virus v services.exe

[markett]

Zdravim,
dnes nam avg zacal hlasit napadeni systemu. Nektere problemy vyresil, u nekterych je psano nevyleceno nebo neodstraneno. Vzhledem k tomu, ze se nachazi v system32, netroufame si je jen tak smazat. Muzete poradit, co s temi soubory, se kterymi si avg neporadil? Prikladam vysledek testu. Diky a preji pekny den, m.


Test "Test celého počítače" byl dokončen.
Infekce;"12";"8";"5"
Spyware;"8";"8";"0"
Varování;"3";"3";"0"
Složky vybrané k testování:;"Test celého počítače"
Test zahájen:;"8. září 2011, 21:50:51"
Test dokončen:;"8. září 2011, 23:11:30 (1 hodin(a) 20 minut(a) 39 sekund(a))"
Celkem otestováno objektů:;"811387"
Uživatel:;"Kuře"

Infekce
;"Soubor";"Infekce";"Výsledek"
;"C:\WINDOWS\system32\services.exe (1024):\memory_09500000";"Rozpoznán virus Packed.Revolt";"Infikováno"
;"C:\WINDOWS\system32\svchost.exe (1364):\memory_00400000";"Trojský kůň SpamTool.FYS";"Infikováno"
;"C:\WINDOWS\system32\svchost.exe (1404):\memory_00400000";"Trojský kůň SpamTool.FYS";"Infikováno"
;"C:\WINDOWS\system32\svchost.exe (1548):\memory_00400000";"Trojský kůň Generic21.BWHM";"Infikováno"
;"C:\WINDOWS\system32\svchost.exe (1568):\memory_00400000";"Trojský kůň Generic21.BWHM";"Infikováno"
;"C:\Services.exe";"Trojský kůň Generic14.BUQL";"Přesunuto do Virového trezoru"
;"C:\WINDOWS\system32\services.exe (1024)";"Rozpoznán virus Packed.Revolt";"Smazáno"
;"C:\WINDOWS\system32\svchost.exe (1364)";"Trojský kůň SpamTool.FYS";"Smazáno"
;"C:\WINDOWS\system32\svchost.exe (1404)";"Trojský kůň SpamTool.FYS";"Smazáno"
;"C:\WINDOWS\system32\svchost.exe (1548)";"Trojský kůň Generic21.BWHM";"Smazáno"
;"C:\WINDOWS\system32\svchost.exe (1568)";"Trojský kůň Generic21.BWHM";"Smazáno"
;"C:\WINDOWS\Temp\64468.sys";"Trojský kůň BackDoor.Generic10.ARXL";"Přesunuto do Virového trezoru"

Spyware
;"Soubor";"Infekce";"Výsledek"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe";"Adware Generic.OUK";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin";"Adware Generic.OUK";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\wbhshare.dll";"Adware Generic.OUK";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\Webhdll.dll";"Adware Generic.LKS";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\WhAgent.exe";"Adware Generic.JBC";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\whiehlpr.dll";"Adware Generic.NLU";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\whieshm.dll";"Adware Generic2.OFO";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Dokumenty\soldier of fortune\sodier of fortune 1\sofgame\Arcade\ArcadeInstallSOFPLAT108c.exe:\unwise015d.bin:\whInstaller.exe";"Adware Generic.NLM";"Přesunuto do Virového trezoru"

Varování
;"Soubor";"Infekce";"Výsledek"
;"C:\Documents and Settings\Kuře\Local Settings\Data aplikací\Opera\Opera\profile\cache4\temporary_download\Sp2-Pro-Windows-Xp.exe";"Poškozený spustitelný soubor";"Přesunuto do Virového trezoru"
;"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\YK1RXVOC\avg_free_stb_eu_2012_1796_free[1].exe";"Poškozený spustitelný soubor";"Přesunuto do Virového trezoru"
;"C:\Hry\Steam\SteamApps\aifel\half-life 2 lostcoast\lostcoast\bin\server.dll";"Poškozený spustitelný soubor";"Přesunuto do Virového trezoru"

[JaRon]

restartuj PC a
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim


akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)

[markett]

Tak dvakrat jsem program spustila a ani jednou se nedokoncil. Poprve se zaseknul na akci mazu slozky a podruhe na dokoncuji fazi 50. Pokazde jsem to nechala cca 45 minut pustene, ale vypada to, ze se nic nedeje. Na plose nejsou zadne ikony, jen ta tabulka combofix a pc se musi restartovat.

