Prosím o kontrolu HJT logu; už podruhé mi spadl Avast Vyřešeno

[jaro3]

Soubory srsvc.dll stále neexistují, pouze srvsvc.dll-- asi si nerozumíme , měl si stáhnout zde nový files:
http://www.edisk.cz/stahni/55887/files.rar_92.29KB.html
tam jsem opravil a vložil jsem správný soubor srsvc.dll , ten vyjmi a vlož do C:\

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
FCOPY::
C:\srsvc.dll | c:\windows\system32\dllcache\srsvc.dll
C:\srsvc.dll | c:\windows\System32\srsvc.dll

File::
c:\windows\system32\drivers\etc\hosts.tmp
c:\windows\Tasks\AdobeAAMUpdater-1.0-MRCHNA-Administrator.job

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.


Nedal si na VT ani ten soubor C:\WINDOWS\system32\regsvc.dll
takže:

dej na virustotal po tom scriptu:
c:\windows\System32\srsvc.dll
C:\WINDOWS\system32\regsvc.dll

[Reklama]

[Myloš]

srsvc.dll neexistuje
regsvc.dll je bez chyby: http://www.virustotal.com/file-scan/rep ... 1315334572

Log z Combofixu po akci:

ComboFix 11-09-06.03 - Administrator 06.09.2011 20:25:03.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1510 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\system32\drivers\etc\hosts.tmp"
"c:\windows\Tasks\AdobeAAMUpdater-1.0-MRCHNA-Administrator.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.tmp
c:\windows\Tasks\AdobeAAMUpdater-1.0-MRCHNA-Administrator.job
.
c:\windows\system32\srsvc.dll . . . je infikován!!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-06 do 2011-09-06 )))))))))))))))))))))))))))))))
.
.
2011-09-04 19:54 . 2011-09-04 19:54 -------- d-----w- C:\files
2011-09-04 10:28 . 2011-02-12 09:06 99840 ----a-w- C:\srvsvc.dll
2011-09-04 10:28 . 2008-04-14 05:51 59904 ------w- C:\regsvc.dll
2011-09-04 10:28 . 2008-04-14 05:51 59904 ----a-w- c:\windows\system32\regsvc.dll
2011-09-04 10:27 . 2008-04-14 05:51 59904 -c--a-w- c:\windows\system32\dllcache\regsvc.dll
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-09-01 15:44 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-01 15:44 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-01 15:39 . 2011-09-01 15:39 9466208 ----a-w- C:\mbam-setup-1.51.1.1800.exe
2011-09-01 15:39 . 2011-09-01 15:39 50688 ----a-w- C:\ATF-Cleaner.exe
2011-09-01 15:38 . 2011-09-01 15:38 -------- d-----w- C:\backups
2011-08-31 22:08 . 2011-09-05 19:16 388608 ----a-w- C:\HijackThis.exe
2011-08-31 20:16 . 2011-08-31 20:16 -------- d-----we c:\program files\Opera
2011-08-31 20:15 . 2011-08-31 20:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Opera
2011-08-27 10:23 . 2011-02-13 07:21 -------- d-----w- c:\documents and settings\Odstraneni_diakritiky
2011-08-24 15:17 . 2011-08-24 16:48 -------- d-----w- c:\program files\nLite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2008-04-14 06:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-08-21 02:33 . 2011-05-15 19:59 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2008-04-13 22:47 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 17:24 . 2011-07-08 17:24 144665 ----a-w- C:\asdsdasdasdsadsad.zip
2011-07-08 17:15 . 2011-07-08 17:15 144665 ----a-w- C:\BlockOut.zip
2011-07-08 14:02 . 2008-04-13 22:27 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-04 11:43 . 2011-02-10 00:18 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-02-10 00:18 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-02-23 20:06 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-02-10 00:18 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-02-10 00:18 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2011-02-10 00:18 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2011-02-10 00:18 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2011-02-10 00:18 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-02-10 00:18 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2011-02-10 00:18 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-24 14:10 . 2011-02-09 23:14 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2008-04-14 06:52 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2008-04-14 06:52 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:31 . 2008-04-14 06:51 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2008-04-14 05:50 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 06:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-01-15 12:59 . 2011-02-11 20:32 728275 ----a-w- c:\program files\Hotkey_Resolution_Changer_1.exe
2006-05-18 20:04 . 2011-02-13 07:29 175616 ----a-w- c:\program files\RemDiak.exe
2000-10-16 14:30 . 2011-02-13 07:29 217088 ----a-w- c:\program files\SpaceMonger.exe
2011-09-01 06:30 . 2011-03-22 19:55 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-02-09 . 4F0777D4A6A6D987BA87FBFE26BAFAB8 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-09-02_15.02.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-06 18:33 . 2011-09-06 18:33 16384 c:\windows\temp\Perflib_Perfdata_85c.dat
+ 2008-04-14 06:52 . 2011-02-12 09:06 99840 c:\windows\system32\dllcache\srvsvc.dll
- 2008-04-14 06:52 . 2010-08-27 05:54 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2008-04-14 06:51 . 2011-09-03 10:17 602112 c:\windows\system32\dllcache\crypt32.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 602112 c:\windows\system32\dllcache\crypt32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]
