Prosím o kontrolu, přímý kontakt s Trojáky

[cross]

Ahoj,

moc prosím o kontrolu. Odvirovával jsem si web a měl jsem tak kontakt se spoustou trojských koní.
U Avast!u jsem pozastavil štíty.




Logfile of random's system information tool 1.08 (written by random/random)
Run by cross at 2010-12-29 10:38:43
Microsoft Windows 7 Home Premium
System drive C: has 74 GB (62%) free of 119 GB
Total RAM: 2937 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:38:53, on 29.12.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\TrueSuite\TrueSuite.SysTray.exe
C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\crossíček\Programy\Auto Clicker\AutoClicker.exe
C:\Windows\System32\StikyNot.exe
C:\crossíček\QIP 2010\QIP 2010\qip.exe
C:\Program Files\TrueSuite\TrueSuite.WeblogonHost.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\crossíček\Programy\The KMPlayer\KMPlayer.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\TrueSuite\TrueSuite.TouchControl.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\cross\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\NOTEPAD.EXE
E:\Downloads\RSIT.exe
C:\Program Files\trend micro\cross.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: TSBHO Class - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\TrueSuite\TrueSuite.IEBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SystemTray] C:\Program Files\TrueSuite\TrueSuite.SysTray.exe
O4 - HKLM\..\Run: [ClientAppLogon] C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [MurGee.com Auto Clicker] C:\crossíček\Programy\Auto Clicker\AutoClicker.exe :silent
O4 - HKCU\..\Run: [PC Suite Tray] "E:\Programy\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: 20Dollars2Surf.lnk = C:\Program Files\20Dollars2Surf\20dollars2surf.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Program Files\Fingerprint Sensor\atservice.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: TrueSuiteService (FPLService) - AuthenTec, Inc - C:\Program Files\TrueSuite\TrueSuite.Service.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5806 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Website Log On - C:\Program Files\TrueSuite\TrueSuite.IEBHO.dll [2009-12-22 195392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-12-08 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-06-28 2837864]
"SystemTray"=C:\Program Files\TrueSuite\TrueSuite.SysTray.exe [2009-12-22 619328]
"ClientAppLogon"=C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe [2009-12-22 307008]
""= []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"=c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2005-08-11 249856]
"MurGee.com Auto Clicker"=C:\crossíček\Programy\Auto Clicker\AutoClicker.exe [2010-11-06 40960]
"PC Suite Tray"=E:\Programy\Nokia PC Suite 7\PCSuite.exe [2010-05-14 1479680]
"RESTART_STICKY_NOTES"=C:\Windows\System32\StikyNot.exe [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
20Dollars2Surf.lnk - C:\Program Files\20Dollars2Surf\20dollars2surf.exe
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-29 10:38:20 ----D---- C:\Program Files\trend micro
