Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01
Ran by pavel (administrator) on PRVN-4WVTXYCSU1 on 28-01-2015 23:20:40
Running from C:\Documents and Settings\pavel\Plocha
Loaded Profiles: pavel (Available profiles: pavel & Administrator)
Platform: Systém Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Čeština
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
() C:\OscarX7H\program files\OSCAR Editor\OscarEditor.exe
(Microsoft Corporation) C:\Program Files\Microsoft ActiveSync\wcescomm.exe
(Microsoft Corporation) C:\PROGRA~1\MI3AA1~1\rapimgr.exe
(Creative Technology Ltd) C:\WINDOWS\system32\CTSVCCDA.EXE
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(CANON INC.) C:\WINDOWS\system32\CNAB4RPK.EXE
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AMBDef] => C:\WINDOWS\AMBDef.exe [53248 2008-01-24] (Creative Technology Ltd.)
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1753192 2010-11-04] ()
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [20029032 2011-02-17] (Realtek Semiconductor Corp.)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] => C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\!SASWinLogon: D:\P R O G R A M Y\SuperAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
HKU\S-1-5-21-1343024091-343818398-839522115-1003\...\Run: [OscarEditor] => C:\OscarX7H\program files\OSCAR Editor\OscarEditor.exe [4053504 2009-08-31] ()
HKU\S-1-5-21-1343024091-343818398-839522115-1003\...\Run: [GarenaPlus] => C:\Program Files\Garena Plus\GarenaMessenger.exe [9936176 2014-04-29] ()
HKU\S-1-5-21-1343024091-343818398-839522115-1003\...\Run: [H/PC Connection Agent] => C:\Program Files\Microsoft ActiveSync\wcescomm.exe [1289000 2006-11-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.seznam.cz/?clid=22668
HKU\S-1-5-21-1343024091-343818398-839522115-1003\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.seznam.cz/?clid=22668
HKU\S-1-5-21-1343024091-343818398-839522115-1003\Software\Microsoft\Internet Explorer\Main,Search Page =
http://search.seznam.cz/?sourceid=quick ... earchTerms}
HKU\S-1-5-21-1343024091-343818398-839522115-1003\Software\Microsoft\Internet Explorer\Main,Search Bar =
https://www.seznam.cz/?clid=22668
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> D:\P R O G R A M Y\avast\aswWebRepIE.dll No File
Toolbar: HKU\S-1-5-21-1343024091-343818398-839522115-1003 -> &Adresa - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Společnost Microsoft)
DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://go.microsoft.com/fwlink/?linkid=39204
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://download.macromedia.com/pub/shoc ... wflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\P R O G R A M Y\SuperAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.11.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=12.0.1.652 -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=12.0.1.652 -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @t.garena.com/garenatalk -> C:\Program Files\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll ( Garena)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1343024091-343818398-839522115-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1343024091-343818398-839522115-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-04-03]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-08-22]
Chrome:
=======
CHR Profile: C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Chrome\User Data\Default
CHR Extension: (AdBlock) - C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-05-13]
CHR Extension: (Peněženka Google) - C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
StartMenuInternet: chrome.exe - C:\Documents and Settings\pavel\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2010-08-19] (Creative Labs) [File not signed]
R2 Creative Service for CDROM Access; C:\WINDOWS\System32\CTsvcCDA.exe [44032 1999-12-12] (Creative Technology Ltd) [File not signed]
R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [417792 2008-04-30] (Creative Technology Ltd) [File not signed]
S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2010-08-19] (Creative Labs) [File not signed]
S3 TunngleService; C:\Program Files\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [279712 2010-10-09] ()
R3 hamachi; C:\WINDOWS\System32\DRIVERS\hamachi.sys [25280 2010-11-17] (LogMeIn, Inc.)