@="{0A479751-02BC-11d3-A855-0004AC2568AA}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]
2010-11-21 21:00 309448 ----a-w- c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]
@="{0A479751-02BC-11d3-A855-0004AC2568DD}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]
2010-11-21 21:00 309448 ----a-w- c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\eraser.exe" [2009-12-16 337808]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-03-24 409320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-06-03 446635]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-09-25 106496]
"ApacheMonitor.exe"="c:\program files\PHP Home Edition 2\Apache2\bin\ApacheMonitor.exe" [2004-06-29 41042]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"CNAP2 Launcher"="c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE" [2009-04-22 116128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 86016]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
procexp.lnk - c:\program files\ProcessExplorer\procexp.exe [2011-2-10 4177272]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2011-2-12 155648]
VirtuaWin.lnk - c:\program files\VirtuaWin\VirtuaWin.exe [2011-2-13 145408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Synchronizer]
2011-06-06 10:55 1240992 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2011-02-13 11:20 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-07-22 21:10 402432 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 00:00 28672 ----a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-02-27 12:03 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Sendik\\Sendik.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [23.2.2011 22:06 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.2.2011 2:18 309848]
R2 ABBYY.Licensing.FineReader.Home.10.0;ABBYY FineReader 10 HE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\Home\NetworkLicenseServer.exe [21.7.2010 18:30 814344]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.2.2011 2:18 19544]
R2 PDRJNDL;PDRJNDL;m:\software\System_a_utility\!_Hesla_a_soukromi_vcetne_spywaru\dekart-privatni_disk__free--eng\nainstalovany\pdrjndl.sys [8.2.2011 18:05 16512]
R2 PRVDISK;PRVDISK;m:\software\System_a_utility\!_Hesla_a_soukromi_vcetne_spywaru\dekart-privatni_disk__free--eng\nainstalovany\prvdisk.sys [8.2.2011 18:05 14080]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [25.9.2009 23:57 56576]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [25.9.2009 23:57 138240]
R3 OA002Afx;Provides a software interface to control audio effects of OA002 camera.;c:\windows\system32\drivers\OA002Afx.sys [8.6.2007 10:00 148056]
R3 OA002Ufd;Creative Camera OA002 Upper Filter Driver;c:\windows\system32\drivers\OA002Ufd.sys [3.6.2008 18:30 144672]
R3 OA002Vid;Creative Camera OA002 Function Driver;c:\windows\system32\drivers\OA002Vid.sys [1.8.2008 10:01 268672]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 14:16 130384]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [22.6.2011 19:23 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [22.6.2011 19:23 8456]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 14:37 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 14:16 753504]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-04-16 10:07 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-06 c:\windows\Tasks\LightScribeControlPanel.job
- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe [2011-04-16 10:09]
.
.
------- Doplňkový sken -------
.
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\y5u8ni4j.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-06 20:34
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: NVIDIA__ rev. -> Harddisk0\DR0 -> \Device\0000006f
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
error: Read Parametr není správný.
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/PROGRA~1/PHPHOM~1/mysql/bin/mysqld-nt.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/PROGRA~1/PHPHOM~1/mysql/bin/mysqld-nt.exe"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-220523388-1409082233-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f0,35,ce,5a,2e,6a,76,4a,9d,1e,82,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f0,35,ce,5a,2e,6a,76,4a,9d,1e,82,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(280)
c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\VirtuaWin\modules\WinList.exe
c:\program files\PHP Home Edition 2\Apache2\bin\Apache.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE
c:\windows\system32\crypserv.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
c:\windows\system32\DVDRAMSV.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\PHP Home Edition 2\Apache2\bin\Apache.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-09-06 20:40:25 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-06 18:40
ComboFix2.txt 2011-09-05 19:05
ComboFix3.txt 2011-09-04 16:46
ComboFix4.txt 2011-09-04 10:49
ComboFix5.txt 2011-09-06 18:24
.
Před spuštěním: Volných bajtů: 58 333 421 568
Po spuštění: Volných bajtů: 58 322 944 000
.
- - End Of File - - C81F1C92708B9921EC34AEFFE9F30154

[Myloš]

