Kontrola logu Vyřešeno

[marocasnocha]

Prosím o kontrolu logu
ComboFix 11-07-23.04 - Marek 24.07.2011 15:16:35.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4094.2774 [GMT 2:00]
Spuštěný z: c:\users\Marek\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-24 do 2011-07-24 )))))))))))))))))))))))))))))))
.
.
2011-07-24 22:35 . 2011-07-24 12:42 -------- d-----w- c:\windows\Panther
2011-07-24 22:35 . 2011-07-24 22:35 -------- d-----w- C:\Boot
2011-07-24 22:35 . 2011-07-24 22:35 -------- d-----w- c:\windows\system32\OEM
2011-07-24 13:19 . 2011-07-24 13:19 0 ----a-w- c:\windows\ativpsrm.bin
2011-07-24 13:18 . 2011-07-24 13:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-24 13:15 . 2011-07-24 13:15 -------- d-----w- C:\32788R22FWJFW
2011-07-24 13:06 . 2011-07-24 13:06 -------- d-----w- c:\program files\Common Files\ATI Technologies
2011-07-24 13:06 . 2009-09-30 14:34 121872 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2011-07-24 13:05 . 2009-10-02 03:39 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-07-24 13:05 . 2011-07-24 13:07 -------- d-----w- c:\program files (x86)\ATI Technologies
2011-07-24 13:04 . 2011-07-24 13:07 -------- d-sh--w- c:\windows\Installer
2011-07-24 13:04 . 2011-07-24 13:04 -------- d--h--w- c:\programdata\CanonBJ
2011-07-24 13:04 . 2008-02-25 18:00 82944 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9I.DLL
2011-07-24 13:04 . 2008-02-25 18:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9I.DLL
2011-07-24 13:04 . 2008-02-25 18:00 279040 ----a-w- c:\windows\system32\CNMLM9I.DLL
2011-07-24 13:03 . 2011-07-24 13:07 -------- d-----w- c:\program files\ATI Technologies
2011-07-24 13:03 . 2011-07-24 13:03 -------- d-----w- c:\program files\ATI
2011-07-24 13:01 . 2011-07-20 07:44 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B3B09A9-E40E-4991-BF19-6C1917BD0F93}\mpengine.dll
2011-07-24 13:01 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-07-24 12:57 . 2011-07-24 12:57 -------- d-----w- C:\rsit
2011-07-24 12:57 . 2011-07-24 12:57 -------- d-----w- c:\program files\trend micro
2011-07-24 12:47 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll
2011-07-24 12:47 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
2011-07-24 12:43 . 2011-07-24 12:43 -------- d-----w- c:\users\Marek
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-10-01 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - DXGKRNL
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001Core.job
- c:\users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-24 12:59]
.
2011-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001UA.job
- c:\users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-24 12:59]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 62.129.50.20 85.135.32.100
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Celkový čas: 2011-07-24 15:21:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-24 13:21
.
Před spuštěním: Volných bajtů: 982 745 649 152
Po spuštění: Volných bajtů: 982 618 198 016
.
- - End Of File - - 4663B630537031B9735AA43A87EB3A17

[Reklama]

[marocasnocha]

RSIT Log
Logfile of random's system information tool 1.09 (written by random/random)

