Prosim o kontrolu: MWAW-TitanShield Vyřešeno

[peacoq]

Ahoj.
Prosim o kontrolu a doporuceni.
(Malwarebytes bez nalezu)
.
MWAW verze 11.0.60 Updated
(mimo polozky Scan All Files, uplny test)
Total Critical Objects: ....2
Total Errors: ..............2
.
Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "TitanShield Antispyware Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
.
- nalezeny objekt 'grokster Spyware/Adware' se uz jednou objevil a jednalo se o jakysi zmateny zapis HKCR\Magnet, ktery ovsem ale obsahoval zapis prinalezijici k 'C:\ProgramFiles\uTorrent\utorrent.exe'' ...a tento zapis se opakuje:
14 Sep 2009 23:25:05 - Offending Key found: HKCR\Magnet !!!
- vyhledani prinalezejiciho zapisu 'TitanShield Antispyware Corrupted Adware/Spyware':
14 Sep 2009 23:25:16 - Offending Folder found: C:\Users\Dell\AppData\Local\VirtualStore\Program Files\SopCast\adv
Slozka SopCast - adv - obsahuje soubor sopadver.dat / velikost 13.312
(SopCast je program ke sledovani interentove TV - soucasne umoznujici sledovani TV v okne Mozilly.)

.
.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:28:37, on 15/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Windows\V0250Mon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\sttray.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0250Mon.exe] C:\Windows\V0250Mon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\BurnAware Free\nmsaccessu.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6141 bytes

[Reklama]

[pitimir]

Nazdar. MWAV je OK, ide len o neplatne registre.
HJT uz ale nepostacuje, daj log z RSITu:

Stiahni RSIT. Spust, klik na "Continue". Po dokoneceni by se ti mal otvorit textovy subor. Ten skopiruj sem.
Pokial by sa nieco stalo, najdes ho aj na adrese "C:\rsit\log.txt".

[peacoq]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Dell at 2009-09-15 11:49:59
Microsoft® Windows Vista™ Business Service Pack 2
System drive C: has 15 GB (28%) free of 55 GB
Total RAM: 893 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:17, on 15/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Windows\V0250Mon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\sttray.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\totalcmd\TOTALCMD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Dell\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Dell.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0250Mon.exe] C:\Windows\V0250Mon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\BurnAware Free\nmsaccessu.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6169 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-08-29 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-15 815104]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2007-03-21 1548288]
"AVFX Engine"=C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe [2006-06-09 24576]
"V0250Mon.exe"=C:\Windows\V0250Mon.exe [2006-06-08 32768]
"QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2009-05-26 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-08-29 149280]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2009-02-16 981384]
"SigmatelSysTrayApp"=C:\Windows\sttray.exe [2006-11-22 303104]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Creative Live! Cam Manager"=C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [2006-05-31 143360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-09-11 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-09-15 11:45:35 ----D---- C:\rsit
2009-09-14 23:23:18 ----AD---- C:\Windows\VDLL.DLL
2009-09-14 23:23:18 ----AD---- C:\Windows\rundll16.exe
2009-09-14 23:23:18 ----AD---- C:\Windows\RUNDL132.EXE
2009-09-14 23:23:18 ----AD---- C:\Windows\logo1_.exe
2009-09-14 23:23:18 ----AD---- C:\Windows\logo_1.exe
2009-09-09 20:41:50 ----D---- C:\Program Files\CPUID
2009-09-09 11:54:21 ----A---- C:\Windows\system32\jscript.dll
2009-09-09 11:52:59 ----A---- C:\Windows\system32\wlanmsm.dll
2009-09-09 11:52:59 ----A---- C:\Windows\system32\L2SecHC.dll
2009-09-09 11:52:58 ----A---- C:\Windows\system32\wlansec.dll
2009-09-09 11:52:58 ----A---- C:\Windows\system32\wlanapi.dll
2009-09-09 11:52:57 ----A---- C:\Windows\system32\wlansvc.dll
2009-09-09 11:52:35 ----A---- C:\Windows\system32\netiohlp.dll
2009-09-09 11:52:33 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-09-09 11:52:33 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-09-09 11:52:33 ----A---- C:\Windows\system32\MRINFO.EXE
2009-09-09 11:52:33 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-09-09 11:52:33 ----A---- C:\Windows\system32\finger.exe
2009-09-09 11:52:33 ----A---- C:\Windows\system32\ARP.EXE
2009-09-09 11:52:32 ----A---- C:\Windows\system32\ROUTE.EXE
2009-09-09 11:52:32 ----A---- C:\Windows\system32\netevent.dll
2009-09-09 11:51:11 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-09-09 11:51:09 ----A---- C:\Windows\system32\mf.dll
2009-09-08 12:22:54 ----D---- C:\Program Files\Call of Duty
2009-09-08 12:21:14 ----A---- C:\Windows\CoD.INI
2009-09-06 14:16:49 ----D---- C:\Program Files\SpeedFan
2009-09-05 23:59:18 ----A---- C:\Windows\system32\vsregexp.dll
2009-09-05 23:59:14 ----A---- C:\Windows\system32\zlcommdb.dll
2009-09-05 23:59:14 ----A---- C:\Windows\system32\zlcomm.dll
2009-09-05 23:59:07 ----A---- C:\Windows\system32\vswmi.dll
2009-09-05 23:59:02 ----A---- C:\Windows\system32\zpeng25.dll
2009-09-05 23:59:01 ----A---- C:\Windows\system32\vsxml.dll
2009-09-05 23:59:00 ----A---- C:\Windows\system32\vspubapi.dll
2009-09-05 23:59:00 ----A---- C:\Windows\system32\vsmonapi.dll
2009-09-05 23:58:59 ----A---- C:\Windows\system32\vsdata.dll
2009-09-05 23:58:14 ----D---- C:\Windows\system32\ZoneLabs
2009-09-05 23:56:54 ----A---- C:\Windows\system32\vsutil.dll
2009-09-05 23:56:54 ----A---- C:\Windows\system32\vsinit.dll
2009-09-03 19:58:14 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-09-03 19:58:13 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-08-29 17:47:45 ----A---- C:\Windows\system32\javaws.exe
2009-08-29 17:47:45 ----A---- C:\Windows\system32\javaw.exe
2009-08-29 17:47:45 ----A---- C:\Windows\system32\java.exe
2009-08-26 10:40:29 ----A---- C:\Windows\system32\tzres.dll
2009-08-23 22:03:34 ----D---- C:\ProgramData\Creative