[JaRon]

vloz aktualny log RSIT - uvidime co dalej

[markett]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Kuře at 2011-09-09 10:41:43
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 5 GB (2%) free of 191 GB
Total RAM: 767 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:41:55, on 9.9.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG2012\avgfws.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\Kuře\Local Settings\Data aplikací\Opera\Opera\profile\cache4\temporary_download\RSIT (2).exe
C:\Program Files\trend micro\Kuře.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache.dobnet.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 9847508843
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe

--
End of file - 8044 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-08-22 2180960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-09-08 1451336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-09-02 305328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll [2011-09-02 1007160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-09-02 305328]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-09-08 1451336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2011-09-02 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
C:\Program Files\VIAudioi\SBADeck\ADeck.exe [2005-09-06 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]
C:\Program Files\AVG\AVG2012\avgtray.exe [2011-08-19 2387296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe /s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CmUsbSound]
RunDll32 cmcnfgu.cpl,CMICtrlWnd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Program Files\D-Tools\daemon.exe -lang 1033 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe [2006-11-20 863744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
C:\Program Files\ICQLite\ICQLite.exe -minimize []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2005-02-16 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-02-16 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe [2006-11-28 2658304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-06-28 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe [2008-08-25 2030136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatBar]
C:\Program Files\Globe Software\StatBar\StatBar.exe [2005-01-26 339456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Hry\Steam\\Steam.exe [2010-10-14 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThrustTSR]
C:\Program Files\Thrustmaster\Thrustmapper\TMTMTSR.exe [2003-04-10 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]
C:\Program Files\AVG Secure Search\vprot.exe [2011-09-08 218440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^BlueSoleil.lnk]
C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
C:\PROGRA~1\MCAFEE~1\20DEB9~1.181\SSSCHE~1.EXE [2010-01-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan.lnk]
C:\PROGRA~1\MCAFEE~1\10BCA1~1.150\SSSCHE~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SpyEmrgSrv"=2
"PnkBstrB"=2
"PnkBstrA"=2
"MyWebSearchService"=2
"gusvc"=3
"gupdate"=2
"MerakSMTP"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\America's Army\System\ArmyOps.exe"="C:\Program Files\America's Army\System\ArmyOps.exe:*:Enabled:ArmyOps"
"C:\Hry\Steam\SteamApps\aifel\counter-strike source\hl2.exe"="C:\Hry\Steam\SteamApps\aifel\counter-strike source\hl2.exe:*:Disabled:hl2"
"C:\Program Files\DC++\DCPlusPlus.exe"="C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Hry\World of Warcraft\WoW-1.9.0-enUS-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.9.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\6FER61Q7\WoW-1.8.3.4807-to-0.9.0-enUS-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\6FER61Q7\WoW-1.8.3.4807-to-0.9.0-enUS-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Plocha\L2W_All.EXE"="C:\Documents and Settings\Kuře\Plocha\L2W_All.EXE:*:Enabled:L2W_All"
"C:\Documents and Settings\Kuře\Plocha\l2asrv.exe"="C:\Documents and Settings\Kuře\Plocha\l2asrv.exe:*:Disabled:l2asrv"
"C:\Documents and Settings\Kuře\Plocha\L2Walker_Cracked\TCPTunnel.exe"="C:\Documents and Settings\Kuře\Plocha\L2Walker_Cracked\TCPTunnel.exe:*:Enabled:TCPTunnel"
"C:\Hry\Call of Duty 2\CoD2MP_s.exe"="C:\Hry\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Hry\Star Wars Battlefront II\GameData\BattlefrontII.exe"="C:\Hry\Star Wars Battlefront II\GameData\BattlefrontII.exe:*:Enabled:BattlefrontII"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\BitTorrent\btdownloadgui.exe"="C:\Program Files\BitTorrent\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\Hry\World of Warcraft\WoW-1.10.0-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.10.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\BackgroundDownloader.exe"="C:\Hry\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\K163ST2Z\DarkmooneFaire_English-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\K163ST2Z\DarkmooneFaire_English-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-1.10.2.5302-to-1.11.0.5428-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.10.2.5302-to-1.11.0.5428-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-1.11.2.5464-to-1.12.0.5595-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.11.2.5464-to-1.12.0.5595-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\Repair.exe"="C:\Hry\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Hry\UT2004\System\UT2004.exe"="C:\Hry\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:Bluetooth Application"