Run by Marek at 2011-07-24 14:57:29
Microsoft Windows 7 Ultimate
System drive C: has 938 GB (98%) free of 954 GB
Total RAM: 4094 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:57:34, on 24.7.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\Marek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 4489 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:71937
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:6410
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:71955
C:\Windows\system32\sppsvc.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1918143655-1119562807-2491148442-10015_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1918143655-1119562807-2491148442-10015 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:203022
"C:\Users\Marek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z58C7P4U\RSITx64[1].exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-07-25 00:35:38 ----D---- C:\Windows\Panther
2011-07-25 00:35:26 ----RASH---- C:\BOOTSECT.BAK
2011-07-25 00:35:24 ----SHD---- C:\Boot
2011-07-25 00:35:07 ----D---- C:\Windows\system32\OEM
2011-07-24 14:57:29 ----D---- C:\rsit
2011-07-24 14:57:29 ----D---- C:\Program Files\trend micro
2011-07-24 14:47:17 ----A---- C:\Windows\SYSWOW64\cabview.dll
2011-07-24 14:47:17 ----A---- C:\Windows\system32\cabview.dll
2011-07-24 14:43:36 ----D---- C:\Users\Marek\AppData\Roaming\Identities
2011-07-24 14:43:19 ----SD---- C:\Users\Marek\AppData\Roaming\Microsoft
2011-07-24 14:43:19 ----D---- C:\Users\Marek\AppData\Roaming\Media Center Programs
2011-07-24 14:41:50 ----SHD---- C:\Recovery
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Šablony
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Plocha
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Oblíbené položky
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Nabídka Start
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Dokumenty
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Data aplikací
2011-07-24 14:39:06 ----D---- C:\Windows\SoftwareDistribution
2011-07-24 14:36:36 ----D---- C:\Windows\Prefetch
2011-07-24 14:36:21 ----ASH---- C:\pagefile.sys
2011-07-24 14:36:20 ----SHD---- C:\System Volume Information
2011-07-24 14:36:20 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 month======

2011-07-24 14:57:29 ----RD---- C:\Program Files
2011-07-24 14:53:06 ----D---- C:\Windows\system32\CodeIntegrity
2011-07-24 14:48:48 ----D---- C:\Windows\System32
2011-07-24 14:48:48 ----D---- C:\Windows\inf
2011-07-24 14:48:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-24 14:48:13 ----D---- C:\Windows\winsxs
2011-07-24 14:47:36 ----D---- C:\Windows\SysWOW64
2011-07-24 14:47:19 ----D---- C:\Windows\system32\restore
2011-07-24 14:47:14 ----D---- C:\Windows\system32\catroot
2011-07-24 14:46:43 ----D---- C:\Windows\Logs
2011-07-24 14:46:32 ----D---- C:\Windows\system32\config
2011-07-24 14:46:01 ----D---- C:\Windows\Microsoft.NET
2011-07-24 14:46:00 ----RSD---- C:\Windows\assembly
2011-07-24 14:44:45 ----D---- C:\Windows\system32\LogFiles
2011-07-24 14:43:33 ----SHD---- C:\$Recycle.Bin
2011-07-24 14:43:19 ----RD---- C:\Users
2011-07-24 14:42:31 ----D---- C:\Windows\Temp
2011-07-24 14:42:29 ----D---- C:\Windows\Setup
2011-07-24 14:42:08 ----D---- C:\Windows\rescache
2011-07-24 14:41:51 ----SD---- C:\ProgramData\Microsoft
2011-07-24 14:41:50 ----HD---- C:\ProgramData
2011-07-24 14:41:50 ----D---- C:\Program Files\Windows NT
2011-07-24 14:41:20 ----D---- C:\Windows\debug
2011-07-24 14:39:22 ----D---- C:\Windows\system32\sysprep
2011-07-24 14:39:16 ----D---- C:\Windows
2011-07-24 14:39:02 ----D---- C:\Windows\system32\drivers
2011-07-24 14:37:45 ----D---- C:\Windows\system32\catroot2
2011-07-24 14:36:56 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

[Žbeky]

Kdo ti poradil jako první použít CF?