R2 hardlock; C:\WINDOWS\System32\DRIVERS\hardlock.sys [420000 2004-01-31] () [File not signed]
R2 Haspnt; C:\WINDOWS\system32\drivers\Haspnt.sys [47616 2003-12-18] (Aladdin Knowledge Systems) [File not signed]
R2 ithsgt; C:\WINDOWS\System32\DRIVERS\ithsgt.sys [162432 2011-09-14] () [File not signed]
R2 lilsgt; C:\WINDOWS\System32\DRIVERS\lilsgt.sys [12032 2011-09-14] () [File not signed]
R2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [25888 2010-10-09] ()
R1 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [108632 2015-01-28] (Malwarebytes Corporation)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
S3 NVHDA; C:\WINDOWS\System32\drivers\nvhda32.sys [100456 2010-11-12] (NVIDIA Corporation)
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-13] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2001-10-25] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2001-10-25] (Microsoft Corporation)
S3 pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [47360 2010-10-21] (VSO Software) [File not signed]
R1 SASDIFSV; D:\P R O G R A M Y\SuperAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; D:\P R O G R A M Y\SuperAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SCDEmu; C:\WINDOWS\system32\Drivers\SCDEmu.sys [56268 2009-03-15] (PowerISO Computing, Inc.) [File not signed]
S3 SECUSB2; C:\WINDOWS\System32\Drivers\SECUSB2.sys [10528 2008-04-16] (Windows (R) 2000 DDK provider) [File not signed]
R2 Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [76288 2004-05-17] (Rainbow Technologies, Inc.) [File not signed]
R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [717296 2011-02-04] () [File not signed]
R3 tap0901t; C:\WINDOWS\System32\DRIVERS\tap0901t.sys [27136 2009-09-16] (Tunngle.net) [File not signed]
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [104576 2008-04-16] (Microsoft Corporation) [File not signed]
U3 av7svc2f; C:\WINDOWS\system32\Drivers\av7svc2f.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-28 23:20 - 2015-01-28 23:20 - 00011646 _____ () C:\Documents and Settings\pavel\Plocha\FRST.txt
2015-01-28 22:27 - 2015-01-28 22:56 - 00000000 ____D () C:\Documents and Settings\pavel\Plocha\mbar
2015-01-28 22:27 - 2015-01-28 22:56 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes' Anti-Malware (portable)
2015-01-28 22:27 - 2015-01-28 22:56 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes' Anti-Malware (portable)
2015-01-28 22:27 - 2015-01-28 22:27 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-28 22:25 - 2015-01-28 22:25 - 16466552 _____ (Malwarebytes Corp.) C:\Documents and Settings\pavel\Plocha\mbar-1.08.3.1004.exe
2015-01-28 19:49 - 2015-01-28 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2015-01-28 19:49 - 2015-01-28 19:49 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Malwarebytes' Anti-Malware
2015-01-28 19:49 - 2015-01-28 19:49 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Malwarebytes' Anti-Malware
2015-01-28 18:52 - 2015-01-28 18:52 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
2015-01-28 18:52 - 2015-01-28 18:52 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
2015-01-28 16:11 - 2015-01-28 11:47 - 01120768 _____ (Farbar) C:\Documents and Settings\pavel\Plocha\frst.exe
2015-01-28 16:09 - 2015-01-28 16:10 - 00000115 _____ () C:\Documents and Settings\pavel\Plocha\Nový objekt - Textový dokument.txt
2015-01-28 16:03 - 2015-01-28 16:03 - 00000000 ____D () C:\_OTM
2015-01-28 16:02 - 2015-01-28 16:02 - 00000489 _____ () C:\Documents and Settings\pavel\Plocha\Zástupce - F I L M Y.lnk
2015-01-28 16:00 - 2015-01-28 16:00 - 00000554 _____ () C:\Documents and Settings\pavel\Plocha\Zástupce - RA95.lnk
2015-01-28 15:58 - 2015-01-28 15:58 - 00000638 _____ () C:\Documents and Settings\pavel\Plocha\Zástupce - frd.lnk
2015-01-28 15:57 - 2015-01-28 15:57 - 00000483 _____ () C:\Documents and Settings\pavel\Plocha\Zástupce - izrael fotky z kamery záloha.lnk