2010-12-15 10:46:06 ----D---- C:\Users\cross\AppData\Roaming\PC Suite
2010-12-15 10:46:06 ----D---- C:\ProgramData\PC Suite
2010-12-15 10:45:54 ----D---- C:\Program Files\Common Files\PCSuite
2010-12-15 10:45:53 ----D---- C:\Program Files\Common Files\Nokia
2010-12-15 10:45:46 ----D---- C:\Program Files\DIFX
2010-12-15 10:45:45 ----A---- C:\Windows\system32\drivers\pccsmcfd.sys
2010-12-15 10:45:42 ----DC---- C:\Windows\system32\DRVSTORE
2010-12-15 10:45:38 ----D---- C:\Program Files\PC Connectivity Solution
2010-12-15 10:45:19 ----A---- C:\Windows\system32\nmwcdcls.dll
2010-12-15 10:44:20 ----D---- C:\ProgramData\Installations
2010-12-15 10:40:58 ----D---- C:\Users\cross\AppData\Roaming\Nokia
2010-12-15 10:10:20 ----D---- C:\Users\cross\AppData\Roaming\Leawo
2010-12-15 10:01:04 ----D---- C:\Users\cross\AppData\Roaming\Broad Intelligence
2010-12-15 09:20:31 ----A---- C:\Windows\system32\tzres.dll
2010-12-15 09:20:29 ----A---- C:\Windows\system32\atmfd.dll
2010-12-15 09:20:28 ----A---- C:\Windows\system32\atmlib.dll
2010-12-15 09:20:27 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-15 09:20:27 ----A---- C:\Windows\system32\taskschd.dll
2010-12-15 09:20:27 ----A---- C:\Windows\system32\taskeng.exe
2010-12-15 09:20:27 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-15 09:20:27 ----A---- C:\Windows\system32\schtasks.exe
2010-12-15 09:20:27 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-15 09:20:26 ----A---- C:\Windows\system32\iertutil.dll
2010-12-15 09:20:25 ----A---- C:\Windows\system32\mstime.dll
2010-12-15 09:20:24 ----A---- C:\Windows\system32\mshtml.dll
2010-12-15 09:20:24 ----A---- C:\Windows\system32\ieframe.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\wininet.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\urlmon.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\mshtmled.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\msfeeds.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\licmgr10.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\ieui.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\iepeers.dll
2010-12-15 09:20:23 ----A---- C:\Windows\system32\iedkcs32.dll
2010-12-15 09:20:22 ----A---- C:\Windows\system32\msfeedssync.exe
2010-12-15 09:20:22 ----A---- C:\Windows\system32\jsproxy.dll
2010-12-15 09:20:21 ----A---- C:\Windows\system32\webio.dll
2010-12-15 09:20:20 ----A---- C:\Windows\system32\win32k.sys
2010-12-15 09:20:20 ----A---- C:\Windows\system32\consent.exe
2010-12-08 22:56:19 ----D---- C:\ProgramData\Sun
2010-12-08 22:56:18 ----D---- C:\Program Files\Common Files\Java
2010-12-08 22:56:00 ----A---- C:\Windows\system32\javaws.exe
2010-12-08 22:56:00 ----A---- C:\Windows\system32\javaw.exe
2010-12-08 22:56:00 ----A---- C:\Windows\system32\java.exe
2010-12-08 22:56:00 ----A---- C:\Windows\system32\deployJava1.dll
2010-12-08 22:55:44 ----D---- C:\Program Files\Java
2010-12-01 22:02:40 ----D---- C:\Program Files\PokerStars
2010-11-30 22:30:30 ----D---- C:\Users\cross\AppData\Roaming\Transcend