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001UA.job

Folder::
C:\32788R22FWJFW

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=-

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[marocasnocha]

ComboFix 11-07-24.01 - Marek 24.07.2011 17:57:46.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.4094.2897 [GMT 2:00]
Spuštěný z: c:\users\Marek\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Marek\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\mazuki.dll
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1918143655-1119562807-2491148442-1001UA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-24 do 2011-07-24 )))))))))))))))))))))))))))))))
.
.
2011-07-24 22:35 . 2011-07-24 12:42 -------- d-----w- c:\windows\Panther
2011-07-24 22:35 . 2011-07-24 22:35 -------- d-----w- C:\Boot
2011-07-24 22:35 . 2011-07-24 22:35 -------- d-----w- c:\windows\system32\OEM
2011-07-24 15:59 . 2011-07-24 15:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-24 15:47 . 2011-07-24 15:47 -------- d-----w- c:\programdata\ATI
2011-07-24 14:31 . 2011-07-24 14:31 -------- d-----w- c:\programdata\NCH Swift Sound
2011-07-24 14:31 . 2011-07-24 14:31 -------- d-----w- c:\program files (x86)\NCH Swift Sound
2011-07-24 14:30 . 2011-07-24 14:30 -------- d-----w- c:\program files (x86)\AnvSoft
2011-07-24 14:28 . 2011-07-08 19:40 54552 ----a-w- c:\windows\system32\pxc40pm.dll
2011-07-24 14:27 . 2011-07-24 14:27 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2011-07-24 14:27 . 2011-07-24 14:27 -------- d-----w- c:\program files\Tracker Software
2011-07-24 14:27 . 2011-07-24 14:27 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-07-24 14:26 . 2011-07-24 14:26 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-07-24 14:26 . 2011-07-24 14:26 -------- d-----w- c:\program files (x86)\Java
2011-07-24 14:26 . 2011-07-24 14:26 -------- d-----w- c:\program files (x86)\The KMPlayer
2011-07-24 14:23 . 2011-07-24 14:23 -------- d-----w- c:\program files (x86)\IrfanView
2011-07-24 14:23 . 2011-07-24 14:23 -------- d-----w- c:\programdata\ashampoo
2011-07-24 14:22 . 2011-07-24 14:22 -------- d-----w- c:\program files (x86)\Ashampoo
2011-07-24 14:22 . 2011-07-24 14:22 -------- d-----w- c:\program files\CCleaner
2011-07-24 14:21 . 2011-07-24 14:21 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-07-24 14:21 . 2011-07-24 15:47 -------- d-----w- c:\program files (x86)\ICQ7.5
2011-07-24 14:04 . 2011-07-24 14:04 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-24 14:04 . 2011-07-24 14:04 -------- d-----w- c:\windows\SysWow64\Macromed
2011-07-24 13:41 . 2011-07-24 13:42 -------- d-----w- C:\totalcmd
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\UC.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\RAR.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\LHA.PIF
2011-07-24 13:41 . 2010-12-17 05:56 545 ----a-w- c:\windows\ARJ.PIF
2011-07-24 13:19 . 2011-07-24 13:19 0 ----a-w- c:\windows\ativpsrm.bin
2011-07-24 13:06 . 2011-07-24 13:06 -------- d-----w- c:\program files\Common Files\ATI Technologies
2011-07-24 13:06 . 2009-09-30 14:34 121872 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2011-07-24 13:05 . 2009-10-02 03:39 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-07-24 13:05 . 2011-07-24 13:07 -------- d-----w- c:\program files (x86)\ATI Technologies
2011-07-24 13:04 . 2011-07-24 14:27 -------- d-sh--w- c:\windows\Installer