"C:\Program Files\VentSrv\ventrilo_srv.exe"="C:\Program Files\VentSrv\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"C:\Hry\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\UTIJW87E\EPL_Trailer_EG.avi-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\UTIJW87E\EPL_Trailer_EG.avi-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\0AHXJTF4\Arathi_new_EG-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\0AHXJTF4\Arathi_new_EG-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\ELJ8OUZT\DarkmooneFaire_English-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\ELJ8OUZT\DarkmooneFaire_English-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\PVRJDD4E\WOW_Rouge-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\PVRJDD4E\WOW_Rouge-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\ELJ8OUZT\EPL_Trailer_EG.avi-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\ELJ8OUZT\EPL_Trailer_EG.avi-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe"="C:\Hry\World of Warcraft\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\3DF3UKHW\EPL_Trailer_EG.avi-downloader[1].exe"="C:\Documents and Settings\Kuře\Local Settings\Temporary Internet Files\Content.IE5\3DF3UKHW\EPL_Trailer_EG.avi-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\Hry\World of Warcraft\WoW-2.0.6.6337-to-2.0.7.6383-enGB-downloader.exe"="C:\Hry\World of Warcraft\WoW-2.0.6.6337-to-2.0.7.6383-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\SimpleCenter\Home Media Server.exe"="C:\Program Files\SimpleCenter\Home Media Server.exe:*:Enabled:Nokia's Media Manager and Server"
"C:\Program Files\BitLord2\BitLord.exe"="C:\Program Files\BitLord2\BitLord.exe:*:Enabled: "
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Infogrames\RollerCoaster Tycoon 2\RTC.EXE"="C:\Program Files\Infogrames\RollerCoaster Tycoon 2\RTC.EXE:*:Enabled:RTC"
"C:\Program Files\Infogrames\RollerCoaster Tycoon 2\RCT.EXE"="C:\Program Files\Infogrames\RollerCoaster Tycoon 2\RCT.EXE:*:Enabled:RCT"
"C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe"="C:\Program Files\Cenega Czech\VIETCONG\vietcong.exe:*:Disabled:vietcong"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Hry\Far Cry\Bin32\FarCry.exe"="C:\Hry\Far Cry\Bin32\FarCry.exe:*:Disabled:Far Cry"
"C:\Hry\Condition Zero\czero.exe"="C:\Hry\Condition Zero\czero.exe:*:Disabled:Half-Life Launcher"
"C:\Hry\Steam\SteamApps\aifel\half-life 2 deathmatch\hl2.exe"="C:\Hry\Steam\SteamApps\aifel\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Program Files\Infogrames\RollerCoaster Tycoon 2\rtc2cz.EXE"="C:\Program Files\Infogrames\RollerCoaster Tycoon 2\rtc2cz.EXE:*:Disabled:rtc2cz"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Disabled:Skype"
"C:\Hry\Steam\Steam.exe"="C:\Hry\Steam\Steam.exe:*:Disabled:Steam"
"C:\Documents and Settings\dc\StrongDC.exe"="C:\Documents and Settings\dc\StrongDC.exe:*:Disabled:StrongDC++"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Documents and Settings\Kuře\Plocha\pbsetup.exe"="C:\Documents and Settings\Kuře\Plocha\pbsetup.exe:*:Enabled:pbsetup"
"C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe"="C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe:*:Enabled:Battlefield 2142"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Documents and Settings\Kuře\Plocha\hry\Warcraft3\Warcraft III.exe"="C:\Documents and Settings\Kuře\Plocha\hry\Warcraft3\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Hry\Steam\SteamApps\common\stalker shadow of chernobyl\bin\XR_3DA.exe"="C:\Hry\Steam\SteamApps\common\stalker shadow of chernobyl\bin\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R.: Shadow of Chernobyl"
"C:\Hry\Steam\SteamApps\common\infernal\game\game.exe"="C:\Hry\Steam\SteamApps\common\infernal\game\game.exe:*:Enabled:Infernal"
"C:\Program Files\Raven\SOF PLATINUM\SoF.exe"="C:\Program Files\Raven\SOF PLATINUM\SoF.exe:*:Enabled:SoF"
"C:\Documents and Settings\Kuře\Plocha\sdc241-32\StrongDC.exe"="C:\Documents and Settings\Kuře\Plocha\sdc241-32\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Hry\Steam\SteamApps\common\company of heroes\RelicCOH.exe"="C:\Hry\Steam\SteamApps\common\company of heroes\RelicCOH.exe:*:Enabled:Company of Heroes: Opposing Fronts"
"C:\Hry\Steam\SteamApps\common\company of heroes\RelicDownloader\RelicDownloader.exe"="C:\Hry\Steam\SteamApps\common\company of heroes\RelicDownloader\RelicDownloader.exe:*:Enabled:Relic Patch Download Manager"
"C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE"="C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE:*:Enabled:ACTOFWAR"
"C:\Program Files\World of Warcraft\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe"="C:\Program Files\World of Warcraft\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\World of Warcraft\Launcher.patch.exe"="C:\Program Files\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe"="C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"C:\Documents and Settings\Kuře\Plocha\Skype.exe"="C:\Documents and Settings\Kuře\Plocha\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Documents and Settings\Kuře\Plocha\MOJE MP3\Phone\Skype.exe"="C:\Documents and Settings\Kuře\Plocha\MOJE MP3\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Hry\World of Warcraft\Launcher.exe"="C:\Hry\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Hry\World of Warcraft\Launcher.patch.exe"="C:\Hry\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\Counter Strike 1.6 Reloaded\hl.exe"="C:\Program Files\Counter Strike 1.6 Reloaded\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"vidc.VP60"=vp6vfw.dll
"vidc.VP61"=vp6vfw.dll
"vidc.VP62"=vp6vfw.dll
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave5"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave7"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer7"=wdmaud.drv
"aux1"=wdmaud.drv
"wave8"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer8"=wdmaud.drv
"aux2"=wdmaud.drv
"vidc.ffds"=ffdshow.ax
"wave9"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer9"=wdmaud.drv
"VIDC.WMV3"=wmv9vcm.dll
"msacm.divxa32"=msaud32_divx.acm