======List of files/folders modified in the last 1 months======

2010-12-29 10:38:50 ----D---- C:\Windows\Temp
2010-12-29 10:38:31 ----D---- C:\Windows\Prefetch
2010-12-29 10:38:20 ----RD---- C:\Program Files
2010-12-29 10:27:42 ----D---- C:\Windows\system32\config
2010-12-28 18:40:43 ----SHD---- C:\Windows\Installer
2010-12-28 09:57:20 ----SHD---- C:\System Volume Information
2010-12-24 13:41:17 ----D---- C:\Windows\System32
2010-12-24 13:41:17 ----D---- C:\Windows\inf
2010-12-24 13:41:17 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-12-23 18:12:29 ----D---- C:\Users\cross\AppData\Roaming\GHISLER
2010-12-20 20:49:09 ----D---- C:\Windows\rescache
2010-12-19 21:05:45 ----D---- C:\ProgramData\Microsoft Help
2010-12-16 13:36:58 ----D---- C:\Windows\winsxs
2010-12-16 13:35:12 ----D---- C:\Windows\system32\migration
2010-12-16 13:35:12 ----D---- C:\Windows\system32\cs-CZ
2010-12-16 13:35:12 ----D---- C:\Program Files\Windows Mail
2010-12-16 13:35:12 ----D---- C:\Program Files\Internet Explorer
2010-12-16 09:19:06 ----D---- C:\Windows\system32\catroot2
2010-12-16 09:19:06 ----D---- C:\Windows\system32\catroot
2010-12-16 09:17:05 ----A---- C:\Windows\system32\MRT.exe
2010-12-15 21:53:17 ----D---- C:\Windows\system32\wdi
2010-12-15 10:47:14 ----D---- C:\Windows\system32\drivers
2010-12-15 10:47:12 ----D---- C:\Windows\system32\drivers\UMDF
2010-12-15 10:46:09 ----D---- C:\Windows\system32\DriverStore
2010-12-15 10:46:06 ----HD---- C:\ProgramData
2010-12-15 10:45:54 ----D---- C:\Program Files\Common Files
2010-12-15 10:41:03 ----D---- C:\Windows\system32\Tasks
2010-12-15 00:08:27 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-14 23:59:57 ----D---- C:\Program Files\Common Files\InstallShield
2010-12-11 21:10:28 ----SD---- C:\Users\cross\AppData\Roaming\Microsoft
2010-12-10 21:25:10 ----D---- C:\Windows\system32\NDF
2010-12-08 17:14:00 ----D---- C:\Program Files\Mozilla Firefox 4.0 Beta 4
2010-12-01 14:16:37 ----RSD---- C:\Windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-09-14 691696]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-06-28 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-06-28 46672]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2009-09-07 48128]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2009-06-25 44544]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2009-06-25 38400]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-13 1035776]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-09-21 1218048]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-09-24 659328]
R3 e1yexpress;Ovladač gigabitových síťových připojení Intel(R); C:\Windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-09-20 25280]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 30720]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 avvxyn9e;avvxyn9e; C:\Windows\system32\drivers\avvxyn9e.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 netr73;RT73 USB - ovladač karty pro bezdrátovou síť LAN pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ATService;AuthenTec Fingerprint Service; C:\Program Files\Fingerprint Sensor\atservice.exe [2009-12-22 1819968]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R2 FPLService;TrueSuiteService; C:\Program Files\TrueSuite\TrueSuite.Service.exe [2009-12-22 108352]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-01 1343400]

-----------------EOF-----------------

[Reklama]

[cross]

Combofix:





ComboFix 10-12-28.03 - cross 29.12.2010 10:46:15.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.2937.1951 [GMT 1:00]
Spuštěný z: e:\downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\Autorun.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-28 do 2010-12-29 )))))))))))))))))))))))))))))))
.

