NB zamrzá a nahodile se restartuje

[Tyris]

Zdravím, prosím o kontrolu logu.
NB se mi (cca 1x denně) zamrzne, na obrazovce se objeví barevné pruhy a musím ho restartovat. Dělá to zcela nahodile. Také přestala fungovat HW akcelerace videí ve všech prohlížečích.

Jedná se o NB:
Asus K50AB
AMD Turion X2 Dual-Core Mobile RM-75 2.20 GHz
ATI Mobility Radeon 4570
3.00 GB RAM
Windows 7 (64) SP1









Logfile of random's system information tool 1.09 (written by random/random)
Run by ew at 2012-05-07 18:30:58
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 36 GB (47%) free of 76 GB
Total RAM: 3071 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:31:33, on 7.5.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files\trend micro\ew.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared

\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [SRS Premium Sound] "C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" /hideme
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\ew\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Download all by FlashGet3 - C:\Users\ew\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Users\ew\AppData\Roaming\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://D:\MICROS~1\Office14\ONBttnIE.dll/105
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SRS Volume Sync Service (SRS_VolSync_Service) - SRS Labs, Inc. - C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Sensor View Service (sviewsvc) - Unknown owner - C:\Program Files (x86)\SensorsView\drv\svsvc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file

missing)

--
End of file - 9070 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1

ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1

ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Windows\system32\FBAgent.exe"
"C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files\ATKGFNEX\GFNEXSrv.exe"
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
"C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
"C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
WLIDSvcM.exe 2128
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
taskhost.exe USER
"C:\Windows\system32\Dwm.exe"
taskeng.exe {61DD7C5C-73F2-486A-A103-63CBDC3779B5}
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe"
"C:\Program Files (x86)\ASUS\Splendid\ACMON.exe"
"C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"
"C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
Atouch64.exe
"C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" /hideme
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
ATKOSD.exe
"C:\Windows\SysWOW64\ACEngSvr.exe" -Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe"
KBFiltr.exe
"C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe"
WDC.exe
"C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe"
"C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\SensorsView\drv\svsvc.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding
"C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe"
C:\Windows\system32\AUDIODG.EXE 0x698
"C:\Program Files (x86)\rsit\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"c:\program files\windows defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 2262D1F9-9FB7-1E8E-5204-3CAD2490ECB9 -Reinvoke

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2009-06-12 619392]
"SpywareTerminatorShield"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2012-03-28 2786480]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SRS Premium Sound"=C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe [2009-07-10 3754232]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"Google Update"=C:\Users\ew\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-27 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-06-06 35736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
D:\Microsoft Office Enterprise 2007\Office14\BCSSync.exe /DelayServices []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\Users\ew\Program Files (x86)\DNA\btdna.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2000-01-01 2472048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [2009-08-17 6859392]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [2009-04-20 159744]
"avast"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2012-03-07 4241512]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-26 336384]

