Pravidelné zamrzání PC

Zpráva

Tomik_hk · #1 Příspěvek od **Tomik_hk** » 07 zář 2011 10:29

PC zamrzá celkem pravidelně každých cca 10 min na dobu cca 1 minuty, poté funguje normálně. Zpomalení aplikací jsme nepostřehl. Proto prosím o kontrolu logu. Děkuji.
Log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Tomik at 2011-09-07 11:15:34
Microsoft Windows 7 Professional
System drive C: has 59 GB (59%) free of 100 GB
Total RAM: 1984 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:15:40, on 7.9.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Totalcmd\TOTALCMD.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Tomik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [WinRepair] C:\Users\Tomik\AppData\Roaming\Microsoft\winrepair.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Aktualizovat ESET licenci.lnk = ?
O4 - Global Startup: Smart Shutdown.lnk = C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ArcGIS License Manager - Macrovision Corporation - C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXlm Service 1 - Macrovision Corporation - C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8118 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
"C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe"
\??\C:\Windows\system32\conhost.exe "531979132549527031238623733-236411722421419481-592748102-2020933620-467892036
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe" -c "C:\Program Files (x86)\ESRI\License\arcgis9x\license.lic" -l "C:\Program Files (x86)\ESRI\License\arcgis9x\flexIm.log" -z
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
ARCGIS.exe -T Tomik-PC 10.8 -1 -c "C:\Program Files (x86)\ESRI\License\arcgis9x\license.lic" -lmgrd_port 6978 --lmgrd_start 4e670b8b -l "C:\Program Files (x86)\ESRI\License\arcgis9x\flexIm.log"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe" startup
"C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE" /tsr
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-470ccd37-88fa-4663-9ffb-da9027ab0d85 -SystemEventPortName:HostProcess-517b409f-7911-4e71-9ff3-a33192b420b8 -IoCancelEventPortName:HostProcess-aebbe8ac-131a-4bda-96a7-26b11538b0df -NonStateChangingEventPortName:HostProcess-b9174506-2301-45fc-8473-6e7a659e424e -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d5fad44e-45f7-4e03-8b8f-18ae98eb080a
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Totalcmd\TOTALCMD.EXE"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2576.9447010.1980333087 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" Mozilla.Firefox.6.0.1 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 2576 "\\.\pipe\gecko-crash-server-pipe.2576" plugin
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe12_ Global\UsGthrCtrlFltPipeMssGthrPipe12 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 504 508 516 65536 512
"c:\program files\windows defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey CD6F55F2-D65A-9090-0A7F-C18F9FBB5C0A -Reinvoke
"C:\Users\Tomik\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Tomik\AppData\Roaming\Mozilla\Firefox\Profiles\dats676c.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Win7codecs\rm\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
"Description"=6.0.12.69
"Path"=C:\Program Files (x86)\Win7codecs\rm\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@software602.cz/602XML Filler]
"Description"=Software602 Form Filler Plugin
"Path"=C:\Program Files (x86)\Software602\602XML\Filler\npfiller.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
NPOFF12.DLL
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-01-19 9996320]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2716216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WinRepair"=C:\Users\Tomik\AppData\Roaming\Microsoft\winrepair.exe []
"EA Core"=C:\Program Files (x86)\Electronic Arts\EADM\Core.exe -silent []
"AlcoholAutomount"=C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]
"ISUSPM Startup"=C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"ISUSScheduler"=C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]
"OPSE reminder"=C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe -r C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Aktualizovat ESET licenci.lnk - C:\Program Files (x86)\ESET\MiNODLogin\MiNODLogin.exe
Smart Shutdown.lnk - C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe

C:\Users\Tomik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-09-07 11:15:35 ----D---- C:\Program Files\trend micro
2011-09-07 11:15:34 ----D---- C:\rsit
2011-09-04 21:41:57 ----D---- C:\Program Files (x86)\CCleaner
2011-08-26 13:45:12 ----A---- C:\Windows\SYSWOW64\ODBCTL32.dll
2011-08-26 13:45:11 ----D---- C:\Program Files (x86)\KCZ
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\VB5DB.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MsRepl35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSRD2x35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJtEr35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJInt35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJet35.dll
2011-08-22 23:02:55 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-22 23:02:55 ----A---- C:\Windows\system32\xmllite.dll
2011-08-22 23:02:53 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-22 23:02:38 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-22 23:02:38 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-22 23:02:37 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-22 23:02:37 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-22 23:02:36 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-22 23:02:36 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-22 23:02:34 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-22 23:02:34 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-22 23:02:32 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-22 23:02:27 ----A---- C:\Windows\system32\kernel32.dll
2011-08-22 23:02:27 ----A---- C:\Windows\system32\conhost.exe
2011-08-22 23:02:26 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-22 23:02:26 ----A---- C:\Windows\system32\wow64.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\winsrv.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-22 23:02:25 ----A---- C:\Windows\system32\wow64win.dll
2011-08-22 23:02:25 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-22 23:02:18 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-22 23:02:18 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-22 23:02:18 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-22 23:02:18 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-22 23:02:02 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-22 23:01:55 ----A---- C:\Windows\system32\mshtml.dll
2011-08-22 23:01:51 ----A---- C:\Windows\system32\ieframe.dll
2011-08-22 23:01:50 ----A---- C:\Windows\system32\iertutil.dll
2011-08-22 23:01:49 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-22 23:01:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-22 23:01:42 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-22 23:01:40 ----A---- C:\Windows\system32\urlmon.dll
2011-08-22 23:01:39 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-22 23:01:39 ----A---- C:\Windows\system32\wininet.dll
2011-08-22 23:01:37 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-22 23:01:37 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-22 23:01:37 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-22 23:01:37 ----A---- C:\Windows\system32\iedkcs32.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\mstime.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\url.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\mstime.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\ieui.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\licmgr10.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\iepeers.dll
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-22 23:01:34 ----A---- C:\Windows\system32\msfeedssync.exe
2011-08-22 23:01:34 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-22 22:59:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-22 22:59:22 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-22 22:59:20 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-11 01:25:46 ----SHD---- C:\$RECYCLE.BIN

======List of files/folders modified in the last 1 month======

2011-09-07 11:15:40 ----D---- C:\Windows\Prefetch
2011-09-07 11:15:39 ----D---- C:\Windows\Temp
2011-09-07 11:15:35 ----RD---- C:\Program Files
2011-09-07 10:52:51 ----D---- C:\Windows\System32
2011-09-07 10:52:51 ----D---- C:\Windows\inf
2011-09-07 10:52:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-09-07 08:24:08 ----D---- C:\Windows\system32\config
2011-09-07 08:13:31 ----D---- C:\flexlm
2011-09-05 06:54:52 ----D---- C:\Windows
2011-09-04 21:42:40 ----D---- C:\Windows\Minidump
2011-09-04 21:42:40 ----D---- C:\Windows\debug
2011-09-04 21:41:57 ----RD---- C:\Program Files (x86)
2011-09-04 07:45:41 ----SHD---- C:\System Volume Information
2011-08-31 23:32:23 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-31 01:39:50 ----D---- C:\Users\Tomik\AppData\Roaming\uTorrent
2011-08-30 13:37:46 ----D---- C:\Windows\system32\FxsTmp
2011-08-26 13:45:12 ----D---- C:\Windows\SysWOW64
2011-08-26 09:35:14 ----D---- C:\Users\Tomik\AppData\Roaming\602XML
2011-08-23 08:48:20 ----D---- C:\Windows\Microsoft.NET
2011-08-23 08:48:14 ----RSD---- C:\Windows\assembly
2011-08-23 08:22:02 ----SHD---- C:\Windows\Installer
2011-08-23 08:22:01 ----D---- C:\ProgramData\Microsoft Help
2011-08-23 08:21:53 ----D---- C:\Windows\winsxs
2011-08-23 00:31:14 ----D---- C:\Windows\system32\drivers
2011-08-23 00:31:12 ----D---- C:\Windows\AppPatch
2011-08-23 00:31:11 ----D---- C:\Windows\SYSWOW64\migration
2011-08-23 00:31:11 ----D---- C:\Program Files\Internet Explorer
2011-08-23 00:31:11 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-23 00:31:10 ----D---- C:\Windows\system32\migration
2011-08-22 23:16:08 ----D---- C:\Windows\system32\catroot
2011-08-22 23:11:12 ----RSD---- C:\Windows\Fonts
2011-08-22 23:10:49 ----D---- C:\Program Files (x86)\Microsoft Works
2011-08-22 23:09:35 ----A---- C:\Windows\win.ini
2011-08-22 23:07:11 ----A---- C:\Windows\system32\MRT.exe
2011-08-22 23:01:26 ----D---- C:\Windows\system32\catroot2
2011-08-16 14:47:32 ----SD---- C:\Users\Tomik\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-21 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-09-11 136584]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-09-11 144824]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-09-11 168544]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-09-11 44944]
R2 Sentinel64;Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [2009-09-17 145448]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-06-19 33608]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-01-19 2242720]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 aojvzlo8;aojvzlo8; C:\Windows\system32\drivers\aojvzlo8.sys []
S3 atomkwgf;atomkwgf; C:\Windows\system32\drivers\atomkwgf.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
R2 ArcGIS License Manager;ArcGIS License Manager; C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2009-09-11 735960]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 23296]
S3 FLEXlm Service 1;FLEXlm Service 1; C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-06-20 1255736]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 07 zář 2011 10:48

Zdravim a pekny den preji

v prve rade bych rad vedel co udelame s tim nelegalnim ESET Smart Security - pravidla fora hovori v tomto smeru jasne...