2010-12-29 09:38 . 2010-12-29 09:38 -------- d-----w- c:\program files\trend micro
2010-12-28 08:57 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{068265B3-8C64-4FA8-A47F-E61F6F156956}\mpengine.dll
2010-12-15 09:46 . 2010-12-15 09:47 -------- d-----w- c:\users\cross\AppData\Roaming\PC Suite
2010-12-15 09:46 . 2010-12-15 09:47 -------- d-----w- c:\programdata\PC Suite
2010-12-15 09:45 . 2010-12-15 09:45 -------- d-----w- c:\program files\Common Files\PCSuite
2010-12-15 09:45 . 2010-12-15 09:45 -------- d-----w- c:\program files\Common Files\Nokia
2010-12-15 09:45 . 2010-12-15 09:46 -------- d-----w- c:\program files\DIFX
2010-12-15 09:45 . 2008-08-26 09:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-12-15 09:45 . 2010-12-15 09:45 -------- dc----w- c:\windows\system32\DRVSTORE
2010-12-15 09:45 . 2010-12-15 09:45 -------- d-----w- c:\program files\PC Connectivity Solution
2010-12-15 09:45 . 2010-02-26 13:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-12-15 09:44 . 2010-12-15 09:44 -------- d-----w- c:\programdata\Installations
2010-12-15 09:40 . 2010-12-15 09:47 -------- d-----w- c:\users\cross\AppData\Roaming\Nokia
2010-12-15 09:10 . 2010-12-15 09:10 -------- d-----w- c:\users\cross\AppData\Roaming\Leawo
2010-12-15 09:01 . 2010-12-15 09:01 -------- d-----w- c:\users\cross\AppData\Roaming\Broad Intelligence
2010-12-08 21:56 . 2010-12-08 21:56 -------- d-----w- c:\program files\Common Files\Java
2010-12-08 21:56 . 2010-12-08 21:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-12-08 21:55 . 2010-12-08 21:55 -------- d-----w- c:\program files\Java
2010-12-01 21:02 . 2010-12-28 23:00 -------- d-----w- c:\users\cross\AppData\Local\PokerStars
2010-12-01 21:02 . 2010-12-07 21:08 -------- d-----w- c:\program files\PokerStars
2010-11-30 21:30 . 2010-11-30 21:30 -------- d-----w- c:\users\cross\AppData\Roaming\Transcend
2010-11-29 19:53 . 2010-12-18 14:07 -------- d-----w- c:\users\cross\AppData\Local\Microsoft Help
2010-11-29 19:53 . 2010-12-19 20:05 -------- d-----w- c:\programdata\Microsoft Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-21 14:49 . 2010-11-21 14:49 695675 ----a-w- c:\windows\unins000.exe
2010-11-02 21:00 . 2010-11-02 21:00 65536 ----a-r- c:\users\cross\AppData\Roaming\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
2010-10-19 09:41 . 2010-08-31 09:43 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TSFPLOlayIcon]
@="{F4DD9208-8229-492D-BCBF-2955F7AC38F4}"
[HKEY_CLASSES_ROOT\CLSID\{F4DD9208-8229-492D-BCBF-2955F7AC38F4}]
2009-12-22 20:56 285504 ----a-w- c:\program files\TrueSuite\TrueSuite.FPLOlayIcon.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"MurGee.com Auto Clicker"="c:\crossíček\Programy\Auto Clicker\AutoClicker.exe" [2010-11-06 40960]
"PC Suite Tray"="e:\programy\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864]
"ClientAppLogon"="c:\program files\TrueSuite\TrueSuite.ClientAppLogonExe.exe" [2009-12-22 307008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
20Dollars2Surf.lnk - c:\program files\20Dollars2Surf\20dollars2surf.exe [2010-8-31 89088]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-8 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

R3 netr73;RT73 USB - ovladač karty pro bezdrátovou síť LAN pro systém Windows Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-01 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-14 691696]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\atservice.exe [2009-12-22 1819968]
S2 FPLService;TrueSuiteService;c:\program files\TrueSuite\TrueSuite.Service.exe [2009-12-22 108352]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-09-23 659328]
S3 e1yexpress;Ovladač gigabitových síťových připojení Intel(R);c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\cross\AppData\Roaming\Mozilla\Firefox\Profiles\g8eeymm8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2712944772-641038960-2487343970-1001\Software\SecuROM\License information*]
"datasecu"=hex:a0,ad,62,e7,e3,9b,44,bb,0d,b3,0c,72,b4,a6,7a,10,5b,95,1d,6b,ff,
92,1d,97,84,c4,6d,af,91,06,b4,7e,2e,87,ee,0c,64,e7,41,7c,e5,11,c8,0b,81,d2,\
"rkeysecu"=hex:39,2c,0e,26,d7,46,1f,12,f5,8c,b5,62,11,4f,65,a4

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-12-29 10:53:29
ComboFix-quarantined-files.txt 2010-12-29 09:53

Před spuštěním: Volných bajtů: 77 564 448 768
Po spuštění: Volných bajtů: 77 865 947 136

- - End Of File - - FEBD16051F54281E9AAC93EAA71C2DDF

[memphisto]

Dořeš si to na virech.cz. Nemá smysl to řešit zároveň na dvou fórech

[cross]

Na viry.cz se tomu nikdo nevěnuje, proto píši sem.

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\unins000.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=-
"ConsentPromptBehaviorUser"=-
"EnableUIADesktopToggle"=-

DDS::
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,

RegNull::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.