prosím o preventivku

[nlc_nlc]

Prosím o kontrolu a předem děkuji za váš čas a pomoc.
MS Security Essentials 10.4. daly do karantény Worm:Win32/Renocide.gen!C


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:14-05-2014
Ran by TOMAS (administrator) on FIALA on 15-05-2014 09:34:25
Running from C:\Documents and Settings\TOMAS\Plocha
Platform: Systém Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Autodesk) C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
(Microsoft Corporation) C:\WINDOWS\system32\inetsrv\inetinfo.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Viewpoint Corporation) C:\Program Files\Viewpoint\Common\ViewpointService.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare\3dxsrv.exe
(Viewpoint Corporation) C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
(Microsoft Corporation) C:\Program Files\Windows Desktop Search\WindowsSearch.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2008\Bin\Inventor.exe
(Macrovision Europe Ltd.) C:\DOCUME~1\TOMAS\LOCALS~1\temp\AdskCleanup.0001
(Autodesk) C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
(Macrovision Europe Ltd.) C:\DOCUME~1\TOMAS\LOCALS~1\temp\AdskCleanup.0001
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
(forum.viry.cz) C:\Documents and Settings\TOMAS\Plocha\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16248320 2006-06-28] (Realtek Semiconductor Corp.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\WINDOWS\system32\NvCpl.dll [15517472 2013-01-31] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] => C:\WINDOWS\system32\NvMCTray.dll [108832 2013-01-31] (NVIDIA Corporation)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1982312 2013-01-31] ()
HKLM\...\Run: [SkyTel] => C:\WINDOWS\SkyTel.EXE [2879488 2006-05-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
HKU\.DEFAULT\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [437160 2007-02-26] (Microsoft Corporation)
HKU\S-1-5-21-1788972911-4054794295-2163327169-1005\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Service Manager.lnk
ShortcutTarget: Service Manager.lnk -> C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare\3dxsrv.exe (3Dconnexion, INC)
Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kamweb.ruk.cuni.cz/webkredit/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - &Adresa - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Společnost Microsoft)
Toolbar: HKCU - &Odkazy - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E}
DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/ ... ontrol.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/sh ... wflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.10

FireFox:
========
FF ProfilePath: C:\Documents and Settings\TOMAS\Data aplikací\Mozilla\Firefox\Profiles\5x8so6fj.default
FF Homepage: www.google.cz
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @viewpoint.com/VMP - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll (Viewpoint Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll (Dassault Systèmes SolidWorks Corp.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: AutoFormer - C:\Documents and Settings\TOMAS\Data aplikací\Mozilla\Firefox\Profiles\5x8so6fj.default\Extensions\{5556F97E-11A5-46b0-9082-32AD74AAA920} [2014-02-04]
FF Extension: DownloadHelper - C:\Documents and Settings\TOMAS\Data aplikací\Mozilla\Firefox\Profiles\5x8so6fj.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26]
FF Extension: Autofill - C:\Documents and Settings\TOMAS\Data aplikací\Mozilla\Firefox\Profiles\5x8so6fj.default\Extensions\firefox-autofill@googlegroups.com.xpi [2014-01-30]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2014-05-12]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-05-12]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-05-12]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2014-05-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-12-10]