Tomik_hk · #3 Příspěvek od **Tomik_hk** » 07 zář 2011 15:27

Omlouvám se, přeinstalováno na AVAST FREE:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Tomik at 2011-09-07 16:25:19
Microsoft Windows 7 Professional
System drive C: has 64 GB (64%) free of 100 GB
Total RAM: 1984 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:25:26, on 7.9.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Totalcmd\TOTALCMD.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\trend micro\Tomik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [WinRepair] C:\Users\Tomik\AppData\Roaming\Microsoft\winrepair.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Smart Shutdown.lnk = C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ArcGIS License Manager - Macrovision Corporation - C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXlm Service 1 - Macrovision Corporation - C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8342 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"taskhost.exe"
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
"C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe"
\??\C:\Windows\system32\conhost.exe "1434827413-502569488-14355193211121549767-1962534474134458158-8972863251655631607
"C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe" -c "C:\Program Files (x86)\ESRI\License\arcgis9x\license.lic" -l "C:\Program Files (x86)\ESRI\License\arcgis9x\flexIm.log" -z
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe" startup
ARCGIS.exe -T Tomik-PC 10.8 -1 -c "C:\Program Files (x86)\ESRI\License\arcgis9x\license.lic" -lmgrd_port 6978 --lmgrd_start 4e677b4d -l "C:\Program Files (x86)\ESRI\License\arcgis9x\flexIm.log"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-fec550e6-9fcb-4834-8cfe-b671d9f996d7 -SystemEventPortName:HostProcess-a354ea49-1c55-4475-9c60-197edb03af78 -IoCancelEventPortName:HostProcess-e7ed6f52-df5c-4151-9d1a-52ceeb9a46bf -NonStateChangingEventPortName:HostProcess-7da0cd32-ecff-4fd1-9a8d-c7d8a0abe5d5 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8b4c4061-8652-4fef-8334-fde9c898eb7c
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE" /tsr
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=2716.a3e5030.1743304011 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" Mozilla.Firefox.6.0.1 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.jar" 2716 "\\.\pipe\gecko-crash-server-pipe.2716" plugin
"C:\Program Files (x86)\Totalcmd\TOTALCMD.EXE"
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\system32\msiexec.exe /V
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /welcome
C:\Windows\System32\svchost.exe -k WerSvcGroup
"G:\TUNING PC\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Tomik\AppData\Roaming\Mozilla\Firefox\Profiles\dats676c.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Win7codecs\rm\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
"Description"=6.0.12.69
"Path"=C:\Program Files (x86)\Win7codecs\rm\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@software602.cz/602XML Filler]
"Description"=Software602 Form Filler Plugin
"Path"=C:\Program Files (x86)\Software602\602XML\Filler\npfiller.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
NPOFF12.DLL
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-09-06 959432]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-09-06 959432]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-01-19 9996320]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WinRepair"=C:\Users\Tomik\AppData\Roaming\Microsoft\winrepair.exe []
"EA Core"=C:\Program Files (x86)\Electronic Arts\EADM\Core.exe -silent []
"AlcoholAutomount"=C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]
"ISUSPM Startup"=C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-16 221184]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"ISUSScheduler"=C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [2004-06-16 81920]
"OPSE reminder"=C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe -r C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini []
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Smart Shutdown.lnk - C:\Program Files (x86)\Smart Shutdown\Smart Shutdown.exe

