Prosím o radu a pomoc
vista nespolupracuje s dvd mechanikou a ext. disky. Vždy hláška o nutnosti formátování, nezobrazí obsah.
Visty nejdou spustit v nouzovém režimu
příloha logy hijack, combofix
díky
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:50, on 29.10.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\VIA\VIAudioi\VDeck\VDECK.EXE
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Opera\opera.exe
C:\download\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{92C9BEBE-C5BA-48B2-9057-536576DB28D1}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\Windows\system32\rpcnet.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\ProoShowGold\ScsiAccess.exe
--
End of file - 6936 bytes
ComboFix 09-10-28.08 - jirka 29.10.2009 17:19.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3036.2035 [GMT 1:00]
Spuštěný z: c:\download\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\gasfkyjpyriwut.sys
c:\windows\system32\gasfkygwxoxpyc.dll
c:\windows\system32\gasfkylitqtqap.dat
c:\windows\system32\gasfkymoobwcud.dat
c:\windows\system32\gasfkysnmionrr.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-28 do 2009-10-29 )))))))))))))))))))))))))))))))
.
2009-10-29 16:30 . 2009-10-29 16:33 -------- d-----w- c:\users\jirka\AppData\Local\temp
2009-10-29 16:30 . 2009-10-29 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-29 16:19 . 2009-04-11 06:32 19944 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-29 16:19 . 2009-02-11 09:11 329752 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-10-29 16:19 . 2008-01-21 02:23 28728 ----a-w- c:\windows\system32\drivers\msahci.sys
2009-10-29 15:08 . 2009-10-29 15:08 -------- d-----w- c:\program files\Secunia
2009-10-29 14:52 . 2009-10-29 15:28 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-29 14:52 . 2009-10-29 14:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-29 12:35 . 2009-10-29 15:00 -------- d-----w- c:\program files\trend micro
2009-10-29 12:35 . 2009-10-29 12:35 -------- d-----w- C:\rsit
2009-10-28 10:03 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 10:03 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-22 19:37 . 2009-10-22 19:37 0 ----a-w- c:\windows\nsreg.dat
2009-10-22 19:37 . 2009-10-22 19:37 -------- d-----w- c:\users\jirka\AppData\Local\Thunderbird
2009-10-22 19:37 . 2009-10-22 19:37 -------- d-----w- c:\users\jirka\AppData\Roaming\Thunderbird
2009-10-22 19:36 . 2009-10-22 19:36 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-19 10:57 . 2009-10-19 11:00 970 ----a-w- c:\windows\unins000.dat
2009-10-19 05:26 . 2006-01-30 16:00 143360 ----a-r- c:\windows\apptune1018.exe
2009-10-19 05:26 . 2006-01-30 16:00 86016 ----a-w- c:\windows\system32\ZSPOOL.DLL
2009-10-19 05:26 . 2006-01-30 16:00 442368 ----a-r- c:\windows\system32\zshp1018.exe
2009-10-19 05:26 . 2006-01-30 16:00 28672 ----a-w- c:\windows\system32\zlm.dll
2009-10-19 05:26 . 2006-01-30 16:00 28672 ----a-w- c:\windows\system32\IMF32.DLL
2009-10-19 05:26 . 2006-01-30 16:00 24576 ----a-w- c:\windows\system32\ZTAG32.DLL
2009-10-19 05:26 . 2006-01-30 16:00 106496 ----a-r- c:\windows\system32\vshp1018.dll
2009-10-19 05:26 . 2006-01-30 16:00 102400 ----a-w- c:\windows\system32\zlhp1018.dll
2009-10-19 05:26 . 2009-10-19 05:26 -------- d-----w- c:\program files\Hewlett-Packard
2009-10-19 05:26 . 2009-10-19 05:26 -------- d--h--w- c:\program files\Zenographics
2009-10-16 11:18 . 2009-10-16 11:18 -------- d-----w- c:\users\jirka\AppData\Local\DocPortal
2009-10-16 11:17 . 2009-10-26 16:48 -------- d-----w- C:\Medicus2
2009-10-16 11:09 . 2009-10-16 11:09 -------- d-----w- c:\program files\Záznamy
2009-10-15 14:45 . 2009-10-15 16:02 -------- d-----w- c:\users\jirka\AppData\Local\Microsoft Games
2009-10-14 16:37 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-14 16:37 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-14 16:37 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-13 13:18 . 2009-10-13 13:18 -------- d-----w- c:\program files\CCleaner
2009-10-12 15:04 . 2009-10-12 15:04 -------- d-----w- c:\program files\MSECache
2009-10-12 14:41 . 2009-10-12 14:41 -------- d-----w- c:\users\jirka\AppData\Roaming\Microsoft Web Folders
2009-10-10 07:29 . 2009-10-10 07:29 -------- d-----w- c:\program files\VobSub
2009-10-07 15:23 . 2009-10-07 15:23 -------- d-----w- c:\programdata\Office Genuine Advantage