========================== Services (Whitelisted) =================

R2 Autodesk Data Management Job Dispatch; C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe [32768 2007-08-17] (Autodesk)
R2 IISADMIN; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-03-17] (Oracle Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
R2 MSSQL$AUTODESKVAULT; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$INVENTORCONTENT; C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe [7520337 2002-12-17] (Microsoft Corporation)
S3 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SMTPSVC; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2007-11-07] (SolidWorks)
S3 SQLAgent$INVENTORCONTENT; C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE [311872 2002-12-17] (Microsoft Corporation)
R2 Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [24652 2007-01-04] (Viewpoint Corporation)
R2 W3SVC; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation)
R3 BCMTPM; C:\WINDOWS\System32\DRIVERS\btpmw32.sys [17290 2005-12-08] (Broadcom Corp.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\WINDOWS\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S1 P3; C:\WINDOWS\System32\DRIVERS\p3.sys [46592 2008-04-14] (Microsoft Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [68168 2010-05-06] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SMOLY; C:\WINDOWS\System32\DRIVERS\SMOLY.SYS [49235 2000-03-22] (SCM Microsystems Inc.,)
S3 BOCDRIVE; \??\C:\Program Files\Comodo\CBOClean\BOCDRIVE.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-15 09:26 - 2014-05-15 09:34 - 00015774 _____ () C:\Documents and Settings\TOMAS\Plocha\FRST.txt
2014-05-15 09:25 - 2014-05-15 09:34 - 00000000 ____D () C:\FRST
2014-05-15 09:25 - 2014-05-15 09:25 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\TOMAS\Plocha\FRSTLauncher.exe
2014-05-15 09:24 - 2014-05-15 09:25 - 01056256 _____ (Farbar) C:\Documents and Settings\TOMAS\Plocha\FRST.exe
2014-05-15 09:15 - 2014-05-15 09:15 - 00781909 _____ () C:\Documents and Settings\TOMAS\Plocha\RSIT.exe
2014-05-12 07:30 - 2014-05-12 07:30 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-05 15:06 - 2014-05-05 15:09 - 00007280 _____ () C:\WINDOWS\KB2964358-IE8.log
2014-05-05 08:31 - 2014-03-25 16:01 - 03060304 _____ () C:\Documents and Settings\TOMAS\Plocha\23163-01.00_00.stp
2014-04-30 15:08 - 2014-04-30 15:08 - 00000403 _____ () C:\WINDOWS\wmsetup.log
2014-04-30 07:33 - 2014-05-05 06:18 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-04-28 08:51 - 2014-04-28 08:51 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\OldVersions
2014-04-28 07:54 - 2014-04-28 07:54 - 02405145 _____ () C:\Documents and Settings\TOMAS\Plocha\3524_5010-xxx-03.STEP
2014-04-16 14:13 - 2014-04-16 14:13 - 00004088 _____ () C:\WINDOWS\system32\jupdate-1.7.0_55-b13.log
2014-04-16 14:13 - 2014-03-17 22:11 - 00094632 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2014-04-16 14:13 - 2014-03-17 22:02 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-04-16 14:13 - 2014-03-17 22:02 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-04-16 14:13 - 2014-03-17 22:02 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe

==================== One Month Modified Files and Folders =======

2014-05-15 09:34 - 2014-05-15 09:26 - 00015774 _____ () C:\Documents and Settings\TOMAS\Plocha\FRST.txt
2014-05-15 09:34 - 2014-05-15 09:25 - 00000000 ____D () C:\FRST
2014-05-15 09:34 - 2007-10-18 12:51 - 00000000 ___HD () C:\Documents and Settings\TOMAS\Local Settings\Data aplikací
2014-05-15 09:34 - 2007-10-18 12:51 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha
2014-05-15 09:33 - 2008-05-13 07:17 - 00004834 _____ () C:\WINDOWS\wincmd.ini
2014-05-15 09:25 - 2014-05-15 09:25 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\TOMAS\Plocha\FRSTLauncher.exe
2014-05-15 09:25 - 2014-05-15 09:24 - 01056256 _____ (Farbar) C:\Documents and Settings\TOMAS\Plocha\FRST.exe
2014-05-15 09:15 - 2014-05-15 09:15 - 00781909 _____ () C:\Documents and Settings\TOMAS\Plocha\RSIT.exe
2014-05-15 09:15 - 2009-06-01 12:18 - 00000000 ____D () C:\Program Files\trend micro
2014-05-15 08:53 - 2013-05-13 06:20 - 00000914 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-05-15 06:24 - 2014-04-01 06:32 - 00000396 ____H () C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
2014-05-15 06:24 - 2004-09-08 16:50 - 02067797 _____ () C:\WINDOWS\WindowsUpdate.log
2014-05-15 06:18 - 2014-01-06 07:28 - 00157184 _____ () C:\Documents and Settings\TOMAS\Plocha\docházka 2014.xls
2014-05-15 06:18 - 2005-10-28 00:59 - 00000000 ____D () C:\WINDOWS\system32\inetsrv
2014-05-15 06:16 - 2005-10-28 00:56 - 00000000 ____D () C:\WINDOWS\Registration
2014-05-15 06:15 - 2014-03-18 07:22 - 00000222 _____ () C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
2014-05-15 06:15 - 2004-09-08 16:27 - 00001158 _____ () C:\WINDOWS\system32\wpa.dbl
2014-05-15 06:14 - 2004-09-08 17:00 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-05-14 15:59 - 2007-10-18 12:51 - 00000272 ___SH () C:\Documents and Settings\TOMAS\ntuser.ini
2014-05-14 15:59 - 2004-09-08 17:00 - 00032406 _____ () C:\WINDOWS\SchedLgU.Txt
2014-05-14 14:52 - 2014-02-24 13:50 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Vakuová komora s magnetrony (ZČU Plzeň)
2014-05-14 14:22 - 2007-10-18 12:51 - 00000000 ____D () C:\Documents and Settings\TOMAS
2014-05-14 13:08 - 2013-10-24 09:56 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Pec pro růst krystalů (MFF - Sechovský)
2014-05-14 11:02 - 2011-09-29 13:49 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\R&R komora - PANT
2014-05-14 06:42 - 2009-01-13 11:39 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\složka
2014-05-14 06:14 - 2012-05-04 06:20 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-13 06:52 - 2013-09-20 11:03 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\SASE3 (Syresin)
2014-05-12 13:56 - 2007-10-18 13:43 - 00002479 _____ () C:\Documents and Settings\All Users\Nabídka Start\Nový dokument Office.lnk
2014-05-12 07:43 - 2014-03-20 10:59 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Díly kryostatu (FZU - Pokorný)
2014-05-12 07:30 - 2014-05-12 07:30 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 07:35 - 2009-05-13 10:37 - 00000180 _____ () C:\WINDOWS\hpbafd.ini
2014-05-06 14:14 - 2013-02-07 15:26 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\MCP 2 (Syresin)
2014-05-05 15:09 - 2014-05-05 15:06 - 00007280 _____ () C:\WINDOWS\KB2964358-IE8.log
2014-05-05 15:09 - 2014-02-18 07:36 - 00009269 _____ () C:\WINDOWS\updspapi.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00079480 _____ () C:\WINDOWS\iis6.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00068009 _____ () C:\WINDOWS\FaxSetup.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00032516 _____ () C:\WINDOWS\ocgen.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00031031 _____ () C:\WINDOWS\tsoc.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00022556 _____ () C:\WINDOWS\comsetup.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00021262 _____ () C:\WINDOWS\msmqinst.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00013663 _____ () C:\WINDOWS\ntdtcsetup.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00011913 _____ () C:\WINDOWS\netfxocm.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00004675 _____ () C:\WINDOWS\MedCtrOC.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00004246 _____ () C:\WINDOWS\ocmsn.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00003421 _____ () C:\WINDOWS\tabletoc.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00003399 _____ () C:\WINDOWS\msgsocm.log
2014-05-05 15:09 - 2014-01-31 16:04 - 00001355 _____ () C:\WINDOWS\imsins.log
2014-05-05 15:09 - 2009-05-29 10:57 - 00000000 ____D () C:\WINDOWS\ie8updates
2014-05-05 06:18 - 2014-04-30 07:33 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-04-30 15:08 - 2014-04-30 15:08 - 00000403 _____ () C:\WINDOWS\wmsetup.log
2014-04-30 15:08 - 2008-02-05 08:45 - 00036864 _____ () C:\Documents and Settings\TOMAS\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-30 12:15 - 2007-12-18 14:55 - 00129654 _____ () C:\inv_oktodelete.bmp
2014-04-30 10:12 - 2008-04-21 08:45 - 06022144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtml.dll
2014-04-30 10:12 - 2004-09-08 16:27 - 06022144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-04-28 14:58 - 2010-05-12 14:06 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\vlastní projekty
2014-04-28 13:26 - 2012-04-06 06:45 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Kufa 8x10_D
2014-04-28 13:25 - 2009-04-17 10:50 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\B&W
2014-04-28 10:26 - 2007-10-22 10:42 - 00000000 ____D () C:\Documents and Settings\TOMAS\Dokumenty\Inventor
2014-04-28 08:53 - 2009-11-04 07:50 - 00000000 ____D () C:\Documents and Settings\TOMAS\Local Settings\Data aplikací\IDA-STEP
2014-04-28 08:52 - 2008-03-04 14:13 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Tomáš - PROJEKTY UZAVŘENÉ
2014-04-28 08:51 - 2014-04-28 08:51 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\OldVersions
2014-04-28 07:54 - 2014-04-28 07:54 - 02405145 _____ () C:\Documents and Settings\TOMAS\Plocha\3524_5010-xxx-03.STEP
2014-04-18 15:02 - 2014-01-15 10:43 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Tahač
2014-04-18 08:06 - 2013-04-26 15:03 - 01072544 _____ () C:\WINDOWS\system32\nvdrsdb1.bin
2014-04-18 08:06 - 2013-04-26 15:03 - 00000001 _____ () C:\WINDOWS\system32\nvdrssel.bin
2014-04-17 13:47 - 2013-12-12 11:19 - 00000000 ____D () C:\Documents and Settings\TOMAS\Plocha\Box pro vzorky (MFF - Pospíšil)
2014-04-16 14:13 - 2014-04-16 14:13 - 00004088 _____ () C:\WINDOWS\system32\jupdate-1.7.0_55-b13.log
2014-04-16 14:13 - 2008-11-04 07:47 - 00000000 ____D () C:\Program Files\Java
2014-04-15 17:29 - 2014-02-07 13:50 - 00000216 _____ () C:\WINDOWS\wiadebug.log
2014-04-15 11:14 - 2014-02-07 13:50 - 00000049 _____ () C:\WINDOWS\wiaservc.log