C:\Users\Tomik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-09-07 16:17:26 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-09-07 16:17:26 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-09-07 16:17:23 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-09-07 16:17:23 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-09-07 16:17:22 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2011-09-07 16:17:21 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-09-07 16:17:21 ----A---- C:\Windows\system32\aswBoot.exe
2011-09-07 16:16:39 ----A---- C:\Windows\SYSWOW64\aswBoot.exe
2011-09-07 16:16:39 ----A---- C:\Windows\avastSS.scr
2011-09-07 16:16:34 ----D---- C:\ProgramData\AVAST Software
2011-09-07 16:16:34 ----D---- C:\Program Files\AVAST Software
2011-09-07 11:15:35 ----D---- C:\Program Files\trend micro
2011-09-07 11:15:34 ----D---- C:\rsit
2011-09-04 21:41:57 ----D---- C:\Program Files (x86)\CCleaner
2011-08-26 13:45:12 ----A---- C:\Windows\SYSWOW64\ODBCTL32.dll
2011-08-26 13:45:11 ----D---- C:\Program Files (x86)\KCZ
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\VB5DB.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MsRepl35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSRD2x35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJtEr35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJInt35.dll
2011-08-26 13:45:11 ----A---- C:\Windows\SYSWOW64\MSJet35.dll
2011-08-22 23:02:55 ----A---- C:\Windows\SYSWOW64\xmllite.dll
2011-08-22 23:02:55 ----A---- C:\Windows\system32\xmllite.dll
2011-08-22 23:02:53 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-22 23:02:38 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-22 23:02:38 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-22 23:02:37 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-22 23:02:37 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-22 23:02:36 ----A---- C:\Windows\SYSWOW64\odbcjt32.dll
2011-08-22 23:02:36 ----A---- C:\Windows\SYSWOW64\odbccp32.dll
2011-08-22 23:02:34 ----A---- C:\Windows\SYSWOW64\odbccu32.dll
2011-08-22 23:02:34 ----A---- C:\Windows\SYSWOW64\odbccr32.dll
2011-08-22 23:02:32 ----A---- C:\Windows\SYSWOW64\odbctrac.dll
2011-08-22 23:02:27 ----A---- C:\Windows\system32\kernel32.dll
2011-08-22 23:02:27 ----A---- C:\Windows\system32\conhost.exe
2011-08-22 23:02:26 ----A---- C:\Windows\SYSWOW64\setup16.exe
2011-08-22 23:02:26 ----A---- C:\Windows\system32\wow64.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\winsrv.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\ntvdm64.dll
2011-08-22 23:02:26 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2011-08-22 23:02:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2011-08-22 23:02:25 ----A---- C:\Windows\system32\wow64win.dll
2011-08-22 23:02:25 ----A---- C:\Windows\system32\wow64cpu.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-22 23:02:24 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-22 23:02:23 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-22 23:02:22 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-22 23:02:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-22 23:02:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-22 23:02:19 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-22 23:02:18 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-22 23:02:18 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-22 23:02:18 ----A---- C:\Windows\SYSWOW64\user.exe
2011-08-22 23:02:18 ----A---- C:\Windows\SYSWOW64\instnm.exe
2011-08-22 23:02:02 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-22 23:01:55 ----A---- C:\Windows\system32\mshtml.dll
2011-08-22 23:01:51 ----A---- C:\Windows\system32\ieframe.dll
2011-08-22 23:01:50 ----A---- C:\Windows\system32\iertutil.dll
2011-08-22 23:01:49 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-08-22 23:01:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-08-22 23:01:42 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-08-22 23:01:40 ----A---- C:\Windows\system32\urlmon.dll
2011-08-22 23:01:39 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-08-22 23:01:39 ----A---- C:\Windows\system32\wininet.dll
2011-08-22 23:01:37 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-08-22 23:01:37 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-08-22 23:01:37 ----A---- C:\Windows\system32\msfeeds.dll
2011-08-22 23:01:37 ----A---- C:\Windows\system32\iedkcs32.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\mstime.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-08-22 23:01:36 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\url.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\mstime.dll
2011-08-22 23:01:36 ----A---- C:\Windows\system32\ieui.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\url.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-08-22 23:01:35 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\licmgr10.dll
2011-08-22 23:01:35 ----A---- C:\Windows\system32\iepeers.dll
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-08-22 23:01:34 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-08-22 23:01:34 ----A---- C:\Windows\system32\msfeedssync.exe
2011-08-22 23:01:34 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-22 22:59:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-22 22:59:22 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-08-22 22:59:20 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-08-11 01:25:46 ----SHD---- C:\$RECYCLE.BIN