A nový log z HJT:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:44:59, on 6.9.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe
C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files\PHP Home Edition 2\Apache2\bin\ApacheMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\ProcessExplorer\procexp.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\VirtuaWin\VirtuaWin.exe
C:\Program Files\VirtuaWin\modules\WinList.exe
C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\Home\NetworkLicenseServer.exe
C:\Program Files\PHP Home Edition 2\Apache2\bin\Apache.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PHP Home Edition 2\Apache2\bin\Apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
c:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [ApacheMonitor.exe] C:\Program Files\PHP Home Edition 2\Apache2\bin\ApacheMonitor.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [CNAP2 Launcher] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - Startup: procexp.lnk = C:\Program Files\ProcessExplorer\procexp.exe
O4 - Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Startup: VirtuaWin.lnk = C:\Program Files\VirtuaWin\VirtuaWin.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7435870203
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 10 HE Licensing Service (ABBYY.Licensing.FineReader.Home.10.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\Home\NetworkLicenseServer.exe
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\PHP Home Edition 2\Apache2\bin\Apache.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySql - Unknown owner - C:/PROGRA~1/PHPHOM~1/mysql/bin/mysqld-nt.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 6941 bytes

[jaro3]

http://www.edisk.cz/stahni/55887/files.rar_92.29KB.html

Teď jsem si to stáhnul a ve složce files jsou dva soubory:
regsvc.dll
srsvc.dll

Možná si stáhnul jen ten první rar, kde to bylo špatně.....ten druhý , pokud stahuješ do stejného místa , tak musíš přepsat původní.....

Zkontroluj si to!!
Vlož ho (srsvc.dll) do C:\ a udělej script znovu .

nejprve:
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide-----nemusí být spustěn , ale zaleží na Tobě

O4 - Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe-----nemusí být spustěn , ale zaleží na Tobě



Nevím , jak to lepší napsat..

[Myloš]

Nene, stáhnul jsem ten poslední, obsahující oba soubory, adresář s původními jsem přepsal, takže jak soubor files.rar, tak i adresář c:\files\ opravdu obsahuje oba soubory – regsvc.dll i srsvc.dll, ale srsvc.dll v adresáři c:\WINDOWS\system32\ opravdu stále není.

[jaro3]

c:\windows\system32\srsvc.dll . . . je infikován!!-----to píše Combofix , takže tam je , ale skrytý a infikovaný,. tím scriptem se přepíše a současně se vloží i náhrada do dllcache.....

ten soubor vlož jen do adresáře C:\ , tedy bude zde:
C:\srsvc.dll o ostatní se postará Combofix , který tento soubor vloží jak do :
c:\windows\System32
tak i do:
c:\windows\system32\dllcache

script:

Kód: Vybrat vše

KillAll::
FCOPY::
C:\srsvc.dll | c:\windows\system32\dllcache\srsvc.dll
C:\srsvc.dll | c:\windows\System32\srsvc.dll

[Myloš]

Jak tam může být, když mám zapnuté zobrazování skrytých a systémových souborů?
Ale zkusím to – jdu na to.

[Myloš]

Tak je to tu.
Jen zpětně koukám – zapomněl jsem v HJT fixnout toto:
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