======List of files/folders modified in the last 1 months======

2009-09-15 11:49:58 ----D---- C:\Windows\Temp
2009-09-15 11:49:58 ----D---- C:\Windows\Prefetch
2009-09-15 11:46:47 ----D---- C:\Windows\Internet Logs
2009-09-15 01:23:50 ----D---- C:\Windows
2009-09-14 19:11:25 ----D---- C:\Windows\system32\catroot2
2009-09-13 15:56:50 ----SD---- C:\ProgramData\Microsoft
2009-09-13 12:25:04 ----D---- C:\Program Files\Mozilla Firefox
2009-09-12 23:46:35 ----D---- C:\Ccleaner-BackUp
2009-09-12 23:43:36 ----SHD---- C:\Windows\Installer
2009-09-12 23:43:30 ----HD---- C:\Config.Msi
2009-09-12 23:42:40 ----D---- C:\Windows\System32
2009-09-12 21:39:08 ----SHD---- C:\System Volume Information
2009-09-12 20:29:16 ----D---- C:\Users\Dell\AppData\Roaming\Skype
2009-09-12 20:28:18 ----D---- C:\Users\Dell\AppData\Roaming\skypePM
2009-09-11 20:40:18 ----HD---- C:\ProgramData
2009-09-11 20:08:14 ----D---- C:\Program Files\SUPERAntiSpyware
2009-09-10 15:38:08 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-09-10 15:09:39 ----D---- C:\Users\Dell\AppData\Roaming\gtk-2.0
2009-09-10 12:50:18 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-09-09 20:41:51 ----D---- C:\Windows\system32\drivers
2009-09-09 20:41:50 ----RD---- C:\Program Files
2009-09-09 13:01:02 ----D---- C:\Windows\Debug
2009-09-09 12:21:56 ----D---- C:\Windows\rescache
2009-09-09 12:01:29 ----D---- C:\Windows\system32\en-US
2009-09-09 12:00:22 ----D---- C:\Windows\winsxs
2009-09-09 11:55:40 ----D---- C:\Windows\system32\catroot
2009-09-09 11:55:19 ----D---- C:\Program Files\Windows Mail
2009-09-08 12:38:56 ----D---- C:\Windows\inf
2009-09-08 12:38:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-09-07 13:11:22 ----D---- C:\Users\Dell\AppData\Roaming\uTorrent
2009-09-03 20:05:25 ----D---- C:\Windows\AppPatch
2009-08-29 17:47:30 ----A---- C:\Windows\system32\deploytk.dll
2009-08-28 23:38:20 ----A---- C:\Windows\system32\mrt.exe
2009-08-26 10:39:16 ----D---- C:\Program Files\Internet Explorer
2009-08-25 22:19:16 ----D---- C:\Windows\Logs
2009-08-23 22:03:30 ----D---- C:\Users\Dell\AppData\Roaming\Creative
2009-08-22 20:30:15 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-22 19:37:53 ----D---- C:\Program Files\ATI
2009-08-16 13:50:01 ----D---- C:\Windows\LiveKernelReports

