měl jsem problém ve Win s chybovou hláškou (Error: Can't Find: "Self-deregistering..."), která mi vyskakovala při pravé myši na složku..soubor, ale už je to v pořádku..sám ani nevím, jak jsem to vyřešil
..Nicméně, byl jsem upozorněn, že mám systém ve velmi špatném stavu, tak bych byl moc rád, kdyby se mi na to někdo z místních rádců ještě mrknul..děkuji předem za reakce
HijackThis
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:02:21, on 7.2.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Classic Shell\ClassicStartMenu.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\system32\taskeng.exe
C:\Windows\MODPS2KEY.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Fraps\fraps.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
D:\Portable aplikace\AIDA64 Extreme Edition 1.50.1236 Beta\Software\aida64.exe
C:\Program Files\Logitech\SetPointG\SetPointII.exe
C:\Windows\system32\taskmgr.exe
C:\Portable aplikace\CoreTemp32\Core Temp.exe
C:\Users\Jirka\Desktop\Programy log systemu\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKCU\..\Run: [Core Temp] "C:\Portable aplikace\CoreTemp32\Core Temp.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [SmartRAM] "C:\Users\Jirka\Downloads\iobit_toolbox\Tools\Suo10_SmartRAM.exe" /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: (no name) - {64964764-1101-4bbd-8891-B56B1A53B9B3} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Služba Acronis Scheduler2 (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Acronis Nonstop Backup Service (afcdpsrv) - Acronis - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Defragmentation-Service (DfSdkS) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo UnInstaller 4\DfSdkS.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files\Secunia\PSI\PSIA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: webcamXP Service (wxpSvc) - Unknown owner - C:\Program Files\wLite\wService.exe
--
End of file - 10192 bytes
Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware 1.50.1.1100
http://www.malwarebytes.org
Verze databáze: 5702
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
7.2.2011 17:03:20
mbam-log-2011-02-07 (17-03-20).txt
Typ kontroly: Rychlý test
Testované objekty: 195434
Uplynulý čas: 3 minut, 22 sekund
Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0
Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)
Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)
Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)
DDS
DDS (Ver_10-12-12.02) - NTFSx86
Run by Jirka at 17:11:13,90 on po 07.02.2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1033.18.3582.2424 [GMT 1:00]
AV: avast! antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Classic Shell\ClassicStartMenu.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\system32\taskeng.exe
C:\Windows\MODPS2KEY.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Fraps\fraps.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files\Windows Media Player\wmplayer.exe
D:\Portable aplikace\AIDA64 Extreme Edition 1.50.1236 Beta\Software\aida64.exe
C:\Program Files\Logitech\SetPointG\SetPointII.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Portable aplikace\CoreTemp32\Core Temp.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Jirka\Desktop\Programy log systemu\DDS\aadds.scr
C:\Windows\system32\conhost.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ExplorerBHO Class: {449d0d6e-2412-4e61-b68f-1cb625cd9e52} - c:\program files\classic shell\ClassicExplorer32.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Classic Explorer Bar: {553891b7-a0d5-4526-be18-d3ce461d6310} - c:\program files\classic shell\ClassicExplorer32.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
uRun: [<NO NAME>]
uRun: [Core Temp] "c:\portable aplikace\coretemp32\Core Temp.exe"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [SmartRAM] "c:\users\jirka\downloads\iobit_toolbox\tools\Suo10_SmartRAM.exe" /m
mRun: [avast!] "c:\program files\alwil software\avast4\ashDisp.exe"
mRun: [Classic Start Menu] c:\program files\classic shell\ClassicStartMenu.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
uPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: EnableLinkedConnections = 1 (0x1)
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\mif5ba~1\office14\ONBttnIE.dll/105
IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {64964764-1101-4bbd-8891-B56B1A53B9B3} - {553891B7-A0D5-4526-BE18-D3CE461D6310} - c:\program files\classic shell\ClassicExplorer32.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
Hosts: 127.0.0.1 http://www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\users\jirka\appdata\roaming\mozilla\firefox\profiles\8ix8n3ta.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.7&q=
FF - component: c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\firefoxextension\components\FirefoxExtension.dll
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\users\jirka\appdata\roaming\mozilla\firefox\profiles\8ix8n3ta.default\extensions\cfxhelper@triton\components\dwmxpcom.dll