ComboFix 11-09-06.03 - Administrator 06.09.2011 23:32:08.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1482 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\srsvc.dll --> c:\windows\system32\dllcache\srsvc.dll
c:\srsvc.dll --> c:\windows\System32\srsvc.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-06 do 2011-09-06 )))))))))))))))))))))))))))))))
.
.
2011-09-06 21:32 . 2008-04-14 05:52 171008 -c--a-w- c:\windows\system32\dllcache\srsvc.dll
2011-09-06 21:32 . 2008-04-14 05:52 171008 ----a-w- c:\windows\system32\srsvc.dll
2011-09-06 21:01 . 2008-04-14 05:52 171008 ------w- C:\srsvc.dll
2011-09-04 19:54 . 2011-09-06 21:00 -------- d-----w- C:\files
2011-09-04 10:28 . 2011-02-12 09:06 99840 ----a-w- C:\srvsvc.dll
2011-09-04 10:28 . 2008-04-14 05:51 59904 ----a-w- C:\regsvc.dll
2011-09-04 10:28 . 2008-04-14 05:51 59904 ----a-w- c:\windows\system32\regsvc.dll
2011-09-04 10:27 . 2008-04-14 05:51 59904 -c--a-w- c:\windows\system32\dllcache\regsvc.dll
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-09-01 15:44 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-09-01 15:44 . 2011-09-01 15:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-01 15:44 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-01 15:39 . 2011-09-01 15:39 9466208 ----a-w- C:\mbam-setup-1.51.1.1800.exe
2011-09-01 15:39 . 2011-09-01 15:39 50688 ----a-w- C:\ATF-Cleaner.exe
2011-09-01 15:38 . 2011-09-01 15:38 -------- d-----w- C:\backups
2011-08-31 22:08 . 2011-09-05 19:16 388608 ----a-w- C:\HijackThis.exe
2011-08-31 20:16 . 2011-08-31 20:16 -------- d-----we c:\program files\Opera
2011-08-31 20:15 . 2011-08-31 20:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Opera
2011-08-27 10:23 . 2011-02-13 07:21 -------- d-----w- c:\documents and settings\Odstraneni_diakritiky
2011-08-24 15:17 . 2011-08-24 16:48 -------- d-----w- c:\program files\nLite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2008-04-14 06:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-08-21 02:33 . 2011-05-15 19:59 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2008-04-13 22:47 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 17:24 . 2011-07-08 17:24 144665 ----a-w- C:\asdsdasdasdsadsad.zip
2011-07-08 17:15 . 2011-07-08 17:15 144665 ----a-w- C:\BlockOut.zip
2011-07-08 14:02 . 2008-04-13 22:27 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-04 11:43 . 2011-02-10 00:18 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-02-10 00:18 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-02-23 20:06 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-02-10 00:18 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-02-10 00:18 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2011-02-10 00:18 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2011-02-10 00:18 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2011-02-10 00:18 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-02-10 00:18 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2011-02-10 00:18 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-24 14:10 . 2011-02-09 23:14 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2008-04-14 06:52 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2008-04-14 06:52 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:31 . 2008-04-14 06:51 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2008-04-14 05:50 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 06:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-01-15 12:59 . 2011-02-11 20:32 728275 ----a-w- c:\program files\Hotkey_Resolution_Changer_1.exe
2006-05-18 20:04 . 2011-02-13 07:29 175616 ----a-w- c:\program files\RemDiak.exe
2000-10-16 14:30 . 2011-02-13 07:29 217088 ----a-w- c:\program files\SpaceMonger.exe
2011-09-01 06:30 . 2011-03-22 19:55 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-02-09 . 4F0777D4A6A6D987BA87FBFE26BAFAB8 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-09-02_15.02.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-06 21:40 . 2011-09-06 21:40 16384 c:\windows\temp\Perflib_Perfdata_e8.dat
+ 2008-04-14 06:52 . 2011-02-12 09:06 99840 c:\windows\system32\dllcache\srvsvc.dll
- 2008-04-14 06:52 . 2010-08-27 05:54 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2008-04-14 06:51 . 2011-09-03 10:17 602112 c:\windows\system32\dllcache\crypt32.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 602112 c:\windows\system32\dllcache\crypt32.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]
@="{0A479751-02BC-11d3-A855-0004AC2568AA}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]
2010-11-21 21:00 309448 ----a-w- c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]
@="{0A479751-02BC-11d3-A855-0004AC2568DD}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]
2010-11-21 21:00 309448 ----a-w- c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\eraser.exe" [2009-12-16 337808]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-03-24 409320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-06-03 446635]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-09-25 106496]
"ApacheMonitor.exe"="c:\program files\PHP Home Edition 2\Apache2\bin\ApacheMonitor.exe" [2004-06-29 41042]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"CNAP2 Launcher"="c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE" [2009-04-22 116128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 86016]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
procexp.lnk - c:\program files\ProcessExplorer\procexp.exe [2011-2-10 4177272]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2011-2-12 155648]
VirtuaWin.lnk - c:\program files\VirtuaWin\VirtuaWin.exe [2011-2-13 145408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Synchronizer]
2011-06-06 10:55 1240992 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2011-02-13 11:20 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-07-22 21:10 402432 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 00:00 28672 ----a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-02-27 12:03 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Sendik\\Sendik.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [23.2.2011 22:06 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10.2.2011 2:18 309848]
R2 ABBYY.Licensing.FineReader.Home.10.0;ABBYY FineReader 10 HE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\Home\NetworkLicenseServer.exe [21.7.2010 18:30 814344]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.2.2011 2:18 19544]
R2 PDRJNDL;PDRJNDL;m:\software\System_a_utility\!_Hesla_a_soukromi_vcetne_spywaru\dekart-privatni_disk__free--eng\nainstalovany\pdrjndl.sys [8.2.2011 18:05 16512]
R2 PRVDISK;PRVDISK;m:\software\System_a_utility\!_Hesla_a_soukromi_vcetne_spywaru\dekart-privatni_disk__free--eng\nainstalovany\prvdisk.sys [8.2.2011 18:05 14080]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [25.9.2009 23:57 56576]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [25.9.2009 23:57 138240]
R3 OA002Afx;Provides a software interface to control audio effects of OA002 camera.;c:\windows\system32\drivers\OA002Afx.sys [8.6.2007 10:00 148056]
R3 OA002Ufd;Creative Camera OA002 Upper Filter Driver;c:\windows\system32\drivers\OA002Ufd.sys [3.6.2008 18:30 144672]
R3 OA002Vid;Creative Camera OA002 Function Driver;c:\windows\system32\drivers\OA002Vid.sys [1.8.2008 10:01 268672]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 14:16 130384]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [22.6.2011 19:23 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [22.6.2011 19:23 8456]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 14:37 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 14:16 753504]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-04-16 10:07 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-06 c:\windows\Tasks\LightScribeControlPanel.job
- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe [2011-04-16 10:09]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\y5u8ni4j.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-06 23:40
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: NVIDIA__ rev. -> Harddisk0\DR0 -> \Device\0000006f
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
error: Read Parametr není správný.
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/PROGRA~1/PHPHOM~1/mysql/bin/mysqld-nt.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySql]
"ImagePath"="C:/PROGRA~1/PHPHOM~1/mysql/bin/mysqld-nt.exe"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-220523388-1409082233-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f0,35,ce,5a,2e,6a,76,4a,9d,1e,82,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f0,35,ce,5a,2e,6a,76,4a,9d,1e,82,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3840)
c:\program files\Linky\LinkShellExtension\HardlinkShellExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\VirtuaWin\modules\WinList.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE
c:\windows\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
c:\program files\PHP Home Edition 2\Apache2\bin\Apache.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\CNABBSWK.EXE
c:\windows\system32\crypserv.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\PHP Home Edition 2\Apache2\bin\Apache.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-09-06 23:43:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-06 21:43
ComboFix2.txt 2011-09-06 18:40
ComboFix3.txt 2011-09-05 19:05
ComboFix4.txt 2011-09-04 16:46
ComboFix5.txt 2011-09-06 21:31
.
Před spuštěním: Volných bajtů: 58 326 482 944
Po spuštění: Volných bajtů: 58 321 010 688
.
- - End Of File - - F5666D144ECBC026F27113F0CBB5E67C