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2009-04-10 351744]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-07-28 9968]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2009-08-15 74480]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 vsdatant;Zone Alarm Firewall Driver; C:\Windows\system32\DRIVERS\vsdatant.sys [2009-02-16 293528]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-08-05 55656]
R2 cpuz132;cpuz132; \??\C:\Windows\system32\drivers\cpuz132_x32.sys [2009-03-27 12672]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-15 32256]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 8192]
R3 AmdLLD;AMD Low Level Device Driver; C:\Windows\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-03 3695104]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-03-21 534016]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-18 14208]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-10-18 986624]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-10-18 206848]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2006-11-22 647680]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-15 179256]
R3 V0250Dev;Live! Cam Notebook Pro; C:\Windows\system32\DRIVERS\V0250Dev.sys [2007-08-30 169696]
R3 V0250Vfx;V0250Vfx; C:\Windows\system32\DRIVERS\V0250Vfx.sys [2006-03-24 6272]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-10-18 659968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-18 11264]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-03-21 534016]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2009-04-10 236544]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-03 3695104]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2009-07-28 7408]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-06-03 684032]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 NMSAccessU;NMSAccessU; C:\Program Files\BurnAware Free\nmsaccessu.exe [2008-05-03 71096]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 STacSV;SigmaTel Audio Service; C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe [2006-11-22 90112]
R2 vsmon;TrueVector Internet Monitor; C:\Windows\System32\ZoneLabs\vsmon.exe [2009-02-16 2402184]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2007-03-21 24064]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-04 386560]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-04-10 918528]

-----------------EOF-----------------

[Damned]

Jen vsuvka: "TitanShield Antispyware" vytváří stejnou složku a stejný zápis v registru, v tomto případě si myslím, že to bude falešný poplach.

[pitimir]

Log je OK.

1) Start -> Spustit -> (napis) C:\Program Files\Trend Micro\HijackThis\Dell.exe
Otvori sa premenovany HJT, v nom fixni (zasrktni stvorcek pri danom riadku a stlac "Fix Checked"):

Kód: Vybrat vše

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

2) Updatuj Adobe Reader (poslednu verziu najdes tu).


3) Pouzi T-Cleaner (ak by ho antivirus hlasil ako smejda, nic sa netreba bat, ide len o paranoju AV programu).


4) Na tvojom mieste by som odinstaloval SpyBota aj SuperAntiSpyware.

To by malo byt vsetko.

[peacoq]

Dekuji.

Chtel bych si ujasnit nektere nejasnosti ...kdyby jsi mel moznost na to odpovedet:

Tento PC je zabezpecen pouze free-nastorji: - Avira, - Zone Alarm, - Spybot/TeaTimer
(cisten je pravidelne: - Ccleaner (denne), - SAS + Auslogis DiskDefrag + RegCleaner for Vista (1x/mesic), - Avira (cca. 1x/14dni) )

1. Hijack This: ...nastroj RSIT, jak jsem se docetl, spousti program HJT (pravdepodobne v nejake hlubsi analyze), ale neni mi jasne, jaka je nadale funkcnost HJT;
A, "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" ...HJT zustava funkcni ?, k ucelu zakladniho prehledu, tj. kdyz ho spustim jako doposud - pres ikonu, udela tutez praci ? (na pohled ano, ale i ve skutecnosti)
B, ...ptam se na to z duvodu, ze nyni se spusteni HJT delo prikazem ''C:\Program Files\Trend Micro\HijackThis\Dell.exe''