2011-07-24 13:04 . 2011-07-24 13:04 -------- d--h--w- c:\programdata\CanonBJ
2011-07-24 13:04 . 2008-02-25 18:00 82944 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9I.DLL
2011-07-24 13:04 . 2008-02-25 18:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9I.DLL
2011-07-24 13:04 . 2008-02-25 18:00 279040 ----a-w- c:\windows\system32\CNMLM9I.DLL
2011-07-24 13:03 . 2011-07-24 13:07 -------- d-----w- c:\program files\ATI Technologies
2011-07-24 13:03 . 2011-07-24 13:03 -------- d-----w- c:\program files\ATI
2011-07-24 13:01 . 2011-07-20 07:44 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B3B09A9-E40E-4991-BF19-6C1917BD0F93}\mpengine.dll
2011-07-24 13:01 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-07-24 12:57 . 2011-07-24 12:57 -------- d-----w- C:\rsit
2011-07-24 12:57 . 2011-07-24 12:57 -------- d-----w- c:\program files\trend micro
2011-07-24 12:47 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll
2011-07-24 12:47 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
2011-07-24 12:43 . 2011-07-24 14:12 -------- d-----w- c:\users\Marek
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-24_13.19.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-07 02:08 . 2011-03-07 02:08 93552 c:\windows\SysWOW64\ElbyCDIO.dll
+ 2009-07-14 05:10 . 2011-07-24 15:49 14098 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-07-24 14:28 . 2011-07-08 19:40 18712 c:\windows\system32\spool\drivers\x64\3\PXC40UIf.DLL
+ 2011-07-24 14:28 . 2011-07-08 19:40 28440 c:\windows\system32\spool\drivers\x64\3\PXC40f.DLL
+ 2009-07-14 05:30 . 2011-07-24 14:28 86016 c:\windows\system32\DriverStore\infpub.dat
- 2009-07-14 05:30 . 2011-07-24 13:06 86016 c:\windows\system32\DriverStore\infpub.dat
+ 2011-01-15 16:21 . 2011-01-15 16:21 36352 c:\windows\system32\DriverStore\FileRepository\vclone.inf_amd64_neutral_90052917d000700d\Vista64\VClone.sys
+ 2011-01-15 16:21 . 2011-01-15 16:21 36352 c:\windows\system32\drivers\VClone.sys
+ 2010-12-16 22:58 . 2010-12-16 22:58 40816 c:\windows\system32\drivers\ElbyCDIO.sys
- 2011-07-24 12:40 . 2011-07-24 12:47 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-07-24 12:40 . 2011-07-24 15:48 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-07-24 12:40 . 2011-07-24 12:47 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-07-24 12:40 . 2011-07-24 15:48 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-07-24 12:47 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-07-24 15:48 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2011-07-24 15:49 73048 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-07-24 12:44 . 2011-07-24 16:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-07-24 12:44 . 2011-07-24 12:44 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-07-24 12:44 . 2011-07-24 12:44 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-07-24 12:44 . 2011-07-24 16:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-07-24 13:21 . 2011-07-24 15:49 4402 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2011-07-24 12:44 . 2011-07-24 15:49 2248 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1918143655-1119562807-2491148442-1001_UserData.bin
+ 2011-07-24 16:00 . 2011-07-24 16:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-07-24 13:19 . 2011-07-24 13:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-24 16:00 . 2011-07-24 16:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-24 14:04 . 2011-07-24 14:04 243360 c:\windows\SysWOW64\Macromed\Flash\FlashUtil10u_Plugin.exe