[jaro3]

Tak tak.

c:\program files\RemDiak.exe
c:\program files\SpaceMonger.exe
Tyto programy znáš? Zvlášť ten první jsem nikde nenašel.

Co Avast?

Stáhni AVP Tools
na svojí plochu.

Zaškrtni :
Hidden startup objects
System Memory
Disk boot sectors
Dokumenty
My email
Počítač
Místní disk C
Místní disk D
Jednotka DVD-Rom (E)
Jednotka BD-ROM (G)
A jiné , např. Flash disky , které máš připojeny.

Pokračuj podle instrukcí.Na konci se objeví textový soubor , který si hned ulož (save log) na svojí plochu pod názvem KAS.txt .Poté sem vlož celý obsah toho logu.

Pokud se Ti log nezobrazí:
Pokud máš AVPtool stále zapnutý, zkus zmáčknout tlačítko Zpráva (Report).
Pokud se Ti zobrazí tabulka, klikni na ní pravým myšítkem a dej Maximalize a měli by se Ti zobrazit výsledky.

[Myloš]

RemDiak je utilita k hromadnému odstraňování diakritiky v názvech souborů a adresářů. Autorem je Jan Fiala – ten, co dělá PSPad.
Domovskou stránku to má http://www.pspad.com/cz/remdiak.htm

Space Monger jsem našel kdysi dávno v nějakém Chipu nebo PCWorldu; tahle historická verze sice má své mouchy – konkrétně masařku, která nepočítá s prolinkováním pomocí junction pointů, ale jinak je to prima utilitka.

AVP pustím, až se vrátím z práce; teď už běžím. Zatím díky.

[jaro3]

Nemáš zač , dík za info!

A ještě až budeš doma:

Stáhni si TDSSKiller

Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

+
Stáhni si aswMBR

na svojí plochu.Poklepej na aswMBR.exe. Klikni na Scan.
Po skenu klikni na aswASW.log a ulož si ho na plochu , vlož sem celý obsak toho logu.

[Myloš]

Log (Automatic Scan report) z Kasperského AVP bych rád vložil, ale má 287 MB.
Podstatné je, že po 9 hodinách kontroly nic nenašel (a v Detected threats není vůbec nic)

---

Tady je log z TDSSKilleru:

2011/09/08 21:08:27.0156 4936 TDSS rootkit removing tool 2.5.20.0 Sep 7 2011 16:44:34
2011/09/08 21:08:27.0578 4936 ================================================================================
2011/09/08 21:08:27.0578 4936 SystemInfo:
2011/09/08 21:08:27.0578 4936
2011/09/08 21:08:27.0578 4936 OS Version: 5.1.2600 ServicePack: 3.0
2011/09/08 21:08:27.0578 4936 Product type: Workstation
2011/09/08 21:08:27.0578 4936 ComputerName: MRCHNA
2011/09/08 21:08:27.0578 4936 UserName: Administrator
2011/09/08 21:08:27.0578 4936 Windows directory: C:\WINDOWS
2011/09/08 21:08:27.0578 4936 System windows directory: C:\WINDOWS
2011/09/08 21:08:27.0578 4936 Processor architecture: Intel x86
2011/09/08 21:08:27.0578 4936 Number of processors: 1
2011/09/08 21:08:27.0578 4936 Page size: 0x1000
2011/09/08 21:08:27.0578 4936 Boot type: Normal boot
2011/09/08 21:08:27.0578 4936 ================================================================================
2011/09/08 21:08:28.0265 4936 Initialize success
2011/09/08 21:08:33.0671 4296 ================================================================================
2011/09/08 21:08:33.0671 4296 Scan started
2011/09/08 21:08:33.0671 4296 Mode: Manual;
2011/09/08 21:08:33.0671 4296 ================================================================================
2011/09/08 21:08:34.0359 4296 Aavmker4 (dfcdd5936cad0138775d5a105d4c7716) C:\WINDOWS\system32\drivers\Aavmker4.sys
2011/09/08 21:08:34.0468 4296 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/09/08 21:08:34.0515 4296 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/09/08 21:08:34.0578 4296 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/09/08 21:08:34.0625 4296 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/09/08 21:08:34.0859 4296 AmdPPM (033448d435e65c4bd72e70521fd05c76) C:\WINDOWS\system32\DRIVERS\AmdPPM.sys
2011/09/08 21:08:36.0484 4296 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/09/08 21:08:36.0796 4296 aswFsBlk (861cb512e4e850e87dd2316f88d69330) C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/09/08 21:08:36.0828 4296 aswMon2 (7857e0b4c817f69ff463eea2c63e56f9) C:\WINDOWS\system32\drivers\aswMon2.sys
2011/09/08 21:08:36.0859 4296 aswRdr (8db043bf96bb6d334e5b4888e709e1c7) C:\WINDOWS\system32\drivers\aswRdr.sys
2011/09/08 21:08:36.0890 4296 aswSnx (17230708a2028cd995656df455f2e303) C:\WINDOWS\system32\drivers\aswSnx.sys
2011/09/08 21:08:36.0937 4296 aswSP (dbedd9d43b00630966ef05d2d8d04cee) C:\WINDOWS\system32\drivers\aswSP.sys
2011/09/08 21:08:36.0968 4296 aswTdi (984cfce2168286c2511695c2f9621475) C:\WINDOWS\system32\drivers\aswTdi.sys
2011/09/08 21:08:37.0015 4296 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/09/08 21:08:37.0046 4296 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/09/08 21:08:37.0109 4296 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/09/08 21:08:37.0156 4296 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/09/08 21:08:37.0218 4296 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/09/08 21:08:37.0265 4296 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/09/08 21:08:37.0312 4296 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/09/08 21:08:37.0359 4296 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/09/08 21:08:37.0406 4296 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/09/08 21:08:37.0453 4296 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/09/08 21:08:37.0609 4296 ctac32k (4b6096745f72b4fd36514617e2ea5d37) C:\WINDOWS\system32\drivers\ctac32k.sys
2011/09/08 21:08:37.0656 4296 ctaud2k (3576ec792347ed15699f6d830e0f5437) C:\WINDOWS\system32\drivers\ctaud2k.sys
2011/09/08 21:08:37.0734 4296 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2011/09/08 21:08:37.0765 4296 ctprxy2k (097d42574e3c6d98cd5a2ee7647fa6bf) C:\WINDOWS\system32\drivers\ctprxy2k.sys
2011/09/08 21:08:37.0796 4296 ctsfm2k (c58a2507ef62b20b9bd670c666088b50) C:\WINDOWS\system32\drivers\ctsfm2k.sys
2011/09/08 21:08:37.0906 4296 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/09/08 21:08:37.0968 4296 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
2011/09/08 21:08:38.0015 4296 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
2011/09/08 21:08:38.0046 4296 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/09/08 21:08:38.0093 4296 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/09/08 21:08:38.0140 4296 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/09/08 21:08:38.0187 4296 ElbyCDIO (084a13f18856d610d44d3109a9d2acde) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
2011/09/08 21:08:38.0218 4296 ElbyDelay (df9957db3bfe5136aad3c2c101806c98) C:\WINDOWS\system32\Drivers\ElbyDelay.sys
2011/09/08 21:08:38.0234 4296 emupia (a9d94b89372f3f9609a1a5eec631a260) C:\WINDOWS\system32\drivers\emupia2k.sys
2011/09/08 21:08:38.0296 4296 epmntdrv (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys
2011/09/08 21:08:38.0328 4296 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys
2011/09/08 21:08:38.0375 4296 exFat (3ef58f2eae3aecab45d682152db2f67d) C:\WINDOWS\system32\drivers\exFat.sys
2011/09/08 21:08:38.0421 4296 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/09/08 21:08:38.0453 4296 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/09/08 21:08:38.0468 4296 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