Some content of TEMP:
====================
C:\Documents and Settings\TOMAS\Local Settings\temp\jre-7u45-windows-i586-iftw.exe
C:\Documents and Settings\TOMAS\Local Settings\temp\jre-7u51-windows-i586-iftw.exe
C:\Documents and Settings\TOMAS\Local Settings\temp\jre-7u55-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe
[2004-09-08 16:27] - [2008-04-14 05:22] - 1034240 ____A (Microsoft Corporation) 27afd587c462e280ee046b8cca3c2cd1

C:\WINDOWS\system32\winlogon.exe
[2004-09-08 16:27] - [2008-04-14 05:22] - 0507904 ____A (Microsoft Corporation) cddb1f8e1aea356f3ad106f2cf9b7fea

C:\WINDOWS\system32\svchost.exe
[2004-09-08 16:27] - [2008-04-14 05:22] - 0014336 ____A (Microsoft Corporation) be4a520e29b6391f49e79ccc52044d93

C:\WINDOWS\system32\services.exe
[2004-09-08 16:27] - [2009-02-09 13:25] - 0111104 ____A (Microsoft Corporation) 9ef697af07bb8dd82c3b02ca953a95b7

C:\WINDOWS\system32\User32.dll
[2004-09-08 16:27] - [2008-04-14 05:22] - 0578560 ____A (Microsoft Corporation) e16e0990967374e76f3e40cacafd3d53

C:\WINDOWS\system32\userinit.exe
[2004-09-08 16:27] - [2008-04-14 05:22] - 0026112 ____A (Microsoft Corporation) 7dc1830f22e7d275b438127b68030239

C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\volsnap.sys
[2004-09-08 16:27] - [2008-04-14 04:12] - 0052480 ____A (Microsoft Corporation) 28a4b296b47782173c346e376cb374d1





===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: (System) (Fixed) (Total:232.88 GB) (Free:166.99 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive m: (vakuum_users_tomas) (Network) (Total:446.23 GB) (Free:301.11 GB) NTFS
Drive u: (vakuum_u_adm) (Network) (Total:446.23 GB) (Free:301.11 GB) NTFS
Drive v: (foto_archiv) (Network) (Total:35.61 GB) (Free:1.73 GB) NTFS

Available physical RAM: 1372.92 MB
Total physical RAM: 3069.91 MB
Percentage of memory in use: 55%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows XP) (Size: 233 GB) (Disk ID: D85F7F66)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: C:\WINDOWS\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job => C:\WINDOWS\system32\xp_eos.exe

==================== Alternate Data Streams (whitelisted) ==================

AlternateDataStreams: C:\Documents and Settings\All Users\Data aplikací\TEMP:A8ADE5D8
AlternateDataStreams: C:\Documents and Settings\All Users\Data aplikací\TEMP:DFC5A2B2

==================== Security Center ==================

AV: Microsoft Security Essentials (Disabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials (Disabled - Up to date) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Documents and Settings\TOMAS\Plocha" je 22127 MB.


***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs.exe
"C:\Program Files\Messenger\msmsgs.exe" /background [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QTTask.exe
"C:\Program Files\QuickTime\QTTask.exe" -atboottime [x]


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0
DoNotAllowExceptions REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DoNotAllowExceptions REG_DWORD 0x0
DisableNotifications REG_DWORD 0x0


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"="C:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe:*:Enabled:Daemonu.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"
"5985:TCP"="5985:TCP:*:Disabled:Vzdlen sprva systmu Windows "
"80:TCP"="80:TCP:*:Disabled:Vzdlen sprva systmu Windows reim kompatibility (HTTP-In) "


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000


==================== End Of Log ==============================

[JaRon]

1. toto je privela >> Velikost slozky "C:\Documents and Settings\TOMAS\Plocha" je 22127 MB.
2. vycisti PC s CCleanerom
inac OK

[nlc_nlc]

Vyčištěno. Ta velikost Plochy je moje nedbalost, z lenosti vše ukládám do složek na plochu, musím se polepšit
Velmi děkuji za kontrolu

[JaRon]

velkost plochy spomaluje PC pri nabehu
rado sa stalo