[HKEY_CURRENT_USER\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"RGSC"=D:\Hry\GTA IV\RGSC\Rockstar Games Social Club\RGSCLauncher.exe /silent []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-05-07 18:30:58 ----D---- C:\rsit
2012-05-07 18:30:58 ----D---- C:\Program Files\trend micro
2012-05-07 18:30:08 ----D---- C:\Program Files (x86)\rsit
2012-05-07 18:27:17 ----D---- C:\Program Files (x86)\HijackThis
2012-05-07 17:28:02 ----A---- C:\Windows\system32\drivers\stflt.sys
2012-05-07 17:28:01 ----D---- C:\Users\ew\AppData\Roaming\Spyware Terminator
2012-05-07 17:28:01 ----D---- C:\ProgramData\Spyware Terminator
2012-05-07 17:26:10 ----D---- C:\Program Files (x86)\Spyware Terminator
2012-05-07 17:26:02 ----D---- C:\Program Files\Core Temp
2012-05-04 21:36:08 ----D---- C:\Program Files (x86)\1ClickDownload
2012-04-29 15:10:53 ----D---- C:\ProgramData\ATI
2012-04-29 15:10:18 ----D---- C:\Program Files (x86)\ATI Stream
2012-04-29 15:09:22 ----D---- C:\Program Files (x86)\ATI Technologies
2012-04-29 15:06:58 ----D---- C:\Program Files\ATI
2012-04-29 15:06:09 ----D---- C:\Program Files\ATI Technologies
2012-04-28 22:43:07 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2012-04-28 20:45:20 ----A---- C:\Windows\SYSWOW64\ativvsvl.dat
2012-04-28 20:45:20 ----A---- C:\Windows\SYSWOW64\ativvsva.dat
2012-04-28 20:45:20 ----A---- C:\Windows\system32\ativvsvl.dat
2012-04-28 20:45:20 ----A---- C:\Windows\system32\ativvsva.dat
2012-04-14 11:58:38 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2012-04-13 13:40:15 ----D---- C:\Windows\cs
2012-04-12 23:25:22 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2012-04-11 22:18:02 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2012-04-11 17:31:05 ----A---- C:\Windows\system32\mshtmled.dll
2012-04-11 17:31:04 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2012-04-11 17:31:03 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2012-04-11 17:31:03 ----A---- C:\Windows\system32\iertutil.dll
2012-04-11 17:31:01 ----A---- C:\Windows\SYSWOW64\url.dll
2012-04-11 17:31:01 ----A---- C:\Windows\system32\jscript9.dll
2012-04-11 17:31:00 ----A---- C:\Windows\SYSWOW64\ieui.dll
2012-04-11 17:31:00 ----A---- C:\Windows\system32\url.dll
2012-04-11 17:31:00 ----A---- C:\Windows\system32\ieui.dll
2012-04-11 17:30:59 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2012-04-11 17:30:59 ----A---- C:\Windows\SYSWOW64\jscript.dll
2012-04-11 17:30:58 ----A---- C:\Windows\system32\jscript.dll
2012-04-11 17:30:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2012-04-11 17:30:56 ----A---- C:\Windows\system32\urlmon.dll
2012-04-11 17:30:55 ----A---- C:\Windows\system32\jsproxy.dll
2012-04-11 17:30:54 ----A---- C:\Windows\SYSWOW64\wininet.dll
2012-04-11 17:30:52 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2012-04-11 17:30:52 ----A---- C:\Windows\system32\wininet.dll
2012-04-11 17:30:50 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2012-04-11 17:30:46 ----A---- C:\Windows\system32\mshtml.dll
2012-04-11 17:30:44 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2012-04-11 17:30:42 ----A---- C:\Windows\system32\ieframe.dll
2012-04-11 17:30:25 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-04-11 17:30:23 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2012-04-11 17:30:21 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2012-04-11 17:26:58 ----A---- C:\Windows\SYSWOW64\imagehlp.dll
2012-04-11 17:26:58 ----A---- C:\Windows\system32\imagehlp.dll
2012-04-11 17:26:58 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-04-11 17:26:55 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2012-04-11 17:26:54 ----A---- C:\Windows\SYSWOW64\wmi.dll
2012-04-11 17:26:54 ----A---- C:\Windows\system32\wmi.dll
2012-04-11 17:26:54 ----A---- C:\Windows\system32\wintrust.dll