2009-10-06 12:28 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-06 12:28 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-06 12:28 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-06 12:28 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-06 12:28 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-06 12:28 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-06 12:28 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-06 12:28 . 2009-08-06 17:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-06 12:28 . 2009-08-06 16:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-04 11:28 . 2009-10-04 11:28 -------- d-----w- c:\users\jirka\AppData\Roaming\Ashampoo
2009-10-04 11:28 . 2009-10-04 11:28 -------- d-----w- c:\program files\Ashampoo
2009-10-04 09:48 . 2009-10-04 10:37 -------- d-----w- C:\Stereo2006 v81
2009-10-03 17:43 . 2009-10-04 11:42 -------- d-----w- C:\Stereo2008 v10
2009-10-03 17:10 . 2009-10-19 13:07 -------- d-----w- C:\Stereo2009 v11
2009-10-03 16:40 . 2009-10-03 17:53 -------- d-----w- c:\program files\Free Hide Folder
2009-10-02 15:09 . 2009-10-20 13:33 1 ----a-w- c:\users\jirka\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-02 15:09 . 2009-10-02 15:09 -------- d-----w- c:\users\jirka\AppData\Roaming\OpenOffice.org
2009-10-02 15:07 . 2009-10-02 15:07 -------- d-----w- c:\program files\OpenOffice.org 3
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-29 16:33 . 2009-07-27 19:22 45056 ----a-w- c:\windows\system32\acovcnt.exe
2009-10-29 16:32 . 2009-09-16 16:25 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2009-10-29 16:32 . 2009-09-16 16:44 56680 ----a-w- c:\windows\system32\rpcnet.dll
2009-10-29 16:22 . 2008-04-17 10:34 598832 ----a-w- c:\windows\system32\perfh005.dat
2009-10-29 16:22 . 2008-04-17 10:34 114992 ----a-w- c:\windows\system32\perfc005.dat
2009-10-29 15:21 . 2009-09-29 16:14 -------- d-----w- c:\users\jirka\AppData\Roaming\Orbit
2009-10-29 15:13 . 2009-09-29 16:14 -------- d-----w- c:\program files\Orbitdownloader
2009-10-29 15:11 . 2009-09-29 16:14 -------- d-----w- c:\users\jirka\AppData\Roaming\GrabPro
2009-10-28 17:21 . 2009-07-27 19:14 -------- d-----w- c:\programdata\P4G
2009-10-20 14:15 . 2009-09-20 11:54 -------- d-----w- c:\program files\The KMPlayer
2009-10-18 16:01 . 2009-07-27 18:08 -------- d-----w- c:\programdata\Microsoft Help
2009-10-18 13:26 . 2009-09-20 13:31 -------- d-----w- c:\program files\AVI ReComp
2009-10-17 08:20 . 2009-09-14 15:33 104040 ----a-w- c:\users\jirka\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-16 11:09 . 2009-10-16 11:09 -------- d-----w- c:\program files\Záznamy
2009-10-15 15:47 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-12 13:52 . 2009-07-27 17:58 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2009-10-10 07:35 . 2009-09-20 13:31 -------- d-----w- c:\program files\Xvid
2009-10-10 07:34 . 2009-09-20 13:31 -------- d-----w- c:\program files\AviSynth 2.5
2009-10-04 15:58 . 2009-10-02 15:15 -------- d-----w- c:\program files\Vista Manager
2009-10-04 07:49 . 2009-07-27 18:20 -------- d-----w- c:\programdata\CyberLink
2009-09-29 16:16 . 2009-09-29 16:16 -------- d-----w- c:\program files\Opera
2009-09-29 13:03 . 2009-09-29 13:03 84 ---ha-w- c:\programdata\aspg.dat
2009-09-29 12:34 . 2009-09-29 12:34 -------- d-----w- c:\program files\7-Zip
2009-09-28 16:12 . 2009-09-28 16:12 -------- d--h--w- c:\programdata\CanonBJ
2009-09-22 15:08 . 2009-09-22 15:08 -------- d-----w- c:\users\jirka\AppData\Roaming\TrueCrypt
2009-09-22 15:07 . 2009-09-22 15:07 215872 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2009-09-22 15:07 . 2009-09-22 15:07 -------- d-----w- c:\program files\TrueCrypt
2009-09-22 15:03 . 2009-09-22 15:03 -------- d-----w- c:\program files\Posudky LPS
2009-09-22 15:03 . 2009-09-22 15:03 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-09-22 05:40 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-09-20 13:44 . 2009-09-20 13:44 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-20 13:40 . 2009-07-27 18:15 -------- d-----w- c:\program files\Microsoft Works
2009-09-20 13:32 . 2009-09-20 13:32 -------- d-----w- c:\program files\Gabest
2009-09-20 12:36 . 2009-09-20 12:33 -------- d-----w- c:\users\jirka\AppData\Roaming\Corel
2009-09-20 12:36 . 2009-09-20 12:29 88 --sha-r- c:\windows\system32\6625445F44.sys
2009-09-20 12:36 . 2009-09-20 12:29 3140 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-09-20 12:32 . 2009-09-20 12:32 -------- d-----w- c:\programdata\Corel