- jednoducha odpoved, napriklad: ...ano, pouzivej HJT jako doposud, spoustej ho pres ikonu a dostanes onen zakladni prehled bezicich programu a sluzeb, ...a nebo ...nikoli, je nutne ho zpoustet prikazem ''C:\Program Files\Trend Micro\HijackThis\Dell.exe''

2. Spybot:
A, jedna se hlavne o sluzby rezidentni ochrany Tea Timer s tim, ze je tedy vypnut Windows Defender. Kdyz cely SB odinstaluji pojedu jen pod ochranou Avira 9 Free + Windows Defender (+Zone Alarm, kde ale stale casteji ctu, ze by ''mel'' stacit jen Win Defender + Win Firewall + Avira 9).
B, i kdyz jsem se docetl, ze SB je stale vice za horizontem vykonnostim a soucasne i to, ze Avira uz obsahuje zakladni defenderovou slozku a i kdyz nikde neni uvedeno, jak moc vykonna/bezpecna je, tak je pravda, ze TT zpusoboje problem pri avira-testovani, a musi byt docasne deaktivovany (- opravdu je vhodne residentni chranu TTimeru zrusit (cely SB) a jet jen pod WDefenderem?)

3. SAS: ...cca. 1xmesic se pouziva na vycisteni

- jaky jiny program v tom pripade ''udela praci za me'' ?, jestlize se mam spolehnout na zatracovany Win Defender, a zrusit SB/TeaTimer, a soucasne,
- jaky jiny program vykona cisteni na misto Spybot/u a SAS?, ...opravdu je dostacujici ochrana jiz lepsi verzi Avira 9 + Windows Defender + Zone Alarm (a nebo se ma dat pryc i ZA a pouzivt jen Windows Firewall),
- k cisteni bude dostacovat Ccleaner, a cca. 1x/mesic Avira (jestlize se zrusi Spybot pouzivany 1x/14dni i SAS pouzivany 1x/mesic)

[pitimir]

Ad HJT: Mrkni sa sem, je tam maly dodatok, ktory ti to trochu objasni :)
Ale ano, jedna sa o plnohodnotny premenovany HijackThis dvojkovej verzie.Je tam vsak podla mna uz len z nostalgie, je v RSITe zbytocny (vsetky potrebne a hlavne podrobnejsie info nam poda nasledny log), avsak niekedy sa zide :)

Ad zabezpecenie PC: Ja na tvojom mieste necham Avira+WinDefender+ZA. Malo by to stacit

[peacoq]

RSIT: ...me ponekud zarazelo, ze pri umisteni na plochu a pri/po pouziti T-Cleaneru se smaze cely program RSIT (stejne jako treba ATF, at uz je na plose program a nebo jen ikona/zastupce).
Takze RSIT je jen ''takovy jeho/HJT spoustec'' a bez instalace samotneho HJT je k nicemu, protoze poskytuje jen log, nikoli okno k fix/nuti sluzby. (Ostatne je to tam i napsane jen me zarazilo jeho 'zmizeni' pri pouziti TC.)
HJT: ...jakym zpusobem ho tedy spoustet ?,
1, pres ikonu, coz je prikaz 'C:\Program Files\Trend Micro\HijackThis\HijackThis.exe''
2, a nebo onim prikazem pres Start/Spustit ''C:\Program Files\Trend Micro\HijackThis\Dell.exe''
Zabezpeceni: ...udelam podle doporuceni (Spybot odinstaluji, aktivuji Win Def, SAS ponecham pro dukladnejsi cisteni)
Dekuji

[pitimir]

RSIT bez HJT nie je onicom program, je to plnohodnotny primarny scaner (tak ako DDS, OTL, SilentRunners atd.). HJT je nostalgicky prebytok, zbytocnost, ktoru by som ja osobne vyhodil. Ale ako som napisal - niekedy sa zide.

K T-Cleaneru: Nedavno bol aktualizovany zoznam mazanych veci jeho tvorcom (Tempestom) a o.i. bol pridany aj RSIT.

A k tomu spustaniu: Je to jedno, oba programu su totozte - jediny rozdiel je v mene.

[peacoq]

Dekuji.
ja pri svych chabych znalostech, ale aspon dobrych uzivatelskych navycich, jsem casto spasna osoba pro lidi kolem me tak jsem chtel vedet co a jak, aspon po uzivatelske strance a pouziti.