======List of files/folders modified in the last 1 month======

2012-05-07 18:31:32 ----D---- C:\Windows\Prefetch
2012-05-07 18:31:24 ----D---- C:\Windows\Temp
2012-05-07 18:30:58 ----RD---- C:\Program Files
2012-05-07 18:30:08 ----RD---- C:\Program Files (x86)
2012-05-07 18:08:15 ----D---- C:\Windows\system32\config
2012-05-07 17:56:35 ----D---- C:\Windows\inf
2012-05-07 17:35:06 ----D---- C:\Users\ew\AppData\Roaming\uTorrent
2012-05-07 17:35:03 ----D---- C:\Windows\Minidump
2012-05-07 17:35:03 ----D---- C:\Windows
2012-05-07 17:28:02 ----AD---- C:\Windows\system32\drivers
2012-05-07 17:28:01 ----HD---- C:\ProgramData
2012-05-07 16:26:27 ----D---- C:\Windows\System32
2012-05-07 16:26:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-05-05 20:19:31 ----D---- C:\Windows\system32\NDF
2012-05-04 23:11:49 ----SHD---- C:\System Volume Information
2012-05-04 23:11:30 ----D---- C:\Program Files (x86)\Rockstar Games
2012-05-04 21:37:42 ----D---- C:\Program Files (x86)\uTorrent
2012-04-29 20:11:04 ----D---- C:\Windows\system32\catroot2
2012-04-29 17:01:22 ----D---- C:\Windows\SysWOW64
2012-04-29 16:53:42 ----D---- C:\Windows\system32\Tasks
2012-04-29 16:27:20 ----SHD---- C:\Config.Msi
2012-04-29 15:10:21 ----SHD---- C:\Windows\Installer
2012-04-29 15:09:06 ----D---- C:\ProgramData\AMD
2012-04-29 15:07:50 ----D---- C:\Windows\system32\catroot
2012-04-29 14:42:15 ----D---- C:\Program Files (x86)\Common Files
2012-04-29 14:42:14 ----D---- C:\Program Files (x86)\Adobe
2012-04-29 14:27:12 ----D---- C:\Windows\system32\DriverStore
2012-04-29 14:25:26 ----D---- C:\Program Files\Common Files
2012-04-29 12:23:20 ----D---- C:\Program Files (x86)\Advanced SystemCare 3
2012-04-29 12:21:54 ----D---- C:\Windows\Logs
2012-04-29 12:21:17 ----D---- C:\Users\ew\AppData\Roaming\Adobe
2012-04-28 22:43:08 ----D---- C:\Windows\SYSWOW64\directx
2012-04-28 22:12:00 ----D---- C:\AMD
2012-04-28 20:30:19 ----SHD---- C:\$Recycle.Bin
2012-04-27 20:49:28 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-04-24 15:15:16 ----D---- C:\Windows\LiveKernelReports
2012-04-13 15:25:43 ----D---- C:\Program Files (x86)\BlueVoda Website Builder
2012-04-13 13:38:31 ----D---- C:\Program Files (x86)\Windows Live
2012-04-13 10:53:56 ----A---- C:\Windows\system32\ServiceFilter.ini
2012-04-13 10:53:54 ----A---- C:\Windows\system32\AutoRunFilter.ini
2012-04-12 23:25:23 ----D---- C:\Windows\Tasks
2012-04-12 18:53:59 ----D---- C:\Windows\Microsoft.NET
2012-04-12 18:52:38 ----RSD---- C:\Windows\assembly
2012-04-12 11:08:55 ----D---- C:\Users\ew\AppData\Roaming\DAEMON Tools Lite
2012-04-12 11:08:33 ----D---- C:\Windows\debug
2012-04-11 22:41:16 ----D---- C:\Windows\winsxs
2012-04-11 22:37:59 ----D---- C:\Program Files (x86)\Internet Explorer
2012-04-11 22:37:58 ----D---- C:\Windows\SYSWOW64\migration
2012-04-11 22:37:58 ----D---- C:\Program Files\Internet Explorer
2012-04-11 22:37:56 ----D---- C:\Windows\system32\migration
2012-04-11 22:18:02 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2012-04-11 17:27:35 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-12-04 530488]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2012-03-07 53080]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2012-03-07 819032]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2012-03-07 337240]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2012-03-07 59224]
R1 SbFw;SbFw; C:\Windows\system32\drivers\SbFw.sys [2011-04-05 253528]
R1 SbTis;SbTis; C:\Windows\system32\drivers\sbtis.sys [2011-04-05 94296]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2012-03-07 24408]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2012-03-07 69976]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\Windows\system32\DRIVERS\stflt.sys [2012-05-07 51496]
R3 ALSysIO;ALSysIO; \??\C:\Users\ew\AppData\Local\Temp\ALSysIO64.sys []
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-01-27 9085952]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-01-27 299520]
R3 appliandMP;appliandMP; C:\Windows\system32\DRIVERS\appliand.sys [2011-06-26 33888]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-06-27 2753536]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-11 279616]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2009-06-12 112128]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 15416]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2009-05-13 15928]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2000-01-01 412264]