======List of files/folders created in the last 1 month======

2011-09-09 09:58:25 ----D---- C:\WINDOWS\temp
2011-09-09 09:40:27 ----SD---- C:\ComboFix
2011-09-09 09:00:09 ----A---- C:\Boot.bak
2011-09-09 08:59:58 ----RASHD---- C:\cmdcons
2011-09-09 08:56:52 ----A---- C:\WINDOWS\zip.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\SWSC.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\SWREG.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\sed.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\PEV.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\NIRCMD.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\MBR.exe
2011-09-09 08:56:52 ----A---- C:\WINDOWS\grep.exe
2011-09-09 08:47:43 ----D---- C:\WINDOWS\ERDNT
2011-09-09 08:45:45 ----D---- C:\Qoobox
2011-09-09 07:17:05 ----D---- C:\rsit
2011-09-08 22:22:37 ----HD---- C:\$AVG
2011-09-08 21:46:45 ----D---- C:\Documents and Settings\Kuře\Data aplikací\AVG2012
2011-09-08 21:45:45 ----D---- C:\Documents and Settings\Kuře\Data aplikací\AVG Secure Search
2011-09-08 21:45:40 ----D---- C:\Program Files\Common Files\AVG Secure Search
2011-09-08 21:45:39 ----D---- C:\Program Files\AVG Secure Search
2011-09-08 21:45:36 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2011-09-08 21:44:23 ----D---- C:\WINDOWS\system32\drivers\AVG
2011-09-08 21:44:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2012
2011-09-08 21:43:28 ----D---- C:\Program Files\AVG
2011-09-08 21:38:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2011-09-02 14:43:27 ----D---- C:\Documents and Settings\Kuře\Data aplikací\Google
2011-08-30 15:43:39 ----D---- C:\Documents and Settings\Kuře\Data aplikací\TFS2
2011-08-30 15:43:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\Particles
2011-08-30 15:39:32 ----D---- C:\Program Files\Rybicky 2 - Na nove adrese
2011-08-25 16:37:23 ----D---- C:\Program Files\Moje cukrarna 3
2011-08-22 12:28:07 ----D---- C:\Documents and Settings\Kuře\Data aplikací\Shape games
2011-08-22 12:27:40 ----D---- C:\Program Files\Zahadna kucharka
2011-08-19 01:22:37 ----A---- C:\WINDOWS\Counter Strike 1.6 Reloaded Uninstaller.exe
2011-08-19 01:18:15 ----D---- C:\Program Files\Counter Strike 1.6 Reloaded
2011-08-11 21:00:27 ----D---- C:\Program Files\TopCD