+ 2011-07-24 14:26 . 2011-07-24 14:26 157472 c:\windows\SysWOW64\javaws.exe
+ 2011-07-24 14:26 . 2011-07-24 14:26 145184 c:\windows\SysWOW64\javaw.exe
+ 2011-07-24 14:26 . 2011-07-24 14:26 145184 c:\windows\SysWOW64\java.exe
+ 2011-03-07 00:52 . 2011-03-07 00:52 134512 c:\windows\SysWOW64\ElbyVCD.dll
- 2009-07-14 02:36 . 2011-07-24 12:48 606992 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-07-24 15:53 606992 c:\windows\system32\perfh009.dat
+ 2009-07-26 18:41 . 2011-07-24 15:53 622422 c:\windows\system32\perfh005.dat
- 2009-07-26 18:41 . 2011-07-24 12:48 622422 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-07-24 12:48 103370 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-07-24 15:53 103370 c:\windows\system32\perfc009.dat
+ 2009-07-26 18:41 . 2011-07-24 15:53 118604 c:\windows\system32\perfc005.dat
- 2009-07-26 18:41 . 2011-07-24 12:48 118604 c:\windows\system32\perfc005.dat
+ 2009-07-14 05:30 . 2011-07-24 14:28 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-07-24 13:06 143360 c:\windows\system32\DriverStore\infstrng.dat
- 2009-07-14 05:30 . 2011-07-24 13:06 143360 c:\windows\system32\DriverStore\infstor.dat
+ 2009-07-14 05:30 . 2011-07-24 14:27 143360 c:\windows\system32\DriverStore\infstor.dat
- 2009-07-14 05:12 . 2011-07-24 12:44 245760 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-07-24 15:48 245760 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:01 . 2011-07-24 16:00 234392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2009-07-14 05:01 234392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-07-24 14:57 . 2011-07-24 16:00 234392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1918143655-1119562807-2491148442-1001-8192.dat
+ 2011-07-24 14:27 . 2011-07-24 14:27 207360 c:\windows\Installer\3dea2a.msi
+ 2011-07-24 14:04 . 2011-07-24 14:04 6271648 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
- 2009-07-14 02:34 . 2011-07-24 13:18 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-07-24 15:58 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 04:45 . 2011-07-24 15:48 3607991 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:45 . 2011-07-24 12:55 3607991 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-07-24 13:16 . 2011-07-24 15:57 9453568 c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT
- 2011-07-24 13:16 . 2011-07-24 13:16 9453568 c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT
+ 2011-07-24 14:26 . 2011-07-24 14:26 12857856 c:\windows\Installer\3dea24.msi
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files (x86)\ICQ7.5\ICQ.exe" [2011-07-24 124216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-10-01 98304]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
.
.
.
--------- x86-64 -----------
.
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 62.129.50.20 85.135.32.100
FF - ProfilePath - c:\users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\evr1vdj5.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Celkový čas: 2011-07-24 18:03:44 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-24 16:03
ComboFix2.txt 2011-07-24 13:21
.
Před spuštěním: Volných bajtů: 948 703 830 016
Po spuštění: Volných bajtů: 948 305 956 864
.
- - End Of File - - 471E31F1F0C0F466B3869EDA7B6A7CF4