R3 SBFWIMCLMP;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\Windows\system32\DRIVERS\SBFWIM.sys [2011-02-08 84568]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-06-05 1806400]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound; C:\Windows\system32\drivers\srs_PremiumSound_amd64.sys [2009-05-18 343592]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-06-05 34872]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2000-01-01 1342064]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S0 giveio;giveio; C:\Windows\system32\drivers\giveio.sys []
S0 jxgrod;jxgrod; C:\Windows\system32\drivers\vaji.sys []
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S2 ASInsHelp;ASInsHelp; \??\C:\Windows\SysWow64\drivers\AsInsHelp64.sys []
S3 AF15BDA;AF9015 BDA Device; C:\Windows\system32\DRIVERS\AF15BDA.sys [2011-08-05 507392]
S3 appliand;Applian Network Service; C:\Windows\system32\DRIVERS\appliand.sys [2011-06-26 33888]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-01-27 9085952]
S3 CRFILTER;USB Mass Storage Filter; C:\Windows\system32\DRIVERS\CRFILTER.sys [2008-04-07 7168]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 132608]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 116992]
S3 hwusbfake;Huawei DataCard USB Fake; C:\Windows\system32\DRIVERS\ewusbfake.sys [2009-07-23 113792]
S3 nhcNT_driver;Notebook Hardware Control NT Driver; \??\C:\Windows\system32\drivers\nhcNT.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010\WNt500x64\Sandra.sys []
S3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Service; C:\Windows\system32\DRIVERS\sbfwim.sys [2011-02-08 84568]
S3 sbhips;sbhips; C:\Windows\system32\drivers\sbhips.sys [2011-04-05 60504]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
S3 tosporte;Bluetooth COM Port; C:\Windows\system32\DRIVERS\tosporte.sys [2009-06-17 54664]
S3 tosrfbd;Bluetooth RFBUS; C:\Windows\system32\DRIVERS\tosrfbd.sys [2009-08-28 211560]
S3 tosrfbnp;Bluetooth RFBNEP; C:\Windows\System32\Drivers\tosrfbnp.sys [2009-06-19 50664]
S3 Tosrfcom;Bluetooth RFCOMM; C:\Windows\System32\Drivers\tosrfcom.sys [2009-07-28 81768]
S3 Tosrfhid;Bluetooth RFHID; C:\Windows\system32\DRIVERS\Tosrfhid.sys [2009-06-19 94336]
S3 tosrfnds;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\tosrfnds.sys [2009-07-24 26472]
S3 TosRfSnd;Bluetooth Audio; C:\Windows\system32\drivers\tosrfsnd.sys [2009-08-05 63856]
S3 Tosrfusb;Bluetooth USB Controller; C:\Windows\system32\DRIVERS\tosrfusb.sys [2009-08-05 58744]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2008-05-24 154168]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S4 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\Windows\System32\drivers\sfdrv01.sys [2006-07-05 75640]
S4 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\Windows\System32\drivers\sfhlp02.sys [2006-06-14 14192]
S4 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\Windows\System32\drivers\sfvfs02.sys [2007-02-08 107384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe [2009-09-17 359552]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-01-27 203776]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
R2 AMD Reservation Manager;AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [2009-06-16 84536]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2012-03-07 44768]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 SRS_VolSync_Service;SRS Volume Sync Service; C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [2009-07-10 128224]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [2012-03-28 1148632]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]
R3 sviewsvc;Sensor View Service; C:\Program Files (x86)\SensorsView\drv\svsvc.exe [2005-10-30 221184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 135664]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 135664]
S3 gusvc;Google Updater Service; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-14 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2010-08-25 407336]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-18 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Také zdravím!
Log vypadá OK. Zkuste reinstalovat ovladače gr. karty a základní desky.

