows\system32\Tasks
2010-03-17 19:08:26 ----D---- C:\Windows\system32\config
2010-03-17 19:08:26 ----D---- C:\Boot
2010-03-17 19:04:21 ----D---- C:\Windows\AppPatch
2010-03-17 19:04:20 ----D---- C:\Program Files\Common Files
2010-03-17 18:32:43 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-17 18:14:14 ----SHD---- C:\Windows\Installer
2010-03-17 18:14:13 ----D---- C:\Program Files\SUPERAntiSpyware
2010-03-17 18:08:50 ----D---- C:\Program Files\Azureus
2010-03-17 18:06:50 ----D---- C:\Windows\Debug
2010-03-10 22:43:51 ----D---- C:\Windows\winsxs
2010-03-10 22:33:05 ----D---- C:\Windows\system32\catroot
2010-03-10 20:29:47 ----D---- C:\Program Files\Windows Mail
2010-03-10 20:29:47 ----D---- C:\Program Files\Movie Maker
2010-03-10 19:22:12 ----RD---- C:\Program Files
2010-03-10 17:14:24 ----D---- C:\ProgramData\Microsoft Help
2010-03-10 17:08:39 ----D---- C:\Program Files\Common Files\microsoft shared
2010-03-09 00:02:34 ----D---- C:\Windows\system32\migration
2010-03-09 00:02:32 ----D---- C:\Program Files\Internet Explorer
2010-03-07 16:01:56 ----D---- C:\Program Files\Common Files\Sony Shared
2010-03-07 16:00:09 ----D---- C:\Program Files\Sony
2010-03-07 15:26:50 ----D---- C:\Windows\rescache
2010-03-07 15:20:38 ----D---- C:\ProgramData\Sony Corporation
2010-03-07 14:49:13 ----D---- C:\Windows\system32\cs-CZ
2010-03-07 14:48:55 ----D---- C:\Windows\PolicyDefinitions
2010-03-07 14:48:54 ----D---- C:\Windows\system32\en-US
2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DMICall;Sony DMI Call service; C:\Windows\system32\DRIVERS\DMICall.sys [2007-06-28 10216]
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2008-07-01 54280]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2008-07-01 71688]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-05-08 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-08 8192]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-10 140800]
R3 catchme;catchme; \??\C:\Users\Rostoff\AppData\Local\Temp\catchme.sys []
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-18 14208]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2008-07-01 30728]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-05-08 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-05-08 207360]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-06-26 1776128]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-06-26 1787816]
R3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-18 2251776]
R3 SNC;Sony Firmware Extension Parser Device; C:\Windows\System32\Drivers\SonyNC.sys [2006-11-06 27520]
R3 ti21sony;ti21sony; C:\Windows\system32\drivers\ti21sony.sys [2007-06-06 812544]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-05-08 659968]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-07-25 246784]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-06-15 705024]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-18 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 mbr;mbr; \??\C:\Users\Rostoff\AppData\Local\Temp\mbr.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-18 2225664]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2007-02-14 128104]
S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\winusb.sys [2009-04-11 31616]
S4 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-01-24 691696]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 NSUService;NSUService; C:\Program Files\Sony\Network Utility\NSUService.exe [2008-11-03 299008]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 VAIO Event Service;VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [2007-07-25 182392]
R2 VCFw;VAIO Content Folder Watcher; C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-03-05 5189992]
R2 VzCdbSvc;VAIO Entertainment Database Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [2009-03-05 192512]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R3 Vcsw;VAIO Entertainment UPnP Client Adapter; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [2009-03-05 313264]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-05-08 386560]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-07-01 19200]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-18 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-12-14 69632]
S3 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [2009-03-05 69632]
S3 VAIOMediaPlatform-IntegratedServer-AppServer;VAIO Media Integrated Server; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2007-06-20 2523136]
S3 VAIOMediaPlatform-IntegratedServer-HTTP;VAIO Media Integrated Server (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-IntegratedServer-UPnP;VAIO Media Integrated Server (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VAIOMediaPlatform-Mobile-Gateway;VAIO Media Gateway Server; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [2007-06-20 499712]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-11 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface; C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
S3 VUAgent;VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S4 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-10 138168]
S4 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-12-14 57344]

-----------------EOF-----------------

#13 Příspěvek od **Caroprd111** » 25 bře 2010 15:49

Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter

Obrázek

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky stiskem "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít

Otevřete si Poznámkový blok a zkopírujte do něj text (z bílého políčka):

Kód: Vybrat vše

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

Nyní uložte jako (typ: všechny soubory) kde za název souboru zadáte "smazani.reg" bez uvozovek, klik na uložit, pak na soubor standardně 2X kliknete a potvrďte dialogové okno.

VIRY.CZ

Prosím o kontrolulogu, děkuji...

Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...

Re: Prosím o kontrolulogu, děkuji...