======List of files/folders modified in the last 1 month======

2011-09-07 16:25:18 ----D---- C:\Windows\Temp
2011-09-07 16:17:26 ----D---- C:\Windows\system32\drivers
2011-09-07 16:17:21 ----D---- C:\Windows\SysWOW64
2011-09-07 16:17:21 ----D---- C:\Windows\System32
2011-09-07 16:17:20 ----SHD---- C:\Windows\Installer
2011-09-07 16:17:17 ----D---- C:\Windows\winsxs
2011-09-07 16:16:53 ----D---- C:\Windows\system32\config
2011-09-07 16:16:39 ----D---- C:\Windows
2011-09-07 16:16:34 ----RD---- C:\Program Files
2011-09-07 16:16:34 ----HD---- C:\ProgramData
2011-09-07 16:16:30 ----SHD---- C:\System Volume Information
2011-09-07 16:14:35 ----D---- C:\Windows\inf
2011-09-07 16:14:35 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-09-07 16:09:17 ----D---- C:\Windows\system32\DriverStore
2011-09-07 16:09:17 ----D---- C:\Windows\system32\catroot
2011-09-07 16:08:12 ----D---- C:\Windows\Prefetch
2011-09-07 16:08:11 ----D---- C:\Program Files (x86)\ESET
2011-09-07 08:13:31 ----D---- C:\flexlm
2011-09-04 21:42:40 ----D---- C:\Windows\Minidump
2011-09-04 21:42:40 ----D---- C:\Windows\debug
2011-09-04 21:41:57 ----RD---- C:\Program Files (x86)
2011-08-31 23:32:23 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-31 01:39:50 ----D---- C:\Users\Tomik\AppData\Roaming\uTorrent
2011-08-30 13:37:46 ----D---- C:\Windows\system32\FxsTmp
2011-08-26 09:35:14 ----D---- C:\Users\Tomik\AppData\Roaming\602XML
2011-08-23 08:48:20 ----D---- C:\Windows\Microsoft.NET
2011-08-23 08:48:14 ----RSD---- C:\Windows\assembly
2011-08-23 08:22:01 ----D---- C:\ProgramData\Microsoft Help
2011-08-23 00:31:12 ----D---- C:\Windows\AppPatch
2011-08-23 00:31:11 ----D---- C:\Windows\SYSWOW64\migration
2011-08-23 00:31:11 ----D---- C:\Program Files\Internet Explorer
2011-08-23 00:31:11 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-23 00:31:10 ----D---- C:\Windows\system32\migration
2011-08-22 23:11:12 ----RSD---- C:\Windows\Fonts
2011-08-22 23:10:49 ----D---- C:\Program Files (x86)\Microsoft Works
2011-08-22 23:09:35 ----A---- C:\Windows\win.ini
2011-08-22 23:07:11 ----A---- C:\Windows\system32\MRT.exe
2011-08-22 23:01:26 ----D---- C:\Windows\system32\catroot2
2011-08-16 14:47:32 ----SD---- C:\Users\Tomik\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-21 834544]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-09-06 42328]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-09-06 301912]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-09-06 58200]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-09-06 24408]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-09-06 65368]
R2 Sentinel64;Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [2009-09-17 145448]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-01-19 2242720]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-09-06 601944]
S3 a406xf42;a406xf42; C:\Windows\system32\drivers\a406xf42.sys []
S3 a6o57iom;a6o57iom; C:\Windows\system32\drivers\a6o57iom.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
R2 ArcGIS License Manager;ArcGIS License Manager; C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 FLEXlm Service 1;FLEXlm Service 1; C:\Program Files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-06-20 1255736]

-----------------EOF-----------------

#4 Příspěvek od **vyosek** » 07 zář 2011 15:38

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Zvolte moznost 2 a potvrte enterem
Utilita provede svou cinnost a da log - ten sem vlozte
Nyni znovu, ale zvolte moznost 3 a pote jeste 4 - logy opet vlozte

Tomik_hk · #5 Příspěvek od **Tomik_hk** » 07 zář 2011 15:49

RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Tomik [Admin rights]
Mode: Remove -- Date : 09/07/2011 16:47:35

Bad processes: 0

Registry Entries: 5
[SUSP PATH] HKCU\[...]\Run : WinRepair (C:\Users\Tomik\AppData\Roaming\Microsoft\winrepair.exe) -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

Particular Files / Folders:

HOSTS File:
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 www.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 alcohol-soft.com
127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

Finished : << RKreport[1].txt >>
RKreport[1].txt

RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Tomik [Admin rights]
Mode: HOSTSFix -- Date : 09/07/2011 16:48:45

Bad processes: 0

HOSTS File:
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 www.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 alcohol-soft.com
127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com

Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

RogueKiller V5.3.4 [08/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Tomik [Admin rights]
Mode: ProxyFix -- Date : 09/07/2011 16:49:08

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

#6 Příspěvek od **vyosek** » 07 zář 2011 15:58

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Tomik_hk · #7 Příspěvek od **Tomik_hk** » 07 zář 2011 16:29