[marocasnocha]

abyste tomu rozuměl na mém počítači byl dneska přeformatovaný disk a nainstalovany system, chci mít jistotu že už tam naprosto nic není včetně mbr sektoru. Měl jsem předtím infikovaný pc virem s facebooku.
Combofix mi nikdo neporadil. To se nemá?? Měl jsem jenom udělat RSIT Log??

[Žbeky]

CF se má dělat jen pod dozorem zkušeného rádce. A ne ho tam střelit jak kanonem na vrabce. Navíc na kontrolu mbr se používají úplně jiné programy

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+ Nový log z HJT

Jak se chová PC?

[marocasnocha]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Marek at 2011-07-24 20:23:46
Microsoft Windows 7 Ultimate
System drive C: has 904 GB (95%) free of 954 GB
Total RAM: 4094 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:23:47, on 24.7.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ICQ7.5\ICQ.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Marek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: PXCIEaddin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: PDFXChange 4.0 - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.5\ICQ.exe" silent loginmode=4
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5085 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"taskhost.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\Explorer.EXE
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\ICQ7.5\ICQ.exe" silent loginmode=4
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"taskhost.exe"
C:\Windows\system32\msiexec.exe /V
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=3196.066B3F58.1046423778 /prefetch:3
C:\Windows\system32\rundll32.exe "C:\Users\Marek\AppData\Local\Google\Chrome\APPLIC~1\120742~1.122\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Marek\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll" --lang=cs --channel=3196.0665C768.765702137 /prefetch:4 --flash-broker=2792
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=3196.066B43F0.694265600 /prefetch:3
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=3196.066B4D20.16894908 /prefetch:3
"C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --disable-client-side-phishing-detection --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_0/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SSLFalseStart/FalseStart_disabled/SpdyCwnd/cwndDynamic/SpdyImpact/npn_with_spdy/ --channel=3196.066B40E0.419146427 /prefetch:3
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe11_ Global\UsGthrCtrlFltPipeMssGthrPipe11 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:\Users\Marek\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\evr1vdj5.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
npPDFXCviewNPPlugin.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{42DFA04F-0F16-418e-B80C-AB97A5AFAD39}]
PDFXChange 4.0 - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll [2011-07-08 420632]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-07-24 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - PDFXChange 4.0 - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll [2011-07-08 420632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Program Files (x86)\ICQ7.5\ICQ.exe [2011-07-24 124216]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-10-01 98304]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"VirtualCloneDrive"=C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2011-03-07 89456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 290304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-07-25 00:35:38 ----D---- C:\Windows\Panther
2011-07-25 00:35:26 ----RASH---- C:\BOOTSECT.BAK
2011-07-25 00:35:24 ----D---- C:\Boot
2011-07-25 00:35:07 ----D---- C:\Windows\system32\OEM
2011-07-24 20:23:46 ----D---- C:\rsit
2011-07-24 20:16:14 ----D---- C:\Program Files (x86)\Trend Micro
2011-07-24 18:03:46 ----D---- C:\Windows\temp
2011-07-24 18:03:45 ----A---- C:\ComboFix.txt
2011-07-24 18:01:12 ----D---- C:\$RECYCLE.BIN
2011-07-24 17:47:58 ----D---- C:\Users\Marek\AppData\Roaming\ATI
2011-07-24 17:47:58 ----D---- C:\ProgramData\ATI
2011-07-24 16:31:39 ----D---- C:\Users\Marek\AppData\Roaming\NCH Swift Sound
2011-07-24 16:31:39 ----D---- C:\ProgramData\NCH Swift Sound
2011-07-24 16:31:37 ----D---- C:\Program Files (x86)\NCH Swift Sound
2011-07-24 16:31:23 ----AD---- C:\ProgramData\TEMP
2011-07-24 16:31:03 ----D---- C:\Users\Marek\AppData\Roaming\AnvSoft