FF - component: c:\users\jirka\appdata\roaming\mozilla\firefox\profiles\8ix8n3ta.default\extensions\dttoolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - plugin: c:\progra~1\mif5ba~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\mif5ba~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft research\hd view\nphdview.dll
FF - plugin: c:\program files\mozilla firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npnul32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPOFF12.DLL
FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
FF - plugin: c:\program files\webzen\webzengamestarter\NPGameWebStarter.dll
FF - plugin: c:\program files\win7codecs\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\win7codecs\rm\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\jirka\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\jirka\appdata\roaming\mozilla\firefox\profiles\8ix8n3ta.default\extensions\maps@ovi.com\plugins\npNMapNPR.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox 4.0 beta 9\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Chromifox Extreme: cfxe@Triton - %profile%\extensions\cfxe@Triton
FF - Ext: Chromifox Extreme Carbon: cfxec@Triton - %profile%\extensions\cfxec@Triton
FF - Ext: Chromifox Companion: cfxHelper@Triton - %profile%\extensions\cfxHelper@Triton
FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com
FF - Ext: Read It Later: isreaditlater@ideashower.com - %profile%\extensions\isreaditlater@ideashower.com
FF - Ext: Ovi maps browser plugin: maps@ovi.com - %profile%\extensions\maps@ovi.com
FF - Ext: Personas Expression: personasexpression@eddiescorpse.private - %profile%\extensions\personasexpression@eddiescorpse.private
FF - Ext: QuickDrag: quickdrag@mozilla.ktechcomputing.com - %profile%\extensions\quickdrag@mozilla.ktechcomputing.com
FF - Ext: Hide IP Easy: support@easy-hideip.com - %profile%\extensions\support@easy-hideip.com
FF - Ext: Ask Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com
FF - Ext: MacOSX Theme: {00352F14-3F76-4e4d-ACFF-9972D7E4B3B9} - %profile%\extensions\{00352F14-3F76-4e4d-ACFF-9972D7E4B3B9}
FF - Ext: MacOSX Theme: {00352F14-3F76-4e4d-ACFF-9976D7E4B3B9} - %profile%\extensions\{00352F14-3F76-4e4d-ACFF-9976D7E4B3B9}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: TV-Fox: {2f17f610-5e97-4fed-828f-9940b7b577a4} - %profile%\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
FF - Ext: Context Search: {902D2C4A-457A-4EF9-AD43-7014562929FF} - %profile%\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: UnMHT: {f759ca51-3a91-4dd1-ae78-9db5eee9ebf0} - %profile%\extensions\{f759ca51-3a91-4dd1-ae78-9db5eee9ebf0}
FF - Ext: PC Sync 2 Synchronisation Extension: bkmrksync@nokia.com - c:\program files\nokia\nokia pc suite 7\bkmrksync
FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\nokia\nokia ovi suite\connectors\bookmarks connector\FirefoxExtension
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
============= SERVICES / DRIVERS ===============
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-2-3 15672]
R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\drivers\tdrpm273.sys [2010-11-19 752128]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-8-19 114768]
R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2010-6-27 102856]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-2-7 218688]
R2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files\common files\acronis\cdp\afcdpsrv.exe [2010-11-19 3975088]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-8-19 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-8-19 53328]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-8-19 138680]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-6-27 60936]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-1-5 10448]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-1 1153368]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-10 993848]
R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2010-12-3 2222376]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [2010-11-19 163232]
R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;d:\portable aplikace\aida64 extreme edition 1.50.1236 beta\software\kerneld.x32 [2011-2-3 28312]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-8-19 254040]
R3 AVerA706;AVerMedia A706 BDA Service;c:\windows\system32\drivers\AVerA706.sys [2009-6-10 1169920]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2010-6-27 79432]
R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 19720]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048]
R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\drivers\V0260Vid.sys [2010-2-24 178913]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [2010-10-8 17792]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-1 136176]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-8-19 352920]
S3 AVerBDA3x;AVerMedia SAA713x BDA Service;c:\windows\system32\drivers\AVerBDA3x.sys [2007-8-29 1183744]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo uninstaller 4\dfsdks.exe --> c:\program files\ashampoo\ashampoo uninstaller 4\DfSdkS.exe [?]