2015-01-28 11:55 - 2015-01-28 23:20 - 00000000 ____D () C:\FRST
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-28 23:20 - 2010-08-19 20:05 - 00000000 ____D () C:\Documents and Settings\pavel\Plocha
2015-01-28 23:20 - 2010-08-19 20:05 - 00000000 ____D () C:\Documents and Settings\pavel\Local Settings\Temp
2015-01-28 23:01 - 2010-08-22 20:36 - 01086578 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-28 22:27 - 2014-07-28 21:36 - 00108632 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-28 22:27 - 2010-08-19 21:35 - 00000000 __RHD () C:\Documents and Settings\All Users.WINDOWS\Data aplikací
2015-01-28 19:49 - 2014-05-11 20:01 - 00000797 _____ () C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes Anti-Malware.lnk
2015-01-28 19:49 - 2010-08-19 21:35 - 00000000 ___RD () C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy
2015-01-28 19:49 - 2010-08-19 21:35 - 00000000 ___RD () C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy
2015-01-28 19:49 - 2010-08-19 21:35 - 00000000 ____D () C:\Documents and Settings\All Users.WINDOWS\Plocha
2015-01-28 19:14 - 2014-05-17 19:35 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-01-28 19:14 - 2014-05-17 19:35 - 00000049 _____ () C:\WINDOWS\wiaservc.log
2015-01-28 19:14 - 2010-08-19 20:02 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-28 18:57 - 2010-08-19 20:05 - 00032430 _____ () C:\WINDOWS\SchedLgU.Txt
2015-01-28 18:50 - 2010-08-19 20:05 - 00000000 __RHD () C:\Documents and Settings\pavel\Data aplikací
2015-01-28 18:35 - 2010-08-22 20:37 - 00026224 ____C () C:\Documents and Settings\pavel\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2015-01-28 17:47 - 2010-08-19 20:05 - 00000000 ____D () C:\Documents and Settings\pavel
2015-01-28 15:47 - 2010-12-30 02:58 - 00000000 ____D () C:\Program Files\Java
2015-01-28 11:57 - 2010-08-19 20:05 - 00000000 ___HD () C:\Documents and Settings\pavel\Local Settings\Data aplikací
2015-01-28 01:07 - 2001-10-25 15:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2015-01-22 12:36 - 2014-05-12 07:21 - 00022521 _____ () C:\WINDOWS\wmsetup.log
2015-01-22 12:22 - 2012-12-14 17:06 - 00000000 ____D () C:\Documents and Settings\pavel\Data aplikací\vlc
==================== Files in the root of some directories =======
2010-12-17 14:33 - 2010-12-17 14:33 - 0002528 ____C () C:\Documents and Settings\pavel\Data aplikací\$_hpcst$.hpc
2010-09-28 18:32 - 2012-08-18 09:18 - 0087608 ____C () C:\Documents and Settings\pavel\Data aplikací\inst.exe
2010-09-28 18:32 - 2012-08-18 09:18 - 0007887 ____C () C:\Documents and Settings\pavel\Data aplikací\pcouffin.cat
2010-09-28 18:32 - 2012-08-18 09:18 - 0001144 ____C () C:\Documents and Settings\pavel\Data aplikací\pcouffin.inf
2010-09-28 18:32 - 2012-08-18 09:18 - 0000033 ____C () C:\Documents and Settings\pavel\Data aplikací\pcouffin.log
2010-09-28 18:32 - 2012-08-18 09:18 - 0047360 ____C (VSO Software) C:\Documents and Settings\pavel\Data aplikací\pcouffin.sys
2011-07-26 11:52 - 2011-07-26 11:52 - 0138056 ____C () C:\Documents and Settings\pavel\Data aplikací\PnkBstrK.sys
2011-03-24 16:56 - 2011-05-24 21:08 - 0046658 ____C () C:\Documents and Settings\pavel\Data aplikací\room.dat
2011-05-28 17:15 - 2014-05-29 14:09 - 0045194 _____ () C:\Documents and Settings\pavel\Data aplikací\room_v3.dat
2010-09-28 18:32 - 2012-06-15 14:52 - 0001057 ____C () C:\Documents and Settings\pavel\Data aplikací\vso_ts_preview.xml
2010-08-21 20:27 - 2014-12-04 20:39 - 0088576 _____ () C:\Documents and Settings\pavel\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
OK, toto je ciste... preventivne se podivame jeste o kousek hloubeji.
Brácha bude mít skvělou radost, ten počítač mu blbne už přes rok. Já jsem mu pomoct nabídnul, ale on mě k tomu nechtěl pustit, že to nemá cenu 
Přispějete na provoz fóra?