======List of files/folders modified in the last 1 month======

2011-09-09 10:41:51 ----D---- C:\WINDOWS\Prefetch
2011-09-09 10:41:50 ----D---- C:\Program Files\Trend Micro
2011-09-09 10:41:48 ----D---- C:\WINDOWS\system32\CatRoot2
2011-09-09 10:30:58 ----A---- C:\WINDOWS\NeroDigital.ini
2011-09-09 09:58:25 ----AD---- C:\WINDOWS
2011-09-09 09:52:42 ----D---- C:\WINDOWS\system32\drivers
2011-09-09 09:52:42 ----D---- C:\WINDOWS\system32
2011-09-09 09:52:40 ----D---- C:\WINDOWS\AppPatch
2011-09-09 09:51:47 ----D---- C:\Program Files\Common Files
2011-09-09 09:40:56 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-09-09 09:20:02 ----RD---- C:\Program Files
2011-09-09 09:19:57 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-09-09 09:17:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-09-09 09:00:10 ----RASH---- C:\boot.ini
2011-09-08 23:01:55 ----D---- C:\WINDOWS\Help
2011-09-08 21:47:02 ----SHD---- C:\WINDOWS\Installer
2011-09-08 21:46:55 ----D---- C:\Config.Msi
2011-09-08 21:45:25 ----HD---- C:\WINDOWS\inf
2011-09-08 21:43:15 ----D---- C:\WINDOWS\WinSxS
2011-09-08 21:35:23 ----SHD---- C:\WINDOWS\CSC
2011-09-07 06:43:26 ----D---- C:\Program Files\World of Warcraft
2011-09-07 06:40:57 ----D---- C:\WINDOWS\Minidump
2011-09-04 06:11:13 ----D---- C:\Documents and Settings\Kuře\Data aplikací\Skype
2011-09-02 14:36:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2011-09-02 14:36:17 ----D---- C:\Program Files\Google
2011-09-02 14:36:05 ----SD---- C:\WINDOWS\Tasks
2011-08-27 13:31:12 ----A---- C:\WINDOWS\winamp.ini
2011-08-25 16:41:05 ----D---- C:\Documents and Settings\Kuře\Data aplikací\EleFun Games
2011-08-17 18:28:57 ----D---- C:\WINDOWS\system32\DirectX
2011-08-17 18:28:50 ----RSD---- C:\WINDOWS\assembly
2011-08-17 18:26:27 ----D---- C:\Program Files\Codemasters
2011-08-17 15:42:23 ----D---- C:\Program Files\Valve
2011-08-17 15:41:23 ----D---- C:\Program Files\Kouzelny morsky svet 2 - Okolo sveta
2011-08-17 15:39:14 ----D---- C:\Program Files\Pruzkumnici - Ztraceni v oceanu
2011-08-17 15:37:56 ----HD---- C:\Program Files\InstallShield Installation Information
2011-08-17 15:37:55 ----D---- C:\Program Files\SCi Games
2011-08-17 15:31:50 ----D---- C:\Program Files\Sara Maribu a ztraceny svet