S3 etdrv;etdrv;c:\windows\etdrv.sys [2010-11-4 17488]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\common files\futuremark shared\futuremark systeminfo\FMSISvc.exe [2011-1-5 129440]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2010-11-4 24944]
S3 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2011-1-19 312152]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 14856]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2010-4-10 266544]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2009-7-14 20992]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-10-8 27192]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2010-3-11 25088]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
S3 vpcuxd;USB Virtualization Stub Service;c:\windows\system32\drivers\vpcuxd.sys [2011-1-6 12800]
S3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-6 1343400]
S3 wxpSvc;webcamXP Service;c:\program files\wlite\wService.exe [2010-5-2 5027328]
S4 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2010-3-25 490280]
S4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2009-12-18 1044808]
=============== Created Last 30 ================
2011-02-07 14:09:02 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-02-07 14:08:47 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2011-02-07 14:08:45 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-02-07 13:54:07 -------- d-----w- c:\users\jirka\appdata\local\{BEB69B3D-5833-4825-93D7-235E9D519EA3}
2011-02-07 13:53:53 -------- d-----w- c:\users\jirka\appdata\roaming\Windows Live Writer
2011-02-07 13:53:53 -------- d-----w- c:\users\jirka\appdata\local\Windows Live Writer
2011-02-07 13:53:03 -------- d-----w- c:\windows\en
2011-02-07 13:52:16 -------- d-----w- c:\windows\cs
2011-02-07 12:43:19 -------- d-----w- c:\users\jirka\appdata\local\Apple
2011-02-06 01:31:12 -------- d-----w- c:\users\jirka\appdata\local\Adobe
2011-02-05 09:16:02 -------- d-----w- c:\users\jirka\appdata\local\Secunia PSI
2011-02-05 09:15:55 -------- d-----w- c:\program files\Secunia
2011-02-05 00:07:58 -------- d-sh--r- C:\bootwiz
2011-02-04 23:35:08 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{5b7cf2f4-de89-4164-b227-0c06de577648}\mpengine.dll
2011-02-03 14:01:57 -------- d-----w- c:\program files\NirSoft
2011-02-03 11:30:04 475648 ----a-w- c:\windows\system32\MyDefragScreenSaver_v4.3.1.scr
2011-02-03 11:30:04 1061888 ----a-w- c:\windows\system32\MyDefragScreenSaver_v4.3.1.exe
2011-02-03 11:30:04 -------- d-----w- c:\program files\MyDefrag v4.3.1
2011-02-03 11:21:29 -------- d-----w- c:\users\jirka\appdata\roaming\Smart PC Solutions
2011-02-03 11:21:06 -------- d-----w- c:\program files\Smart PC Solutions
2011-02-03 08:48:17 -------- d-----w- c:\program files\AkelPad
2011-02-03 01:35:14 28496 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-02-03 01:35:14 15672 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-02-02 14:00:52 -------- d-----w- c:\users\jirka\appdata\roaming\Xilisoft
2011-02-02 13:59:12 -------- d-----w- c:\program files\Xilisoft
2011-02-01 01:54:54 312320 ----a-w- c:\windows\system32\proppage.dll
2011-02-01 01:54:54 11264 ----a-w- c:\windows\system32\MMShellHook.dll
2011-02-01 01:54:53 655872 ----a-w- c:\windows\system32\msvcr90.dll