2011-07-24 16:30:56 ----D---- C:\Program Files (x86)\AnvSoft
2011-07-24 16:28:00 ----A---- C:\Windows\system32\pxc40pm.dll
2011-07-24 16:27:47 ----D---- C:\Users\Marek\AppData\Roaming\WinRAR
2011-07-24 16:27:45 ----D---- C:\Program Files (x86)\WinRAR
2011-07-24 16:27:36 ----D---- C:\Program Files (x86)\Elaborate Bytes
2011-07-24 16:27:17 ----D---- C:\Program Files\Tracker Software
2011-07-24 16:27:15 ----D---- C:\ProgramData\Sun
2011-07-24 16:26:56 ----A---- C:\Windows\SYSWOW64\javaws.exe
2011-07-24 16:26:56 ----A---- C:\Windows\SYSWOW64\javaw.exe
2011-07-24 16:26:56 ----A---- C:\Windows\SYSWOW64\java.exe
2011-07-24 16:26:56 ----A---- C:\Windows\SYSWOW64\deployJava1.dll
2011-07-24 16:26:45 ----D---- C:\Program Files (x86)\Java
2011-07-24 16:26:14 ----D---- C:\Program Files (x86)\The KMPlayer
2011-07-24 16:23:49 ----D---- C:\Users\Marek\AppData\Roaming\Ashampoo
2011-07-24 16:23:20 ----D---- C:\Users\Marek\AppData\Roaming\IrfanView
2011-07-24 16:23:20 ----D---- C:\Program Files (x86)\IrfanView
2011-07-24 16:23:16 ----D---- C:\ProgramData\ashampoo
2011-07-24 16:22:59 ----D---- C:\Program Files (x86)\Ashampoo
2011-07-24 16:22:42 ----D---- C:\Program Files\CCleaner
2011-07-24 16:21:21 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-07-24 16:21:13 ----D---- C:\Users\Marek\AppData\Roaming\ICQ
2011-07-24 16:21:10 ----D---- C:\Program Files (x86)\ICQ7.5
2011-07-24 16:04:14 ----D---- C:\Windows\SYSWOW64\Macromed
2011-07-24 15:41:58 ----D---- C:\Users\Marek\AppData\Roaming\GHISLER
2011-07-24 15:41:58 ----D---- C:\totalcmd
2011-07-24 15:41:58 ----A---- C:\Windows\UC.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\RAR.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\PKZIP.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\PKUNZIP.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\NOCLOSE.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\LHA.PIF
2011-07-24 15:41:58 ----A---- C:\Windows\ARJ.PIF
2011-07-24 15:40:23 ----D---- C:\Users\Marek\AppData\Roaming\Mozilla
2011-07-24 15:40:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-07-24 15:16:03 ----A---- C:\Windows\zip.exe
2011-07-24 15:16:03 ----A---- C:\Windows\SWSC.exe
2011-07-24 15:16:03 ----A---- C:\Windows\SWREG.exe
2011-07-24 15:16:03 ----A---- C:\Windows\sed.exe
2011-07-24 15:16:03 ----A---- C:\Windows\PEV.exe
2011-07-24 15:16:03 ----A---- C:\Windows\NIRCMD.exe
2011-07-24 15:16:03 ----A---- C:\Windows\MBR.exe
2011-07-24 15:16:03 ----A---- C:\Windows\grep.exe
2011-07-24 15:15:59 ----D---- C:\Windows\ERDNT
2011-07-24 15:06:14 ----D---- C:\Program Files\Common Files\ATI Technologies
2011-07-24 15:06:05 ----A---- C:\Windows\system32\drivers\AtiHdmi.sys
2011-07-24 15:05:57 ----A---- C:\Windows\system32\ATIDEMGX.dll
2011-07-24 15:05:43 ----D---- C:\Users\Marek\AppData\Roaming\Macromedia
2011-07-24 15:05:43 ----D---- C:\Users\Marek\AppData\Roaming\Adobe
2011-07-24 15:05:22 ----D---- C:\Program Files (x86)\ATI Technologies
2011-07-24 15:04:56 ----SHD---- C:\Windows\Installer
2011-07-24 15:04:38 ----HD---- C:\ProgramData\CanonBJ
2011-07-24 15:04:26 ----A---- C:\Windows\system32\CNMLM9I.DLL
2011-07-24 15:03:55 ----D---- C:\Program Files\ATI Technologies
2011-07-24 15:03:54 ----D---- C:\Program Files\ATI
2011-07-24 15:01:38 ----N---- C:\Windows\system32\MpSigStub.exe
2011-07-24 14:57:29 ----D---- C:\Program Files\trend micro
2011-07-24 14:47:17 ----A---- C:\Windows\SYSWOW64\cabview.dll
2011-07-24 14:47:17 ----A---- C:\Windows\system32\cabview.dll
2011-07-24 14:43:36 ----D---- C:\Users\Marek\AppData\Roaming\Identities
2011-07-24 14:43:19 ----SD---- C:\Users\Marek\AppData\Roaming\Microsoft
2011-07-24 14:43:19 ----D---- C:\Users\Marek\AppData\Roaming\Media Center Programs
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Šablony
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Plocha
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Oblíbené položky
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Nabídka Start
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Dokumenty
2011-07-24 14:41:50 ----SHD---- C:\ProgramData\Data aplikací
2011-07-24 14:41:50 ----D---- C:\Recovery
2011-07-24 14:39:06 ----D---- C:\Windows\SoftwareDistribution
2011-07-24 14:36:36 ----D---- C:\Windows\Prefetch
2011-07-24 14:36:21 ----ASH---- C:\pagefile.sys
2011-07-24 14:36:20 ----SHD---- C:\System Volume Information
2011-07-24 14:36:20 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 month======