[Tyris]

Ovladače jsem již reinstaloval. Zkoušel jsem i starší verze ovladačů grafiky.
Stále nefunguje HW akcelerace (youtube, stream), místo videa se zobrazí zelená plocha, někdy spadne celý prohlížeč. Někdy se na obrazovce se z ničeho nic objeví barevné pruhy a musím ho restartovat. A teď jsem zjistil, že nelze přehrát DVD ve WMP.

[Rudy]

Obávám se, že půjde o hw problém (gr. karta). Dejte ještě pro jistotu log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Tyris]

Provedl jsem kontrolu pomocí ComboFix, postupoval jsem podle instrukcí a nyní nelze na NB spustit vůbec nic. Nelze spustit ani obnovení systému. Pokaždé to píše "Pokus použít neplatnou operaci na klíč registru, který je označen pro odstranení."

Prosím o rychlou pomoc.

[Rudy]

Zkuste nouz. režim a v něm obnovu systému k datu, kdy korektně fungoval. Mám ale podezření, že jde o hw problém. CF, pokud provede něco záludného, shodí systém zcela. Toto ale není ten případ.

[Tyris]

OK, přes nouzový režim šla spustit obnova.
Zde je tedy ještě ten log z ComboFix, ale taky si myslím že to bude bohužel HW chyba