2011-02-01 01:54:53 -------- d-----w- c:\users\jirka\appdata\roaming\Media Control
2011-02-01 01:54:53 -------- d-----w- c:\program files\Media Control
2011-01-31 22:26:42 -------- d-----w- c:\program files\iTunes
2011-01-31 22:26:42 -------- d-----w- c:\program files\iPod
2011-01-31 22:25:27 -------- d-----w- c:\program files\Bonjour
2011-01-31 01:01:36 -------- d-----w- c:\users\jirka\appdata\roaming\VOS
2011-01-31 00:46:06 -------- d-----w- c:\windows\XSxS
2011-01-31 00:44:13 -------- d-----w- c:\users\jirka\appdata\local\Thinstall
2011-01-31 00:11:26 -------- d-----w- c:\users\jirka\appdata\local\Hardcoded Software
2011-01-31 00:11:15 -------- d-----w- c:\program files\Hardcoded Software
2011-01-28 05:44:37 -------- d-----w- c:\users\jirka\appdata\roaming\Stardock
2011-01-28 05:44:18 -------- d-----w- c:\users\jirka\appdata\local\PackageAware
2011-01-26 08:49:26 -------- d-----w- c:\program files\MSI Afterburner
2011-01-25 09:51:12 -------- d-----w- c:\windows\$regcmp$
2011-01-25 08:51:38 -------- d-----w- c:\progra~2\Martau
2011-01-25 08:51:36 -------- d-----w- c:\program files\Total Uninstall 5
2011-01-25 02:01:23 -------- d-----w- C:\Documents and Settings
2011-01-24 19:55:53 -------- d-----w- c:\users\jirka\appdata\roaming\2K Sports
2011-01-24 14:39:27 -------- d-----w- c:\progra~2\KONAMI
2011-01-24 14:29:10 -------- d-----w- c:\users\jirka\appdata\roaming\Mikogo
2011-01-24 13:02:27 -------- d-----w- c:\program files\MP3Gain
2011-01-24 11:37:42 888424 ----a-w- c:\windows\system32\nvdispco322050.dll
2011-01-24 11:37:42 813672 ----a-w- c:\windows\system32\nvgenco322030.dll
2011-01-24 11:37:42 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-01-24 11:37:42 4837480 ----a-w- c:\windows\system32\nvcuda.dll
2011-01-24 11:37:42 319080 ----a-w- c:\windows\system32\nvdecodemft.dll
2011-01-24 11:37:42 2912360 ----a-w- c:\windows\system32\nvcuvid.dll
2011-01-24 11:37:42 2666600 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-01-24 11:37:42 14899816 ----a-w- c:\windows\system32\nvoglv32.dll
2011-01-24 11:37:42 13019752 ----a-w- c:\windows\system32\nvcompiler.dll
2011-01-24 11:37:42 10084360 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-01-24 11:37:42 10023528 ----a-w- c:\windows\system32\nvd3dum.dll
2011-01-19 19:06:27 -------- d-----w- c:\users\jirka\appdata\roaming\UseNeXT
2011-01-19 19:06:17 -------- d-----w- c:\program files\UseNeXT
2011-01-19 19:05:14 -------- d-----w- c:\program files\Defraggler
2011-01-19 17:51:10 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-19 17:51:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-19 17:51:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-17 02:47:41 -------- d-----w- c:\program files\PhotoZoom Pro 4
2011-01-17 00:11:49 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 9
2011-01-11 20:41:59 169064 ----a-w- c:\windows\system32\everest_cpl.cpl
2011-01-11 20:39:03 -------- d-----w- c:\program files\Lavalys
2011-01-11 19:03:14 -------- d-----w- c:\program files\PC Connectivity Solution
2011-01-11 19:02:11 -------- d-----w- c:\progra~2\NokiaInstallerCache
2011-01-11 00:47:00 -------- d-----w- c:\users\jirka\appdata\roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-01-11 00:47:00 -------- d-----w- c:\users\jirka\appdata\roaming\Adobe Mini Bridge CS5