ComboFix 11-09-07.04 - Tomik 07.09.2011 17:13:15.1.2 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.1984.707 [GMT 2:00]
Spuštěný z: c:\users\Tomik\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Tomik\~WRL0001.tmp
c:\users\Tomik\AppData\Roaming\Mikrotik
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\advtool.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\advtool.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\dhcp.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\dhcp.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\hotspot.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\hotspot.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\ppp.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\ppp.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\roteros.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\roteros.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\roting2.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\roting2.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\secure.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\secure.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\system.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\system.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\wlan2.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\3.10-1849542534\wlan2.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\advtool.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\advtool.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\dhcp.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\dhcp.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\hotspot.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\hotspot.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\mpls.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\mpls.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\ppp.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\ppp.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\roteros.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\roteros.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\roting4.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\roting4.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\secure.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\secure.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\system.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\system.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\wlan4.crc
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\4.16-2634057548\wlan4.dll
c:\users\Tomik\AppData\Roaming\Mikrotik\Winbox\winbox.cfg
c:\windows\iun6002.exe
c:\windows\SysWow64\regobj.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-07 do 2011-09-07 )))))))))))))))))))))))))))))))
.
.
2011-09-07 15:17 . 2011-09-07 15:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-07 14:17 . 2011-09-06 20:38 301912 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-07 14:17 . 2011-09-06 20:36 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-07 14:17 . 2011-09-06 20:36 58200 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-07 14:17 . 2011-09-06 20:36 42328 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-07 14:17 . 2011-09-06 20:38 601944 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-07 14:17 . 2011-09-06 20:45 254400 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-07 14:17 . 2011-09-06 20:36 65368 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-07 14:16 . 2011-09-06 20:45 41184 ----a-w- c:\windows\avastSS.scr
2011-09-07 14:16 . 2011-09-06 20:45 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-09-07 14:16 . 2011-09-07 14:16 -------- d-----w- c:\programdata\AVAST Software
2011-09-07 14:16 . 2011-09-07 14:16 -------- d-----w- c:\program files\AVAST Software
2011-09-07 09:15 . 2011-09-07 14:25 -------- d-----w- c:\program files\trend micro
2011-09-07 09:15 . 2011-09-07 09:15 -------- d-----w- C:\rsit
2011-09-04 19:41 . 2011-09-04 19:41 -------- d-----w- c:\program files (x86)\CCleaner
2011-09-04 05:45 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5C16E745-CAED-4A18-8235-97D347B6DB6F}\mpengine.dll
2011-08-26 11:45 . 1997-03-07 14:40 77824 ----a-w- c:\windows\SysWow64\ODBCTL32.dll
2011-08-26 11:45 . 2011-08-26 11:45 -------- d-----w- c:\program files (x86)\KCZ
2011-08-26 11:45 . 1997-07-21 12:30 1045776 ----a-w- c:\windows\SysWow64\MSJet35.dll
2011-08-26 11:45 . 1997-06-23 05:06 407312 ----a-w- c:\windows\SysWow64\MsRepl35.dll
2011-08-26 11:45 . 1997-06-23 05:06 252176 ----a-w- c:\windows\SysWow64\MSRD2x35.dll
2011-08-26 11:45 . 1997-06-23 05:06 24848 ----a-w- c:\windows\SysWow64\MSJtEr35.dll
2011-08-26 11:45 . 1997-06-23 05:06 123664 ----a-w- c:\windows\SysWow64\MSJInt35.dll
2011-08-26 11:45 . 1997-01-24 01:00 78608 ----a-w- c:\windows\SysWow64\VB5DB.dll
2011-08-26 11:45 . 1997-01-14 01:00 519680 ----a-w- c:\windows\SysWow64\DBGRID32.OCX
2011-08-26 11:45 . 1996-12-11 01:00 46080 ----a-w- c:\windows\SysWow64\MCIWNDX.OCX
2011-08-26 11:45 . 1996-12-05 01:00 582144 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\DAO\DAO350.DLL
2011-08-22 20:59 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-22 20:59 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-22 20:59 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-23 06:00 . 2011-07-29 17:53 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 22:19 . 2011-07-16 22:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-07-16 04:32 . 2011-08-22 21:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-11 02:56 . 2011-07-15 09:27 3134464 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\users\Tomik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Smart Shutdown.lnk - c:\program files (x86)\Smart Shutdown\Smart Shutdown.exe [2010-4-21 184320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
R3 FLEXlm Service 1;FLEXlm Service 1;c:\program files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 136176]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
S2 ArcGIS License Manager;ArcGIS License Manager;c:\program files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWSNX
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 12:14]
.
2011-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-17 12:14]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-19 9996320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.107.4.100 10.107.4.129 84.16.96.2
FF - ProfilePath - c:\users\Tomik\AppData\Roaming\Mozilla\Firefox\Profiles\dats676c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-OPSE reminder - c:\program files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files (x86)\ESRI\License\arcgis9x\ARCGIS.exe
.
**************************************************************************
.
Celkový čas: 2011-09-07 17:26:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-07 15:26
.
Před spuštěním: Volných bajtů: 66 312 110 080
Po spuštění: Volných bajtů: 66 574 540 800
.
- - End Of File - - 213195E476905E388778585583508788

#8 Příspěvek od **vyosek** » 07 zář 2011 20:50

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"=-
"ISUSPM Startup"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=
"ISUSScheduler"=-