ComboFix 12-05-07.02 - ew 07.05.2012 22:28:37.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3071.1995 [GMT 2:00]
Spuštěný z: c:\users\ew\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\programdata\xmlF2A9.tmp
c:\programdata\xmlF430.tmp
c:\programdata\xmlF51B.tmp
c:\users\ew\AppData\Roaming\.#
c:\users\ew\AppData\Roaming\.#\MBX@CF0@1EB2770.###
c:\users\ew\AppData\Roaming\.#\MBX@CF0@1EB27A0.###
c:\windows\SysWow64\tmp23F5.tmp
c:\windows\SysWow64\tmp23F6.tmp
c:\windows\SysWow64\tmp263B.tmp
c:\windows\SysWow64\tmp264B.tmp
c:\windows\SysWow64\tmp83CF.tmp
c:\windows\SysWow64\tmp83DF.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-07 do 2012-05-07 )))))))))))))))))))))))))))))))
.
.
2012-05-07 20:37 . 2012-05-07 20:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-07 19:39 . 2012-05-07 19:41 -------- d-----w- c:\windows\SysWow64\C2MP
2012-05-07 16:30 . 2012-05-07 16:31 -------- d-----w- C:\rsit
2012-05-07 16:30 . 2012-05-07 16:31 -------- d-----w- c:\program files\trend micro
2012-05-07 16:30 . 2012-05-07 16:30 -------- d-----w- c:\program files (x86)\rsit
2012-05-07 15:28 . 2012-05-07 15:28 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2012-05-07 15:28 . 2012-05-07 16:07 -------- d-----w- c:\programdata\Spyware Terminator
2012-05-07 15:28 . 2012-05-07 15:28 -------- d-----w- c:\users\ew\AppData\Roaming\Spyware Terminator
2012-05-07 15:26 . 2012-05-07 15:28 -------- d-----w- c:\program files (x86)\Spyware Terminator
2012-05-07 15:26 . 2012-05-07 15:26 -------- d-----w- c:\program files\Core Temp
2012-05-04 19:17 . 2012-04-13 08:46 8917360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F7993F5A-820D-481B-BD01-65BB4F631220}\mpengine.dll
2012-04-29 13:10 . 2012-04-29 13:10 -------- d-----w- c:\programdata\ATI
2012-04-29 13:10 . 2012-04-29 13:10 -------- d-----w- c:\program files (x86)\ATI Stream
2012-04-29 13:09 . 2012-04-29 13:09 -------- d-----w- c:\program files (x86)\ATI Technologies
2012-04-29 13:06 . 2012-04-29 13:06 -------- d-----w- c:\program files\ATI
2012-04-29 13:06 . 2012-04-29 13:09 -------- d-----w- c:\program files\ATI Technologies
2012-04-28 20:43 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2012-04-28 17:48 . 2012-04-28 17:49 -------- d-----w- c:\users\ew\AppData\Local\Akamai
2012-04-22 20:14 . 2012-04-22 20:14 4376576 ----a-w- c:\windows\system32\ffdshow.ax
2012-04-22 20:14 . 2012-04-22 20:14 3515392 ----a-w- c:\windows\SysWow64\ffdshow.ax
2012-04-22 20:14 . 2012-04-22 20:14 4489728 ----a-w- c:\windows\system32\ffmpeg.dll
2012-04-22 20:12 . 2012-04-22 20:12 4424704 ----a-w- c:\windows\SysWow64\ffmpeg.dll
2012-04-15 11:49 . 2012-04-15 11:49 -------- d-----w- c:\users\ew\AppData\Local\Jaksta_Technologies_Pty_L
2012-04-14 09:58 . 2012-04-14 09:58 8766112 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-13 11:40 . 2012-04-13 11:40 -------- d-----w- c:\windows\cs
2012-04-13 11:35 . 2012-04-13 11:35 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\82a2fbaf1cd196901\DSETUP.dll
2012-04-13 11:35 . 2012-04-13 11:35 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\82a2fbaf1cd196901\DXSETUP.exe
2012-04-13 11:35 . 2012-04-13 11:35 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\82a2fbaf1cd196901\dsetup32.dll
2012-04-12 21:25 . 2012-04-28 20:38 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-11 20:18 . 2012-04-11 20:18 279616 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-11 15:30 . 2012-02-28 01:18 1799168 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-04-11 15:26 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-11 15:26 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-11 15:26 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-04-11 15:26 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-04-11 15:26 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-04-11 15:26 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-11 15:26 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-04-08 23:47 . 2012-04-08 23:47 474624 ----a-w- c:\windows\system32\ff_kernelDeint.dll
2012-04-08 23:47 . 2012-04-08 23:47 92160 ----a-w- c:\windows\system32\ff_vfw.dll
2012-04-08 23:46 . 2012-04-08 23:46 631296 ----a-w- c:\windows\system32\TomsMoComp_ff.dll
2012-04-08 23:45 . 2012-04-08 23:45 183808 ----a-w- c:\windows\system32\ff_unrar.dll
2012-04-08 23:45 . 2012-04-08 23:45 156672 ----a-w- c:\windows\system32\ff_libmad.dll
2012-04-08 23:45 . 2012-04-08 23:45 114688 ----a-w- c:\windows\system32\ff_wmv9.dll
2012-04-08 23:45 . 2012-04-08 23:45 359424 ----a-w- c:\windows\system32\ff_libfaad2.dll
2012-04-08 23:45 . 2012-04-08 23:45 222720 ----a-w- c:\windows\system32\ff_libdts.dll
