PC vždy po najetí zamrzne

[ramin1328]

Dobrý den , PC se vždy po prvním startu sekne a nefunguje nic jineho než reset tlačítkem pak je vše v poho. Tedy až do doby kdy jsem to projel Esetem a hazelo to modrou obrazovku nejdřív s hláškou
Bad_pool_header
a poté
acpi.sys po této hlášce fungovala jen prace v nouzi.
Tady je log RSIT děkuji za radu...

Logfile of random's system information tool 1.06 (written by random/random)
Run by Racek at 2010-03-22 09:20:31
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 92 GB (19%) free of 477 GB
Total RAM: 2046 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:20:34, on 22.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\Download\RSIT.exe
C:\Program Files\trend micro\Racek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
O9 - Extra button: Přeložit - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - C:\Program Files\Verdict Free\etnxp.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Verdict Free\etnxp.dll
O9 - Extra 'Tools' menuitem: Internetový překladač... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - C:\Program Files\Verdict Free\etnxp.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Vytvořit mobilní oblíbenou položku… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} (OCXDownloadChecker Control) - http://5.39.135.105/cab/OCXChecker_6110.cab
O16 - DPF: {2328F294-DD85-11D3-B4AF-00C04F2B300E} (XSockClient Control) - http://10.0.0.91/eng/activex/activex.CAB
O16 - DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} (RtspVaPgCtrlNew Class) - http://194.149.102.106:8080/RtspVaPgDec.cab
O16 - DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} (OCXDownloadChecker Control) - http://194.149.102.106/cab/OCXChecker_8320.cab
O16 - DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} (DownloadCenter Control) - http://5.230.103.81/cab/DownloadCenter_8300.cab
O16 - DPF: {FF3BA0DA-79B5-4110-8FAC-C402D85AAEDA} (CSQ2 Object) - http://90.179.203.86:9900/view.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: uvnc_service - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 7454 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{85963A21-23BC-4B12-AA40-B4D0742986EC}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-10-08 1036288]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"bgsmsnd.exe"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe [2006-06-02 106496]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-03 13672448]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-12-03 86016]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2007-11-13 72192]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2008-12-03 2181672]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"fsm"= []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe

C:\Documents and Settings\Racek\Nabídka Start\Programy\Po spuštění
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveTypeAutoRun"=
"NoDriveAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\diskD\flash\flash1\Programy\VilarWizard_EN.exe"="C:\diskD\flash\flash1\Programy\VilarWizard_EN.exe:*:Enabled:TODO: <Explain>"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Remote Viewlog\Vlsvr.exe"="C:\Remote Viewlog\Vlsvr.exe:*:Enabled:Viewlog Server"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\MSI\TotalMedia 3.5\TotalMedia.exe"="C:\Program Files\MSI\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\DMMultiView\MultiView.exe"="C:\Program Files\DMMultiView\MultiView.exe:*:Enabled:MultiView"
"C:\Program Files\UltraVNC\vncviewer.exe"="C:\Program Files\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Program Files\v8200\DMMultiView\MultiView.exe"="C:\Program Files\v8200\DMMultiView\MultiView.exe:*:Enabled:MultiView"
"C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe"="C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{357337da-1d0c-11de-a63a-001fc6ddac98}]
shell\AuTOPlaY\command - clbflj.pif
shell\AutoRun\command - clbflj.pif
shell\eXplOre\command - clbflj.pif
shell\opEn\command - clbflj.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b278924c-10b1-11df-b2d1-001fc6ddac98}]
shell\AutoRun\command - H:\LaunchU3.exe -a


======File associations======

.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-22 09:20:32 ----D---- C:\Program Files\trend micro
2010-03-22 09:20:31 ----D---- C:\rsit
2010-03-22 09:15:44 ----D---- C:\WINDOWS\LastGood
2010-03-22 09:10:25 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-22 00:25:50 ----D---- C:\Documents and Settings\Racek\Data aplikací\ESET
2010-03-22 00:25:12 ----D---- C:\Program Files\ESET
2010-03-22 00:25:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-03-21 23:58:38 ----D---- C:\WINDOWS\ie8updates
2010-03-21 23:57:34 ----HDC---- C:\WINDOWS\ie8
2010-03-21 23:54:23 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-03-21 23:54:19 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2010-03-21 23:54:10 ----D---- C:\Program Files\Windows Media Connect 2
2010-03-21 23:54:01 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2010-03-21 23:53:31 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-03-21 23:53:16 ----D---- C:\79eeafb4d2555610f966
2010-03-21 23:53:13 ----D---- C:\WINDOWS\system32\LogFiles
2010-03-21 23:53:09 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-03-21 23:51:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Windows Genuine Advantage
2010-03-21 23:33:14 ----D---- C:\Documents and Settings\Racek\Data aplikací\vlc
2010-03-21 23:30:13 ----D---- C:\Program Files\ArcSoft
2010-03-21 23:16:09 ----D---- C:\Program Files\Software Informer
2010-03-21 23:16:09 ----D---- C:\Documents and Settings\Racek\Data aplikací\Software Informer
2010-03-21 17:11:43 ----D---- C:\Program Files\Verdict Free
2010-03-18 08:59:36 ----D---- C:\Program Files\VDOWNLOADER
2010-03-18 08:59:36 ----D---- C:\Program Files\Common Files\eBay
2010-03-17 17:58:32 ----D---- C:\Program Files\Eurotran XP
2010-03-12 01:08:33 ----A---- C:\WINDOWS\DMmvHost.ini
2010-03-11 00:27:26 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-11 00:07:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-08 15:28:37 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-03-08 15:28:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-03-08 15:28:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-03-08 15:28:28 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-03-08 15:26:46 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-03-08 15:26:42 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-03-08 15:26:38 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-03-08 15:26:35 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-03-08 15:26:32 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-03-08 15:26:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-03-08 15:26:26 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-03-08 15:26:22 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-03-08 15:26:19 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-03-08 15:26:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-03-08 15:26:12 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-03-08 15:26:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-03-08 15:26:04 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-03-08 15:25:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-03-08 15:25:56 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-03-08 15:25:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-03-08 15:25:49 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-03-08 15:25:41 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-03-08 15:25:34 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-03-08 15:20:51 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-03-08 15:20:49 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-03-08 15:20:43 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-03-05 13:40:17 ----SHD---- C:\RECYCLER
2010-03-05 12:40:51 ----A---- C:\ComboFix.txt
2010-03-05 12:31:33 ----A---- C:\Boot.bak
2010-03-05 12:31:31 ----RASHD---- C:\cmdcons
2010-03-05 12:26:30 ----D---- C:\WINDOWS\ERDNT
2010-03-05 12:26:30 ----A---- C:\WINDOWS\system32\CF23263.exe
2010-03-05 11:49:32 ----D---- C:\Program Files\BitComet
2010-03-03 20:39:40 ----D---- C:\Program Files\UltraVNC
2010-03-03 19:22:24 ----D---- C:\SmartPhone Viewer V3
2010-02-23 14:03:15 ----D---- C:\WINDOWS\v8320