2011/09/08 21:08:38.0500 4296 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/09/08 21:08:38.0531 4296 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/09/08 21:08:38.0562 4296 Fs_Rec (c865b83411d7347627a4beec22543fb1) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/09/08 21:08:38.0593 4296 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/09/08 21:08:38.0625 4296 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/09/08 21:08:38.0656 4296 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/09/08 21:08:38.0703 4296 ha10kx2k (dc9847cdc43665ed4cc780947516209c) C:\WINDOWS\system32\drivers\ha10kx2k.sys
2011/09/08 21:08:38.0812 4296 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/09/08 21:08:38.0875 4296 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/09/08 21:08:38.0968 4296 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/09/08 21:08:39.0000 4296 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/09/08 21:08:39.0093 4296 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/09/08 21:08:39.0125 4296 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/09/08 21:08:39.0156 4296 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/09/08 21:08:39.0171 4296 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/09/08 21:08:39.0203 4296 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/09/08 21:08:39.0234 4296 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/09/08 21:08:39.0265 4296 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/09/08 21:08:39.0296 4296 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/09/08 21:08:39.0343 4296 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/09/08 21:08:39.0375 4296 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/09/08 21:08:39.0421 4296 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/09/08 21:08:39.0515 4296 meiudf (766a1d242f4390ddf1243084898a20c9) C:\WINDOWS\system32\Drivers\meiudf.sys
2011/09/08 21:08:39.0562 4296 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/09/08 21:08:39.0593 4296 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
2011/09/08 21:08:39.0625 4296 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/09/08 21:08:39.0671 4296 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/09/08 21:08:39.0687 4296 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/09/08 21:08:39.0734 4296 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/09/08 21:08:39.0765 4296 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/09/08 21:08:39.0828 4296 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/09/08 21:08:39.0875 4296 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/09/08 21:08:39.0906 4296 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/09/08 21:08:39.0953 4296 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/09/08 21:08:39.0984 4296 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/09/08 21:08:40.0015 4296 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/09/08 21:08:40.0062 4296 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/09/08 21:08:40.0093 4296 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/09/08 21:08:40.0156 4296 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/09/08 21:08:40.0187 4296 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/09/08 21:08:40.0218 4296 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/09/08 21:08:40.0250 4296 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/09/08 21:08:40.0265 4296 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/09/08 21:08:40.0312 4296 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/09/08 21:08:40.0328 4296 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/09/08 21:08:40.0359 4296 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/09/08 21:08:40.0421 4296 NetworkX (5ef7dd401771693245d46f4b0b69fe2b) C:\WINDOWS\system32\ckldrv.sys
2011/09/08 21:08:40.0453 4296 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/09/08 21:08:40.0484 4296 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/09/08 21:08:40.0515 4296 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/09/08 21:08:40.0578 4296 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/09/08 21:08:40.0593 4296 nusb3hub (cce7c2b70d68a5314cbfdf91e84b248d) C:\WINDOWS\system32\DRIVERS\nusb3hub.sys
2011/09/08 21:08:40.0625 4296 nusb3xhc (5a3efb79d50726ff98d7b5d8cff9634b) C:\WINDOWS\system32\DRIVERS\nusb3xhc.sys
2011/09/08 21:08:40.0750 4296 nv (29e060897a3179660c49367f52fcaac0) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/09/08 21:08:40.0906 4296 nvata (0344aa9113dc16eec379f4652020849d) C:\WINDOWS\system32\DRIVERS\nvata.sys
2011/09/08 21:08:40.0937 4296 nvatabus (0344aa9113dc16eec379f4652020849d) C:\WINDOWS\system32\DRIVERS\nvatabus.sys
2011/09/08 21:08:40.0968 4296 NVENETFD (ac050fdc2d24c678bc49b5d5671e13be) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/09/08 21:08:40.0984 4296 nvnetbus (81339157c429aada7a6aea97f3177da7) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/09/08 21:08:41.0015 4296 nvraid (a4f2a29b9d40f9ffbbb54e56ce483797) C:\WINDOWS\system32\DRIVERS\nvraid.sys
2011/09/08 21:08:41.0046 4296 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/09/08 21:08:41.0078 4296 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/09/08 21:08:41.0109 4296 OA002Afx (ec528056b89d15755abb624e55949e44) C:\WINDOWS\system32\Drivers\OA002Afx.sys
2011/09/08 21:08:41.0125 4296 OA002Ufd (a015dd2ba6009c8bdd00a6c431302d06) C:\WINDOWS\system32\DRIVERS\OA002Ufd.sys
2011/09/08 21:08:41.0156 4296 OA002Vid (ea274f30e5d89b2746c9d89e20571f5e) C:\WINDOWS\system32\DRIVERS\OA002Vid.sys
2011/09/08 21:08:41.0187 4296 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/09/08 21:08:41.0234 4296 ossrv (f29184bdc81c398b6027a67ff6a19895) C:\WINDOWS\system32\drivers\ctoss2k.sys
2011/09/08 21:08:41.0281 4296 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\drivers\Parport.sys