2011-01-10 22:32:50 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-01-10 22:32:50 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2011-01-10 22:32:11 -------- d-----w- c:\progra~2\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-01-10 17:46:09 -------- d-----w- c:\progra~2\Boss Media
2011-01-10 17:46:08 -------- d-----w- c:\users\jirka\appdata\local\Boss Media
2011-01-10 17:32:48 -------- d-----w- c:\users\jirka\appdata\local\IM
2011-01-10 17:32:36 -------- d-----w- c:\progra~2\IncrediMail
2011-01-10 17:32:36 -------- d-----w- c:\progra~2\IM
==================== Find3M ====================
2011-01-25 09:24:43 17488 ----a-w- c:\windows\gdrv.sys
2011-01-24 22:11:25 17488 ----a-w- c:\windows\etdrv.sys
2011-01-05 16:14:10 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2011-01-05 16:14:10 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2010-12-24 07:45:52 86016 ----a-w- c:\windows\system32\frapsvid.dll
2010-11-29 16:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 15:13:58 809560 ----a-r- c:\windows\system32\tmpE007.tmp
2010-11-10 01:54:18 49016 ----a-w- c:\windows\system32\sirenacm.dll
2010-11-10 01:28:46 301936 ----a-w- c:\windows\WLXPGSS.SCR
=================== ROOTKIT ====================
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600 Disk: WDC_WD6401AALS-00L3B2 rev.01.03B01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-4
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: >>UNKNOWN [0x8304A000]<< >>UNKNOWN [0x8D26D000]<< >>UNKNOWN [0x8D25C000]<< >>UNKNOWN [0x8C96B000]<< >>UNKNOWN [0x83013000]<< >>UNKNOWN [0x85D091F8]<<
_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }
1 ntkrnlpa!IofCallDriver[0x83086458] -> \Device\Harddisk0\DR0[0x86B98740]
\Driver\Disk[0x86B97DD8] -> IRP_MJ_CREATE -> 0x8D27139F
3 [0x8D27159E] -> ntkrnlpa!IofCallDriver[0x83086458] -> [0x86AA5400]
\Driver\ACPI[0x85D7C5F0] -> IRP_MJ_CREATE -> 0x8C9744AA
5 [0x8C9743B2] -> ntkrnlpa!IofCallDriver[0x83086458] -> \Device\Ide\IdeDeviceP2T0L0-2[0x86AA0908]
\Driver\atapi[0x86A91328] -> IRP_MJ_CREATE -> 0x85D091F8
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user != kernel MBR !!!
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
============= FINISH: 17:12:05,04 ===============
GMER
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-02-07 18:01:31
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD6401AALS-00L3B2 rev.01.03B01
Running: aagmer.exe; Driver: C:\Users\Jirka\AppData\Local\Temp\uwlcypow.sys
---- System - GMER 1.0.15 ----
SSDT 930585E3 ZwLoadDriver
SSDT 930585E8 ZwSetSystemInformation
SSDT 930585A7 ZwTerminateProcess
SSDT 930585A2 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 8308D599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 830B1F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 45C 830B996C 4 Bytes [E3, 85, 05, 93]
.text ntkrnlpa.exe!RtlSidHashLookup + 768 830B9C78 4 Bytes CALL D89EA202
.text ntkrnlpa.exe!RtlSidHashLookup + 7B8 830B9CC8 4 Bytes [A7, 85, 05, 93]
.text ntkrnlpa.exe!RtlSidHashLookup + 82C 830B9D3C 4 Bytes [A2, 85, 05, 93]
? System32\Drivers\sppi.sys Systém nemůže nalézt uvedenou cestu. !
.text USBPORT.SYS!DllUnload 9202BCA0 5 Bytes JMP 85D494E0
? C:\Users\Jirka\AppData\Local\Temp\ALSysIO.sys Systém nemůže nalézt uvedený soubor. !