2012-04-08 23:45 . 2012-04-08 23:45 1532928 ----a-w- c:\windows\system32\ff_samplerate.dll
2012-04-08 23:45 . 2012-04-08 23:45 116224 ----a-w- c:\windows\system32\ff_liba52.dll
2012-04-08 23:40 . 2012-04-08 23:40 79360 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2012-04-08 23:39 . 2012-04-08 23:39 260608 ----a-w- c:\windows\SysWow64\TomsMoComp_ff.dll
2012-04-08 23:39 . 2012-04-08 23:39 99840 ----a-w- c:\windows\SysWow64\ff_wmv9.dll
2012-04-08 23:39 . 2012-04-08 23:39 158720 ----a-w- c:\windows\SysWow64\ff_unrar.dll
2012-04-08 23:39 . 2012-04-08 23:39 1525248 ----a-w- c:\windows\SysWow64\ff_samplerate.dll
2012-04-08 23:39 . 2012-04-08 23:39 146944 ----a-w- c:\windows\SysWow64\ff_libmad.dll
2012-04-08 23:39 . 2012-04-08 23:39 212480 ----a-w- c:\windows\SysWow64\ff_libdts.dll
2012-04-08 23:39 . 2012-04-08 23:39 115200 ----a-w- c:\windows\SysWow64\ff_liba52.dll
2012-04-08 23:39 . 2012-04-08 23:39 328704 ----a-w- c:\windows\SysWow64\ff_libfaad2.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-05 20:34 . 2012-04-05 20:34 187392 ----a-w- c:\windows\system32\clinfo.exe
2012-04-05 20:34 . 2012-04-05 20:34 74752 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-04-05 20:34 . 2012-04-05 20:34 64512 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-04-05 20:33 . 2012-04-05 20:33 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-04-05 20:33 . 2012-04-05 20:33 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-04-05 20:33 . 2012-04-05 20:33 16457216 ----a-w- c:\windows\system32\amdocl64.dll
2012-04-05 20:32 . 2012-04-05 20:32 13007872 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-04-05 20:32 . 2012-04-05 20:32 54784 ----a-w- c:\windows\system32\OpenCL.dll
2012-04-05 20:32 . 2012-04-05 20:32 50176 ----a-w- c:\windows\SysWow64\OpenCL.dll
2012-03-29 14:23 . 2012-03-29 14:23 775168 ----a-w- c:\windows\system32\LAVVideo.ax
2012-03-29 14:23 . 2012-03-29 14:23 555520 ----a-w- c:\windows\system32\LAVSplitter.ax
2012-03-29 14:23 . 2012-03-29 14:23 248832 ----a-w- c:\windows\system32\LAVAudio.ax
2012-03-29 14:23 . 2012-03-29 14:23 202240 ----a-w- c:\windows\system32\libbluray.dll
2012-03-29 14:23 . 2012-03-29 14:23 6757091 ----a-w- c:\windows\system32\avcodec-lav-54.dll
2012-03-29 14:23 . 2012-03-29 14:23 399620 ----a-w- c:\windows\system32\swscale-lav-2.dll
2012-03-29 14:23 . 2012-03-29 14:23 214711 ----a-w- c:\windows\system32\avutil-lav-51.dll
2012-03-29 14:23 . 2012-03-29 14:23 133299 ----a-w- c:\windows\system32\avfilter-lav-2.dll
2012-03-29 14:23 . 2012-03-29 14:23 1167294 ----a-w- c:\windows\system32\avformat-lav-54.dll
2012-03-29 14:21 . 2012-03-29 14:21 606720 ----a-w- c:\windows\SysWow64\LAVVideo.ax
2012-03-29 14:21 . 2012-03-29 14:21 462848 ----a-w- c:\windows\SysWow64\LAVSplitter.ax
2012-03-29 14:21 . 2012-03-29 14:21 217600 ----a-w- c:\windows\SysWow64\LAVAudio.ax
2012-03-29 14:21 . 2012-03-29 14:21 172032 ----a-w- c:\windows\SysWow64\libbluray.dll
2012-03-29 14:21 . 2012-03-29 14:21 6582226 ----a-w- c:\windows\SysWow64\avcodec-lav-54.dll
2012-03-29 14:21 . 2012-03-29 14:21 374152 ----a-w- c:\windows\SysWow64\swscale-lav-2.dll
2012-03-29 14:21 . 2012-03-29 14:21 207872 ----a-w- c:\windows\SysWow64\avutil-lav-51.dll
2012-03-29 14:21 . 2012-03-29 14:21 144523 ----a-w- c:\windows\SysWow64\avfilter-lav-2.dll
2012-03-29 14:21 . 2012-03-29 14:21 1152365 ----a-w- c:\windows\SysWow64\avformat-lav-54.dll
2012-03-27 15:08 . 2012-03-27 15:08 267264 ----a-w- c:\windows\SysWow64\IntelQuickSyncDecoder.dll
2012-03-27 15:08 . 2012-03-27 15:08 348160 ----a-w- c:\windows\system32\IntelQuickSyncDecoder.dll
2012-03-22 19:12 . 2012-03-22 19:12 4435968 ----a-w- c:\windows\SysWow64\GPhotos.scr
2012-03-08 16:37 . 2012-03-08 16:37 302448 ----a-w- c:\windows\WLXPGSS.SCR
2012-03-07 00:15 . 2010-06-29 06:13 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:15 . 2010-02-23 19:45 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-03-07 00:15 . 2011-01-17 14:36 258520 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-07 00:04 . 2011-02-23 20:38 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:04 . 2010-02-23 19:47 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2012-02-24 17:21 53080 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-03-07 00:01 . 2010-02-23 19:47 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2010-02-23 19:47 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2010-02-23 19:47 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2010-04-18 16:14 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 12:15 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 12:15 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 12:15 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 12:15 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-15 12:09 . 2012-02-15 12:09 1576448 ----a-w- c:\windows\system32\VSFilter.dll