Driver::
gupdate
gupdatem

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Tomik_hk · #9 Příspěvek od **Tomik_hk** » 08 zář 2011 10:27

tady je :

ComboFix 11-09-07.04 - Tomik 08.09.2011 11:17:11.2.2 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.1984.1084 [GMT 2:00]
Spuštěný z: c:\users\Tomik\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Tomik\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-08 do 2011-09-08 )))))))))))))))))))))))))))))))
.
.
2011-09-08 09:20 . 2011-09-08 09:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-07 14:17 . 2011-09-06 20:38 301912 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-07 14:17 . 2011-09-06 20:36 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-07 14:17 . 2011-09-06 20:36 58200 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-07 14:17 . 2011-09-06 20:36 42328 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-07 14:17 . 2011-09-06 20:38 601944 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-07 14:17 . 2011-09-06 20:45 254400 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-07 14:17 . 2011-09-06 20:36 65368 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-07 14:16 . 2011-09-06 20:45 41184 ----a-w- c:\windows\avastSS.scr
2011-09-07 14:16 . 2011-09-06 20:45 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-09-07 14:16 . 2011-09-07 14:16 -------- d-----w- c:\programdata\AVAST Software
2011-09-07 14:16 . 2011-09-07 14:16 -------- d-----w- c:\program files\AVAST Software
2011-09-07 09:15 . 2011-09-07 14:25 -------- d-----w- c:\program files\trend micro
2011-09-07 09:15 . 2011-09-07 09:15 -------- d-----w- C:\rsit
2011-09-04 19:41 . 2011-09-04 19:41 -------- d-----w- c:\program files (x86)\CCleaner
2011-09-04 05:45 . 2011-08-12 04:10 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5C16E745-CAED-4A18-8235-97D347B6DB6F}\mpengine.dll
2011-08-26 11:45 . 1997-03-07 14:40 77824 ----a-w- c:\windows\SysWow64\ODBCTL32.dll
2011-08-26 11:45 . 2011-08-26 11:45 -------- d-----w- c:\program files (x86)\KCZ
2011-08-26 11:45 . 1997-07-21 12:30 1045776 ----a-w- c:\windows\SysWow64\MSJet35.dll
2011-08-26 11:45 . 1997-06-23 05:06 407312 ----a-w- c:\windows\SysWow64\MsRepl35.dll
2011-08-26 11:45 . 1997-06-23 05:06 252176 ----a-w- c:\windows\SysWow64\MSRD2x35.dll
2011-08-26 11:45 . 1997-06-23 05:06 24848 ----a-w- c:\windows\SysWow64\MSJtEr35.dll
2011-08-26 11:45 . 1997-06-23 05:06 123664 ----a-w- c:\windows\SysWow64\MSJInt35.dll
2011-08-26 11:45 . 1997-01-24 01:00 78608 ----a-w- c:\windows\SysWow64\VB5DB.dll
2011-08-26 11:45 . 1997-01-14 01:00 519680 ----a-w- c:\windows\SysWow64\DBGRID32.OCX
2011-08-26 11:45 . 1996-12-11 01:00 46080 ----a-w- c:\windows\SysWow64\MCIWNDX.OCX
2011-08-26 11:45 . 1996-12-05 01:00 582144 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\DAO\DAO350.DLL
2011-08-22 20:59 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-22 20:59 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-22 20:59 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-23 06:00 . 2011-07-29 17:53 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 22:19 . 2011-07-16 22:19 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-07-16 04:32 . 2011-08-22 21:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-06-11 02:56 . 2011-07-15 09:27 3134464 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-07_15.19.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-09-07 15:19 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-09-08 09:23 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-09-07 15:19 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 09:23 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-08 09:23 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-09-07 15:19 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-04-21 19:11 . 2011-09-08 05:56 33256 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-09-08 05:56 30960 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2010-04-21 23:22 . 2011-08-23 11:28 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-04-21 23:22 . 2011-09-07 16:22 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-21 23:22 . 2011-08-23 11:28 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-21 23:22 . 2011-09-07 16:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-23 11:28 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-09-07 16:22 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-22 16:34 . 2011-09-08 09:23 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-22 16:34 . 2011-09-07 15:19 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:46 . 2011-09-08 06:01 83688 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2010-12-22 16:34 . 2011-09-07 15:19 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-12-22 16:34 . 2011-09-08 09:23 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-12-22 16:34 . 2011-09-08 09:23 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-22 16:34 . 2011-09-07 15:19 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-04-21 20:07 . 2011-09-08 09:23 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-21 20:07 . 2011-09-07 15:20 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-04-21 20:07 . 2011-09-08 09:23 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-04-21 20:07 . 2011-09-07 15:20 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-04-22 20:36 . 2011-09-05 22:05 4296 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-04-22 20:36 . 2011-09-07 22:39 4296 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-04-21 17:22 . 2011-09-08 05:56 9052 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4189423312-3548187945-3778243143-1000_UserData.bin
- 2011-09-07 15:19 . 2011-09-07 15:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-08 09:22 . 2011-09-08 09:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-07 15:19 . 2011-09-07 15:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-08 09:22 . 2011-09-08 09:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-04-22 10:51 . 2011-09-07 21:09 350698 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2009-07-14 02:36 . 2011-09-07 15:08 606992 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-09-08 05:58 606992 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-09-08 05:58 622422 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-09-07 15:08 622422 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-09-07 15:08 103370 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-09-08 05:58 103370 c:\windows\system32\perfc009.dat
+ 2009-07-14 15:18 . 2011-09-08 05:58 118604 c:\windows\system32\perfc005.dat
- 2009-07-14 15:18 . 2011-09-07 15:08 118604 c:\windows\system32\perfc005.dat
+ 2009-07-14 05:01 . 2011-09-08 09:21 426964 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-09-07 15:18 426964 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-09-07 22:39 . 2011-09-08 09:21 427732 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4189423312-3548187945-3778243143-1000-8192.dat
+ 2009-07-14 04:45 . 2011-09-07 15:21 3859456 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:45 . 2011-08-23 10:37 3859456 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 02:34 . 2011-09-07 14:16 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-09-07 16:38 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\users\Tomik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Smart Shutdown.lnk - c:\program files (x86)\Smart Shutdown\Smart Shutdown.exe [2010-4-21 184320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 FLEXlm Service 1;FLEXlm Service 1;c:\program files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-03-14 84520]
S2 ArcGIS License Manager;ArcGIS License Manager;c:\program files (x86)\ESRI\License\arcgis9x\lmgrd.exe [2010-11-06 1327104]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-19 9996320]
"combofix"="c:\combofix\CF28647.3XE" [2009-07-14 344576]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.107.4.100 10.107.4.129 84.16.96.2
FF - ProfilePath - c:\users\Tomik\AppData\Roaming\Mozilla\Firefox\Profiles\dats676c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files (x86)\ESRI\License\arcgis9x\ARCGIS.exe
.
**************************************************************************
.
Celkový čas: 2011-09-08 11:26:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-08 09:26
ComboFix2.txt 2011-09-07 15:26
.
Před spuštěním: Volných bajtů: 65 576 730 624
Po spuštění: Volných bajtů: 65 118 797 824
.
- - End Of File - - BFA855CADC7078898AC78893B2AB7018