2011-07-24 20:18:02 ----D---- C:\Windows\debug
2011-07-24 20:18:02 ----D---- C:\Windows
2011-07-24 20:16:14 ----RD---- C:\Program Files (x86)
2011-07-24 18:37:30 ----D---- C:\Windows\Microsoft.NET
2011-07-24 18:22:02 ----D---- C:\Windows\system32\config
2011-07-24 18:21:54 ----D---- C:\Windows\winsxs
2011-07-24 18:21:45 ----D---- C:\Windows\system32\catroot2
2011-07-24 18:21:45 ----D---- C:\Windows\system32\catroot
2011-07-24 18:05:36 ----D---- C:\Windows\System32
2011-07-24 18:05:36 ----D---- C:\Windows\inf
2011-07-24 18:05:36 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-07-24 18:03:47 ----D---- C:\Windows\system32\drivers
2011-07-24 18:01:13 ----A---- C:\Windows\system.ini
2011-07-24 18:01:08 ----D---- C:\Windows\system32\drivers\etc
2011-07-24 17:59:43 ----D---- C:\Windows\Tasks
2011-07-24 17:59:42 ----D---- C:\ProgramData
2011-07-24 17:58:54 ----D---- C:\Windows\SYSWOW64\drivers
2011-07-24 17:58:54 ----D---- C:\Windows\SysWOW64
2011-07-24 17:58:54 ----D---- C:\Windows\AppPatch
2011-07-24 17:58:53 ----D---- C:\Program Files\Common Files
2011-07-24 17:58:53 ----D---- C:\Program Files (x86)\Common Files
2011-07-24 16:31:39 ----D---- C:\Windows\system32\Tasks
2011-07-24 16:27:57 ----D---- C:\Windows\system32\DriverStore
2011-07-24 16:27:17 ----RD---- C:\Program Files
2011-07-24 15:21:06 ----D---- C:\Windows\system32\wdi
2011-07-24 15:07:36 ----RSD---- C:\Windows\assembly
2011-07-24 15:02:20 ----RSD---- C:\Windows\Media
2011-07-24 15:02:19 ----D---- C:\Windows\twain_32
2011-07-24 14:53:06 ----D---- C:\Windows\system32\CodeIntegrity
2011-07-24 14:47:19 ----D---- C:\Windows\system32\restore
2011-07-24 14:46:43 ----D---- C:\Windows\Logs
2011-07-24 14:44:45 ----D---- C:\Windows\system32\LogFiles
2011-07-24 14:43:19 ----RD---- C:\Users
2011-07-24 14:42:29 ----D---- C:\Windows\Setup
2011-07-24 14:42:08 ----D---- C:\Windows\rescache
2011-07-24 14:41:51 ----SD---- C:\ProgramData\Microsoft
2011-07-24 14:41:50 ----D---- C:\Program Files\Windows NT
2011-07-24 14:39:22 ----D---- C:\Windows\system32\sysprep
2011-07-24 14:36:56 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2010-12-17 40816]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2009-09-30 121872]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-10-02 6182400]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2011-01-15 36352]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-10-02 202752]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

[Žbeky]

V HJT fixni:

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

Jak se chová ten počítač?

[marocasnocha]

chová se že je všechno v pořádku, facebook jsem si už i více zabezpečil, chodí mi na email odkud se přihlašuje na facebook, změnil jsem si heslo a samozdřejmě používám protokol https

[marocasnocha]

takže už to je v pořádku nebo máš ještě něco udělat aby tam opravdu nic nebylo žádný vir

[Žbeky]

V lozích už nejde vidět nic. Takže pokud nemáš problémy, dej vyřešeno