2009-09-20 12:31 . 2009-09-20 12:30 -------- d-----w- c:\program files\Common Files\Corel
2009-09-20 12:30 . 2009-09-20 12:29 -------- d-----w- c:\program files\Corel
2009-09-20 12:30 . 2009-09-20 12:30 456008 ----a-w- c:\programdata\pswi_preloaded.exe
2009-09-20 12:29 . 2009-09-20 12:29 -------- d-----w- c:\users\jirka\AppData\Roaming\InstallShield
2009-09-20 11:23 . 2009-09-20 11:21 -------- d-----w- c:\users\jirka\AppData\Roaming\Zoner
2009-09-20 11:21 . 2009-09-20 11:21 -------- d-----w- c:\program files\Zoner
2009-09-20 10:56 . 2009-09-20 10:56 -------- d-----w- c:\programdata\ASUS
2009-09-17 17:40 . 2009-09-14 15:53 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-09-17 17:40 . 2009-09-14 15:53 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-09-17 17:40 . 2009-09-14 15:53 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-09-17 17:40 . 2009-09-14 15:53 -------- d-----w- c:\program files\Symantec
2009-09-16 16:44 . 2009-09-16 16:44 56680 ----a-w- c:\windows\system32\rpcnet.exe
2009-09-14 18:03 . 2009-09-14 18:00 -------- d-----w- c:\program files\Canon
2009-09-14 17:42 . 2009-09-14 15:53 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-14 17:42 . 2009-07-27 18:24 -------- d-----w- c:\program files\Google
2009-09-14 17:35 . 2009-09-14 17:35 -------- d-----w- c:\program files\Photodex Presenter
2009-09-14 17:35 . 2009-09-14 17:35 -------- d-----w- c:\users\jirka\AppData\Roaming\Netscape
2009-09-14 17:35 . 2009-09-14 17:35 131072 ----a-w- c:\users\jirka\AppData\Roaming\Netscape\Plugins\npPxPlay.dll
2009-09-14 17:35 . 2009-09-14 17:35 131072 ----a-w- c:\users\jirka\AppData\Roaming\Mozilla\Plugins\npPxPlay.dll
2009-09-14 17:35 . 2009-09-14 17:35 -------- d-----w- c:\program files\ProoShowGold
2009-09-14 17:32 . 2009-09-14 17:32 -------- d-----w- c:\users\jirka\AppData\Roaming\Photodex
2009-09-14 17:26 . 2009-09-14 17:26 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-09-14 17:25 . 2009-09-14 17:25 -------- d-----w- c:\program files\Axesstel
2009-09-14 16:21 . 2009-09-14 16:21 -------- d-----w- c:\programdata\LightScribe
2009-09-14 16:06 . 2009-09-14 16:06 -------- d-----w- c:\users\jirka\AppData\Roaming\CyberLink
2009-09-14 15:54 . 2009-07-27 18:22 -------- d-----w- c:\programdata\Symantec
2009-09-14 15:53 . 2009-09-14 15:53 0 ----a-w- c:\windows\system32\drivers\1043_ASUSTeK_K50IJ.alu
2009-09-14 15:53 . 2009-07-27 18:21 -------- d-----w- c:\programdata\Norton
2009-09-14 15:40 . 2009-09-14 15:38 -------- d-----w- c:\program files\Microsoft
2009-09-14 15:40 . 2009-09-14 15:37 -------- d-----w- c:\program files\Windows Live
2009-09-14 15:38 . 2009-09-14 15:38 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-14 15:38 . 2009-09-14 15:38 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-14 15:37 . 2009-09-14 15:37 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-14 15:35 . 2009-09-14 15:35 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-14 09:29 . 2009-10-14 16:36 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-05 12:25 . 2009-09-05 12:25 1183744 ----a-w- c:\windows\system32\drivers\athr.sys
2009-09-04 11:41 . 2009-10-14 16:36 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 00:27 . 2009-09-15 16:10 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-15 16:10 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22 . 2009-10-14 16:36 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-14 16:36 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-14 16:36 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-14 16:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-26 00:08 . 2009-09-14 15:53 25648 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:27 . 2009-09-16 16:41 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-16 16:41 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-16 16:41 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-16 16:41 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-16 16:41 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-16 16:41 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-16 16:41 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-16 16:41 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-16 16:41 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-16 16:41 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-16 16:41 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-05 04:18 . 2009-08-05 04:18 48640 ----a-w- c:\windows\system32\drivers\L1E60x86.sys