2011/09/08 21:08:41.0296 4296 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/09/08 21:08:41.0343 4296 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/09/08 21:08:41.0390 4296 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/09/08 21:08:41.0437 4296 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/09/08 21:08:41.0484 4296 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/09/08 21:08:41.0734 4296 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/09/08 21:08:41.0765 4296 Processor (7eb15dce4ec3a0220bd796a15c18186e) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/09/08 21:08:41.0828 4296 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/09/08 21:08:41.0875 4296 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/09/08 21:08:42.0031 4296 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/09/08 21:08:42.0062 4296 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/09/08 21:08:42.0093 4296 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/09/08 21:08:42.0125 4296 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/09/08 21:08:42.0156 4296 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/09/08 21:08:42.0187 4296 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/09/08 21:08:42.0234 4296 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/09/08 21:08:42.0296 4296 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/09/08 21:08:42.0343 4296 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/09/08 21:08:42.0406 4296 SbieDrv (2b12749cc05f32d217735770d2eeabe3) C:\Program Files\Sandboxie\SbieDrv.sys
2011/09/08 21:08:42.0453 4296 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/09/08 21:08:42.0500 4296 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/09/08 21:08:42.0515 4296 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/09/08 21:08:42.0562 4296 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/09/08 21:08:42.0625 4296 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/09/08 21:08:42.0703 4296 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/09/08 21:08:42.0750 4296 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/09/08 21:08:42.0796 4296 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/09/08 21:08:42.0828 4296 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/09/08 21:08:42.0859 4296 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/09/08 21:08:42.0968 4296 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/09/08 21:08:43.0015 4296 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/09/08 21:08:43.0046 4296 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/09/08 21:08:43.0078 4296 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/09/08 21:08:43.0093 4296 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/09/08 21:08:43.0171 4296 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/09/08 21:08:43.0250 4296 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/09/08 21:08:43.0296 4296 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/09/08 21:08:43.0343 4296 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/09/08 21:08:43.0359 4296 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/09/08 21:08:43.0390 4296 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/09/08 21:08:43.0421 4296 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/09/08 21:08:43.0453 4296 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/09/08 21:08:43.0500 4296 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/09/08 21:08:43.0531 4296 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/09/08 21:08:43.0562 4296 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/09/08 21:08:43.0593 4296 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/09/08 21:08:43.0640 4296 vmm (e41fef9e3056fe88c71e411f705be41e) C:\WINDOWS\system32\Drivers\vmm.sys
2011/09/08 21:08:43.0671 4296 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/09/08 21:08:43.0718 4296 VPCNetS2 (f96a678debdccb0b4bb7f38cb2580589) C:\WINDOWS\system32\DRIVERS\VMNetSrv.sys
2011/09/08 21:08:43.0750 4296 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/09/08 21:08:43.0781 4296 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/09/08 21:08:43.0906 4296 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/09/08 21:08:43.0953 4296 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/09/08 21:08:44.0000 4296 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/09/08 21:08:44.0031 4296 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/09/08 21:08:44.0109 4296 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk1\DR1
2011/09/08 21:08:44.0125 4296 MBR (0x1B8) (413fc2a0c716421b3158746d63736515) \Device\Harddisk0\DR0
2011/09/08 21:08:44.0187 4296 Boot (0x1200) (a0f28a3d1973185bc37d0eb29fc2ee25) \Device\Harddisk1\DR1\Partition0
2011/09/08 21:08:44.0234 4296 Boot (0x1200) (1abe03c3d025a44684f273c45d7a35bc) \Device\Harddisk1\DR1\Partition1
2011/09/08 21:08:44.0265 4296 Boot (0x1200) (073bc0027706bd723cd04144c086b17b) \Device\Harddisk0\DR0\Partition0
2011/09/08 21:08:44.0281 4296 Boot (0x1200) (0efafe467e6051d7cd03b3d0938e6f19) \Device\Harddisk0\DR0\Partition1
2011/09/08 21:08:44.0296 4296 ================================================================================
2011/09/08 21:08:44.0296 4296 Scan finished
2011/09/08 21:08:44.0296 4296 ================================================================================
2011/09/08 21:08:44.0312 5956 Detected object count: 0
2011/09/08 21:08:44.0312 5956 Actual detected object count: 0

---

EOF to nehlásí, ale je to celé