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-07-11 32464]
R0 prohlp02;StarForce Protection Helper Driver v2; C:\WINDOWS\System32\drivers\prohlp02.sys [2006-12-23 77120]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\WINDOWS\System32\drivers\prosync1.sys [2005-12-21 7136]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-08-25 36528]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2006-07-05 59256]
R0 sfhlp01;StarForce Protection Helper Driver; C:\WINDOWS\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-09-17 691696]
R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-15 76544]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-17 41216]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-07-11 229840]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2006-12-23 80768]
R1 SpyEmrg;Spy Emergency Driver; C:\WINDOWS\System32\Drivers\spyemrg.sys [2008-02-05 12344]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 DgiVecp;Team MFP Comm Driver; C:\WINDOWS\System32\Drivers\DgiVecp.sys [2003-07-29 40448]
R2 SVKP;SVKP; \??\C:\WINDOWS\system32\SVKP.sys []
R3 Avgfwdx;Avgfwdx; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-07-11 16720]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 TMBUS;Thrustmapper Device Enumerator; C:\WINDOWS\system32\drivers\TMBUS.sys [2001-12-17 12283]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\vinyl97.sys [2005-08-03 202112]
S0 BTHidMgr;Bluetooth HID Manager Service; C:\WINDOWS\System32\Drivers\BTHidMgr.sys []
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S1 NPPTNT2;NPPTNT2; \??\C:\WINDOWS\system32\npptNT2.sys []
S1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
S3 a120x35a;a120x35a; C:\WINDOWS\system32\drivers\a120x35a.sys []
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501); C:\WINDOWS\system32\DRIVERS\adusbmdm65.sys [2005-05-02 64896]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys []
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501); C:\WINDOWS\system32\DRIVERS\adusbser65.sys [2005-05-02 64896]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS []
S3 Avgfwfd;AVG network filter service; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2011-05-23 30944]
S3 Bcfilter;Jetico Personal Firewall Network Monitor; C:\WINDOWS\system32\DRIVERS\bcfilter.sys []
S3 BcfilterMP;BcfilterMP; C:\WINDOWS\system32\DRIVERS\bcfilter.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys []
S3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys []
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys []
S3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys []
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\KUE~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 cmudau;C-Media USB Sound Interface; C:\WINDOWS\system32\drivers\cmudau.sys [2005-11-16 809536]
S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-12-21 10976]
S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2008-12-21 22368]
S3 hidgame;Microsoft Hid to Joystick Port Enabler; C:\WINDOWS\system32\DRIVERS\hidgame.sys [2001-08-17 8576]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 npkcrypt;npkcrypt; \??\C:\Hry\Lineage 2\system\npkcrypt.sys []
S3 PSSdk23;PSSdk23; \??\C:\WINDOWS\system32\Drivers\PsSdk23.drv []
S3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8029.SYS [2001-08-17 19017]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SpyEmrgAccess;Spy Emergency OnAccess Driver; C:\WINDOWS\System32\Drivers\spyemrg_access.sys [2008-08-11 15288]
S3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver; C:\WINDOWS\System32\Drivers\spyemrg_guard.sys [2008-02-05 14392]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 TMKEmu;Thrustmapper virtual Keyboard device driver; C:\WINDOWS\system32\drivers\TMKEmu.sys [2001-05-18 5042]
S3 TMMEmu;Thrustmapper virtual Mouse device driver; C:\WINDOWS\system32\drivers\TMMEmu.sys [2001-05-18 5042]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys [2006-09-18 223128]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avgfws;AVG Firewall; C:\Program Files\AVG\AVG2012\avgfws.exe [2011-08-19 2399560]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-08-16 5264736]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 ProtexisLicensing;ProtexisLicensing; C:\Program Files\Common Files\Protexis\License Service\PSIService.exe [2006-11-02 174656]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2006-03-04 221184]
R2 vToolbarUpdater;vToolbarUpdater; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-09-08 246600]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-02 136176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-02 136176]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-09-02 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
S4 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe []
S4 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service []
S4 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service []
S4 MerakSMTP;Merak SMTP; C:\Program Files\Merak\smtp.exe [2007-03-15 1440256]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-05-02 75136]
S4 SpyEmrgSrv;Spy Emergency Engine Service; C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe [2008-08-25 645688]

-----------------EOF-----------------

[JaRon]

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Driver::
SVKP

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[markett]

No je to divne, ale stale se deje totez. ComboFix se spusti, vytvori bod obnoveni a zacnou ty jednotlive faze. U faze 50 to skonci a nic se nedeje dalsi dlouhou dobu

[JaRon]

restartuj PC do nudzoveho rezimu a vykonaj akciu tam

[markett]