2009-08-03 13:07 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-07-27 18:19 . 2009-07-27 18:19 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-05 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-05 150552]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-03-23 17149952]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-12-29 159744]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-02-06 1593344]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-07-27 3054136]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2009-07-27 47672]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-03-06 424352]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 2 (0x2)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ADSMTray"=c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):70,cf,b3,e7,47,3b,ca,01
R0 lullaby;lullaby;c:\windows\System32\drivers\lullaby.sys [27.7.2009 20:13 15416]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1007020.00B\SymEFA.sys [17.9.2009 18:39 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NIS\1007020.00B\BHDrvx86.sys [17.9.2009 18:39 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1007020.00B\cchpx86.sys [17.9.2009 18:39 482432]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091021.001\IDSvix86.sys [22.10.2009 19:15 342576]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [17.9.2009 18:39 117640]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [29.10.2009 15:52 1153368]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30.3.2009 15:28 1533808]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [16.9.2009 9:00 102448]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\System32\drivers\ETD.sys [13.3.2009 4:11 140800]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\System32\drivers\L1E60x86.sys [5.8.2009 5:18 48640]
R3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [17.6.2009 13:20 12648]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\System32\drivers\SRS_PremiumSound_i386.sys [27.7.2009 20:15 230952]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\NIS\1007020.00B\symndisv.sys [17.9.2009 18:39 48688]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\System32\drivers\viahduaa.sys [20.3.2009 7:21 984064]
S3 Axtmvflt;Axesstel USB Filter Service;c:\windows\System32\drivers\Axtmvflt.sys [14.9.2009 18:25 3456]
S3 Axtmvmdm;Axesstel USB Modem;c:\windows\System32\drivers\Axtmvmdm.sys [14.9.2009 18:25 40064]
S3 Axtmvprt;Axesstel Diagnostic Port;c:\windows\System32\drivers\Axtmvprt.sys [14.9.2009 18:25 38784]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [14.9.2009 16:40 55264]
S3 fsssvc;Windows Live Zabezpečení rodiny;c:\program files\Windows Live\Family Safety\fsssvc.exe [8.12.2008 16:01 533344]
--- Ostatní služby/ovladače v paměti ---
*NewlyCreated* - MBR
*Deregistered* - mbr
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain ... &bmod=ASUS
mStart Page = hxxp://www.google.com/ig/redirectdomain ... &bmod=ASUS
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 17:34
Windows 6.0.6002 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
C:\ADSM_PData_0150
sken byl úspešně dokončen
skryté soubory: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'Explorer.exe'(1548)
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\program files\ASUS\SmartLogon\smartlogon.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\windows\system32\WLANExt.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PSIService.exe
c:\program files\ASUS\ASUS Live Update\ALU.exe
c:\program files\ASUS\ASUS CopyProtect\aspg.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\rpcnet.exe
c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe
c:\program files\ASUS\ATK Hotkey\HControl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\system32\igfxsrvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\NORTON INTERNET SECURITY\ENGINE\16.7.2.11\cltLMH.exe
.
**************************************************************************
.
Celkový čas: 2009-10-29 17:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-29 16:37
Před spuštěním: Volných bajtů: 105 361 469 440
Po spuštění: Volných bajtů: 104 562 597 888
- - End Of File - - 1BF62244145D485EBC82A91692AC9E71
nespolupráce vista s dvd a exter- disky
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 9 hostů