2012-02-15 12:08 . 2012-02-15 12:08 1288192 ----a-w- c:\windows\SysWow64\VSFilter.dll
2012-02-10 06:36 . 2012-03-14 12:15 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 12:15 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2009-07-10 3754232]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-08-17 6859392]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2012-03-07 4241512]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ALSysIO;ALSysIO;c:\users\ew\AppData\Local\Temp\ALSysIO64.sys [x]
R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [x]
R3 CRFILTER;USB Mass Storage Filter;c:\windows\system32\DRIVERS\CRFILTER.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 135664]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 135664]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 nhcNT_driver;Notebook Hardware Control NT Driver;c:\windows\system32\drivers\nhcNT.sys [x]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys [x]
R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [x]
S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys [x]
S2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [2009-07-10 128224]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [2012-03-28 1148632]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 SBFWIMCLMP;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys [x]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\srs_PremiumSound_amd64.sys [x]
S3 sviewsvc;Sensor View Service;c:\program files (x86)\SensorsView\drv\svsvc.exe [2005-10-30 221184]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 20:03]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23 20:03]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000Core.job
- c:\users\ew\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-27 14:53]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000UA.job
- c:\users\ew\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-27 14:53]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 135408 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-06-12 619392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all by FlashGet3 - c:\users\ew\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\ew\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - d:\micros~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - d:\micros~1\Office14\ONBttnIE.dll/105
IE: ????3?? - c:\users\ew\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\ew\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
@Allowed: (Read) (RestrictedCode)
@="c:\\Users\\ew\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
@Allowed: (Read) (RestrictedCode)
@="c:\\Users\\ew\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:c2,ce,ad,8e,94,5a,e5,8a,68,92,4e,15,4c,f0,77,1b,a8,79,20,96,82,bb,e7,
fd,9f,d7,d7,6e,56,14,9a,8a,4c,97,b3,d7,b0,24,bd,b7,c4,37,2a,c1,c6,d3,1d,2d,\
"??"=hex:45,67,60,c8,45,a3,37,de,74,03,91,a4,e8,96,50,44
.
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\SecuROM\License information*]
"datasecu"=hex:cb,f9,07,cc,44,36,e1,09,20,87,3f,fb,eb,f6,c0,2b,0b,51,e8,b1,d5,
a6,cf,e6,bc,26,51,8f,14,a4,fe,c5,0c,d2,e1,26,c5,a1,b8,62,7c,87,e4,18,fb,7a,\
"rkeysecu"=hex:c6,db,3b,2e,51,65,5f,be,ea,fd,ae,d1,f8,41,de,8f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\ASUS\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Hotkey\Atouch64.exe
c:\program files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Hotkey\WDC.exe
.
**************************************************************************
.
Celkový čas: 2012-05-07 22:44:41 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-05-07 20:44
.
Před spuštěním: Volných bajtů: 38 821 261 312
Po spuštění: Volných bajtů: 38 585 012 224
.
- - End Of File - - EA3867A4BC2E6399A6AB70F8DE460118

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte doí něj:

KillAll::

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3613786397-1526620662-3840953830-1000UA.job

RegLock::
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}Ź]
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_fŹ3*N}ŹhQčţ”Ąc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Regnull::
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[HKEY_USERS\S-1-5-21-3613786397-1526620662-3840953830-1000\Software\SecuROM\License information*]

Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.



Na hw chybu to opravdu vypadá.

[Tyris]

Problémem jsem vyřešil nakonec obnovením systému do původního stavu (z recovery partition). Přesto díky

[Rudy]

Nemáte zač!