Tak se podarilo

ComboFix 11-09-09.03 - Administrator 09.09.2011 12:08:10.4.1 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.583 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Drivers\atapi.sys . . . je infikován!!
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_SVKP
-------\Service_SVKP
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_SVKP
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-08-09 do 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 10:01 . 2011-09-09 10:01 -------- d-----w- c:\documents and settings\Administrator
2011-09-09 05:17 . 2011-09-09 05:17 -------- d-----w- C:\rsit
2011-09-08 20:22 . 2011-09-08 20:22 -------- d-----w- C:\$AVG
2011-09-08 19:45 . 2011-09-08 19:45 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2011-09-08 19:45 . 2011-09-08 19:45 -------- d-----w- c:\program files\AVG Secure Search
2011-09-08 19:45 . 2011-09-08 19:45 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\Common Files
2011-09-08 19:44 . 2011-09-09 00:12 -------- d-----w- c:\windows\system32\drivers\AVG
2011-09-08 19:44 . 2011-09-08 19:53 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2012
2011-09-08 19:43 . 2011-09-08 19:43 -------- d-----w- c:\program files\AVG
2011-09-08 19:38 . 2011-09-09 08:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\MFAData
2011-08-30 13:43 . 2011-08-30 13:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Particles
2011-08-30 13:39 . 2011-08-30 13:40 -------- d-----w- c:\program files\Rybicky 2 - Na nove adrese
2011-08-25 14:37 . 2011-08-25 14:40 -------- d-----w- c:\program files\Moje cukrarna 3
2011-08-22 10:27 . 2011-08-22 10:27 -------- d-----w- c:\program files\Zahadna kucharka
2011-08-18 23:22 . 2011-08-18 23:22 719228 ----a-w- c:\windows\Counter Strike 1.6 Reloaded Uninstaller.exe
2011-08-18 23:18 . 2011-08-18 23:19 -------- d-----w- c:\program files\Counter Strike 1.6 Reloaded
2011-08-11 19:00 . 2011-08-11 19:00 -------- d-----w- c:\program files\TopCD
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-08 04:08 . 2011-08-08 04:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2011-07-10 23:14 . 2011-07-10 23:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-07-10 23:14 . 2011-07-10 23:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-07-10 23:14 . 2011-07-10 23:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys
2011-07-10 23:14 . 2011-07-10 23:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
2011-07-10 23:14 . 2011-07-10 23:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-07-10 23:13 . 2011-07-10 23:13 229840 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-07-10 23:13 . 2011-07-10 23:13 32464 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-06-26 11:22 . 2006-01-30 17:02 98304 ----a-w- c:\windows\DUMP9114.tmp
2011-06-20 06:50 . 2004-07-17 09:36 12464 ----a-w- c:\windows\system32\drivers\secdrv.sys
2005-03-31 21:17 . 2006-02-08 05:40 40960 -c--a-w- c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-09-08 19:45 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-09-08 1451336]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\McAfee Security Scan.lnk
backup=c:\windows\pss\McAfee Security Scan.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-06 21:46 57344 -c--a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
2005-09-06 10:10 450560 ----a-w- c:\program files\VIAudioi\SBADeck\ADeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]
2011-08-19 04:24 2387296 ----a-w- c:\program files\AVG\AVG2012\avgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-17 13:49 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
2006-11-20 11:24 863744 -c--a-w- c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 14:15 221184 -c--a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 14:15 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 -c--a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
2006-11-27 23:12 2658304 -c--a-w- c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 13:01 13529088 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 13:01 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 13:01 1630208 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
2007-03-23 12:20 227328 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-06-28 19:29 32768 -c--a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
2008-08-25 16:39 2030136 ----a-w- c:\program files\NETGATE\Spy Emergency 2008\SpyEmergency.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatBar]
2005-01-26 18:07 339456 -c--a-w- c:\program files\Globe Software\StatBar\StatBar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-10-14 14:29 1242448 ----a-w- c:\hry\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 02:00 132496 ----a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThrustTSR]
2003-04-10 09:44 217088 -c--a-w- c:\program files\Thrustmaster\Thrustmapper\TMTMTSR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]
2011-09-08 19:45 218440 ----a-w- c:\program files\AVG Secure Search\vprot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SpyEmrgSrv"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"MyWebSearchService"=2 (0x2)
"gusvc"=3 (0x3)
"gupdate"=2 (0x2)
"MerakSMTP"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Hry\\Steam\\SteamApps\\aifel\\counter-strike source\\hl2.exe"=
"c:\\Hry\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Hry\\UT2004\\System\\UT2004.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\SimpleCenter\\Home Media Server.exe"=
"c:\\Program Files\\Infogrames\\RollerCoaster Tycoon 2\\RTC.EXE"=
"c:\\Program Files\\Infogrames\\RollerCoaster Tycoon 2\\RCT.EXE"=
"c:\\Program Files\\Cenega Czech\\VIETCONG\\vietcong.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Hry\\Steam\\SteamApps\\aifel\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Hry\\Steam\\Steam.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Hry\\Steam\\SteamApps\\common\\stalker shadow of chernobyl\\bin\\XR_3DA.exe"=
"c:\\Hry\\Steam\\SteamApps\\common\\infernal\\game\\game.exe"=
"c:\\Hry\\Steam\\SteamApps\\common\\company of heroes\\RelicCOH.exe"=
"c:\\Hry\\Steam\\SteamApps\\common\\company of heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"c:\\Documents and Settings\\Kuře\\Plocha\\MOJE MP3\\Phone\\Skype.exe"=
"c:\\Program Files\\Counter Strike 1.6 Reloaded\\hl.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11.7.2011 1:14 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11.7.2011 1:13 32464]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11.7.2011 1:14 295248]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.9.2006 20:18 691696]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11.7.2011 1:13 229840]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S1 SpyEmrg;Spy Emergency Driver;c:\windows\system32\drivers\spyemrg.sys [3.11.2008 10:26 12344]
S2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [19.8.2011 6:24 2399560]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [16.8.2011 6:27 5264736]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2.8.2011 6:09 192776]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2.9.2011 14:36 136176]
S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [8.9.2011 21:45 246600]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [6.4.2007 11:08 64896]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\adusbser.sys --> c:\windows\system32\DRIVERS\adusbser.sys [?]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [6.4.2007 11:08 64896]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [23.5.2011 1:03 30944]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11.7.2011 1:14 134608]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11.7.2011 1:14 24272]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11.7.2011 1:14 16720]
S3 Bcfilter;Jetico Personal Firewall Network Monitor;c:\windows\system32\DRIVERS\bcfilter.sys --> c:\windows\system32\DRIVERS\bcfilter.sys [?]
S3 BcfilterMP;BcfilterMP;c:\windows\system32\DRIVERS\bcfilter.sys --> c:\windows\system32\DRIVERS\bcfilter.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [21.12.2008 15:45 10976]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2.9.2011 14:36 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.1.2010 14:49 227232]
S3 SpyEmrgAccess;Spy Emergency OnAccess Driver;c:\windows\system32\drivers\spyemrg_access.sys [3.11.2008 10:26 15288]
S3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;c:\windows\system32\drivers\spyemrg_guard.sys [3.11.2008 10:26 14392]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [18.9.2006 20:21 223128]
S4 SpyEmrgSrv;Spy Emergency Engine Service;c:\program files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe [3.11.2008 10:26 645688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Obsah adresáře 'Naplánované úlohy'
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-02 12:36]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-02 12:36]
.
2011-09-09 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-01-02 18:15]
.
.
------- Doplňkový sken -------
.
LSP: c:\windows\system32\DRWEBSP.DLL
TCP: DhcpNameServer = 192.168.168.254 95.80.224.41
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKU-Default-RunOnce-IETI - c:\program files\Skype\Phone\IEPlugin\unins000.exe
MSConfigStartUp-CloneCDTray - c:\program files\SlySoft\CloneCD\CloneCDTray.exe
MSConfigStartUp-CmUsbSound - cmcnfgu.cpl
MSConfigStartUp-DAEMON Tools - c:\program files\DAEMON Tools\daemon.exe
MSConfigStartUp-DAEMON Tools-1033 - c:\program files\D-Tools\daemon.exe
MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 12:23
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSSdk23]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk23.drv"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e1,e9,d6,1f,ad,93,fc,f6,54,14,5f,7a,c3,4d,f5,29,29,76,b9,ce,3b,35,ae,
1c,de,6e,71,c3,02,f5,23,f7,21,4e,17,15,a8,16,14,30,94,65,ad,7c,b9,55,90,98,\
"??"=hex:7b,07,dd,de,81,16,88,93,83,ec,b4,42,15,9b,ba,39
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Celkový čas: 2011-09-09 12:28:32 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-09-09 10:28
.
Před spuštěním: 5 673 635 840
Po spuštění: 5 558 407 168
.
- - End Of File - - 203CA29DB23711F9D37E974C9208F744