? C:\Users\Jirka\AppData\Local\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8C84B042] \SystemRoot\System32\Drivers\sppi.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8C84B6D6] \SystemRoot\System32\Drivers\sppi.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8C84B800] \SystemRoot\System32\Drivers\sppi.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8C84B13E] \SystemRoot\System32\Drivers\sppi.sys
---- Devices - GMER 1.0.15 ----
Device 85D0B1F8
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
AttachedDevice tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \Driver\USBSTOR \Device\0000008f 87C84500
Device \Driver\NetBT \Device\NetBT_Tcpip_{92C1CD9A-9950-4160-AF99-0BCEDA1F4CA2} 86FDF1F8
Device \Driver\volmgr \Device\VolMgrControl 85D071F8
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd507276
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd507276@001d6ec30d29 0x70 0xA3 0xAF 0x2C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd507276@727f8b7a6601 0x44 0x80 0xAB 0xF5 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x54 0x09 0x4A 0xF4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x0E 0xD3 0x76 0x68 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x5E 0xC6 0x01 0x86 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xE7 0x11 0x32 0x52 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd507276 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd507276@001d6ec30d29 0x70 0xA3 0xAF 0x2C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd507276@727f8b7a6601 0x44 0x80 0xAB 0xF5 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x54 0x09 0x4A 0xF4 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x0E 0xD3 0x76 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x5E 0xC6 0x01 0x86 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xE7 0x11 0x32 0x52 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG12.00.00.01PROFESSIONAL 1668278146EC968E9FB81A89827C6E051A364E755F497832D83F32746AEB372C37E227AECE6E692BB90622DC1E711265010EA2616E67587688227A87BCD7325B33755DBCA4B362FEB12C46666F41C25233C22DC0E50E64F4DE920E59FE7975762C5CB509D0450898FE67FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808FEBC9E127BECC74CA2D97226D213B555A9C6AECB7A5D1407A224EF4BB2AFFE5CCCE395D9872A2BFA2E0A2ABDCD1BE8926FC9A087064BEED281C69F029E1549BCF29DF8C529B2F8419375705F6A18E46E6C9E5906B6D81C3000C879E11BA8E219DFC5C4E56163964A14D8E430D226DA594C1D11075D7C1ED16376B8D8F998E5C6B80F795A6C20F1EB52F36AA25004ADC7CCAF306E72EB6CF02800EB5C7F35FEDDD515EA47FE720FBE20693BACA314D475DE2076A4E28514887AF9F4E364F26EB840D341D6BC8A0221883F62477E5E5B5F2A9E73910D4836D5BFDC8BE9D56B8AF939ADF735C1B87633C65EC270088C60C8063D8EA4C75704DC0C053AEDF55B3E84B466DD921BF22A5A4C978FAA5BED973602F301D1D77B49E62B3360F4D8230401582A97A44AD36F40BC9CD37808F548F35E9ED88E7B20E07B1B8B2F8688C86DDA81849C2245182C51F002696790BACD0E10FC7655E1553A6D0E17AF2D7FF
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL E73102CDA5DB6C955E717EA52E887A53723EC0B68540A1EA9C2CF72AF920DE69AA6D49DF0C47F70AB9CE61A9B4F423D04F789D5944FCAE08770D439A4802BD02F7904520088D1FA9941F9A1F8EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B555A6171C11EC38DE3DC038D530D6EB3452767FA4857FD1956491C32F96978F8BB0E5CC7085DB10B57E2A3743AFF7FB136270E04ED40092F1D037391EDAAA7C6C2DC69785A0583A355EE234545A6A90357E4E1E5F8CEC14721496CDCA0991C2D559B7453A847324B11B8D383E34B2039C210FD31807DCB42326E382D563256E4169C455AD7B6BAA2FC1A867B7AE1623FE4C4666717E3AD205A4699C920E96101CB20A8CAF34D5B02B01C6A5B0232E4304A89D7D9495C5528ED0032208926ABB4A2EBA75C3419C9B932A119D494C6AB947835183614F8F99A78DA2E072DEF58B9F7B1DDCA41A7CD34CB5C03ED84989E0D9CAB1A7691400962D664E6740C4E79A67DA0C53BC9604C7ABBEA639671DA498BE14A25E723150B671861F8B95783E0B5F33F42EAE771AE87C03248432AF24C2ED969CDCF8D512EEB6BFC1644B944D01B98DD9074C5DF62EFEE5B3592B4C44C5532DAA9EA8172536B986784E6A95BB241C19D1BA2050278FE36E5DB8F822198CD059EE636
---- EOF - GMER 1.0.15 ----
...po prvním dále ComboFix pracoval, po druhém už najely normálně Windows a bylo po akci..