#10 Příspěvek od **vyosek** » 08 zář 2011 11:49

Odinstalujte Combofix

Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
Napiste ComboFix /Uninstall
Stisknete Enter
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Doporucuji provest defragmentaci disku

Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
- Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
- prepnete se do zalozky Nastroje
- Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
- Toto provedte se vsemi disky
Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
- Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
- Kliknete na Analyzovat
- Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
- Postup provedte se vsemi disky
Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
- Vyhodou programku je, ze se neinstaluje
- Staci tedy jen stahnout dle verze vaseho OS a rozbalit
- Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
- Probehne analyza disku a nasledne i defragmentace

Napiste jak se chova PC

Tomik_hk · #11 Příspěvek od **Tomik_hk** » 08 zář 2011 17:58

Vše jsem provedl dle instrukcí, ale bohužel to nepomohlo. PC se bohužel stále seká....

#12 Příspěvek od **vyosek** » 08 zář 2011 18:11

Otestujte HD pomoci HD Tune http://www.stahuj.centrum.cz/utility_a_ ... g/hd-tune/

Udelejte testy Benchmark a Error Scan - dejte screeny
Dejte screen ze zalozky Health
Scree udelate kdyz klilknete na tu modrou disketku a pak jej sem dejte dle tohoto navdou http://www.viry.cz/forum/viewtopic.php?f=15&t=14114 - zajima Vas jen cast "zaslani na forum" samozrejme

Tomik_hk · #13 Příspěvek od **Tomik_hk** » 08 zář 2011 19:08

zasílám odkazy na test:
http://imageshack.us/photo/my-images/22 ... achih.png/
http://imageshack.us/photo/my-images/11 ... ihds7.png/

#14 Příspěvek od **vyosek** » 09 zář 2011 05:48

Error sken se nepodarilo udelat

Pak jeste otestujte RAM pamet dle tohoto navodu http://viry.cz/forum/viewtopic.php?f=53&t=106788

VIRY.CZ

Pravidelné zamrzání PC

Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC

Re: Pravidelné zamrzání PC