[JaRon]

no este to chvilu potrva ,,,
prescanuj PC s MBAM - rychla kontrola

[markett]

Tak to se taky podarilo a tady je log.

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 7683

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

9.9.2011 13:31:43
mbam-log-2011-09-09 (13-31-38).txt

Typ kontroly: Rychlý test
Testované objekty: 179488
Uplynulý čas: 5 minut, 32 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 3
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 0
Infikované složky: 3
Infikované soubory: 4

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Value: f3PopularScreensavers -> No action taken.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
c:\documents and settings\Kuře\data aplikací\funwebproducts (Adware.MyWebSearch) -> No action taken.
c:\documents and settings\Kuře\data aplikací\funwebproducts\Data (Adware.MyWebSearch) -> No action taken.
c:\documents and settings\Kuře\data aplikací\funwebproducts\Data\Kuře (Adware.MyWebSearch) -> No action taken.

Infikované soubory:
c:\documents and settings\Kuře\dokumenty\downloads\zwinkysetup2.3.64.2.zjfox000.exe (Adware.MyWebSearch) -> No action taken.
c:\program files\mozilla firefox\plugins\NPMyWebS.dll (Adware.MyWebSearch) -> No action taken.
c:\documents and settings\Kuře\data aplikací\wiaservg.log (Malware.Trace) -> No action taken.
c:\documents and settings\Kuře\data aplikací\funwebproducts\Data\Kuře\avatar.dat (Adware.MyWebSearch) -> No action taken.

[JaRon]

fajn vsetko nechaj odstranit v MBAM - restart do normal modu a tam skus pustit ComboFix - bez scriptu
ak by to trvalo dlhsie ako 25min - necakaj a napis

[markett]

No tak v normal modu se to zase zasekne na fazi 50 a dal se nic nedeje

[JaRon]

1. odinstaluj Spy Emergency 2008
2. spust ComboFix v nudzovom rezime - bez scriptu
zial ja to uz dnes s Tebou nedostiahnem do vitazneho konca - idem na jarmok

[markett]

nevadi...i tak diky za cas. Snad se nekdo najde. Mej se pekne