======List of files/folders modified in the last 1 months======

2010-03-22 09:20:32 ----D---- C:\Program Files
2010-03-22 09:20:22 ----A---- C:\WINDOWS\wincmd.ini
2010-03-22 09:18:59 ----D---- C:\Download
2010-03-22 09:16:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-22 09:16:23 ----HD---- C:\WINDOWS\inf
2010-03-22 09:16:23 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-22 09:16:23 ----D---- C:\WINDOWS\system32
2010-03-22 09:16:23 ----D---- C:\WINDOWS\Prefetch
2010-03-22 09:16:23 ----AD---- C:\WINDOWS
2010-03-22 09:15:44 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-22 09:14:40 ----D---- C:\WINDOWS\Temp
2010-03-22 09:14:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\VMware
2010-03-22 09:13:50 ----D---- C:\Documents and Settings\Racek\Data aplikací\Hamachi
2010-03-22 09:10:52 ----D---- C:\Documents and Settings
2010-03-22 00:56:31 ----D---- C:\WINDOWS\system32\drivers
2010-03-22 00:53:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-22 00:53:15 ----SHD---- C:\WINDOWS\Installer
2010-03-22 00:16:16 ----SD---- C:\WINDOWS\Tasks
2010-03-22 00:03:54 ----D---- C:\Program Files\Hamachi
2010-03-22 00:02:48 ----D---- C:\WINDOWS\system32\cs-cz
2010-03-22 00:02:46 ----D---- C:\WINDOWS\Media
2010-03-22 00:02:46 ----D---- C:\WINDOWS\Help
2010-03-22 00:02:46 ----D---- C:\Program Files\Internet Explorer
2010-03-21 23:58:52 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-21 23:58:50 ----A---- C:\WINDOWS\imsins.BAK
2010-03-21 23:54:15 ----A---- C:\WINDOWS\win.ini
2010-03-21 23:54:10 ----D---- C:\Program Files\Windows Media Player
2010-03-21 23:51:11 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-03-21 23:41:18 ----D---- C:\Documents and Settings\Racek\Data aplikací\dvdcss
2010-03-21 23:30:13 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-21 10:53:07 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-19 01:31:56 ----D---- C:\Program Files\PC Off
2010-03-18 08:59:36 ----D---- C:\Program Files\Common Files
2010-03-12 01:08:34 ----A---- C:\WINDOWS\multiview.ini
2010-03-11 00:27:27 ----D---- C:\Program Files\Movie Maker
2010-03-08 15:47:19 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-08 15:45:14 ----D---- C:\WINDOWS\AppPatch
2010-03-08 15:28:32 ----D---- C:\WINDOWS\WinSxS
2010-03-08 15:27:57 ----A---- C:\WINDOWS\system32\MRT.INI
2010-03-05 15:09:02 ----D---- C:\Program Files\Microsoft ActiveSync
2010-03-05 12:39:42 ----A---- C:\WINDOWS\system.ini
2010-03-05 12:31:33 ----RASH---- C:\boot.ini
2010-03-03 21:37:55 ----D---- C:\WINDOWS\pss
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-23 14:05:57 ----D---- C:\Program Files\DMMultiView

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 hcmon;VMware hcmon; \??\C:\WINDOWS\system32\Drivers\hcmon.sys []
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R2 VMnetBridge;VMware Bridge Protocol; C:\WINDOWS\system32\DRIVERS\vmnetbridge.sys [2007-10-08 28592]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys []
R2 vmx86;VMware vmx86; \??\C:\WINDOWS\system32\Drivers\vmx86.sys []
R2 vstor2;Vstor2 Virtual Storage Driver; \??\C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys []
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-10-09 313856]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-06-19 103424]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-01-22 25280]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-03 6188320]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-11-17 54016]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-11-17 22016]
R3 PKWCap;PKWCap service; C:\WINDOWS\system32\DRIVERS\PKWCap.sys [2008-02-27 980608]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 vmkbd;VMware kbd; \??\C:\WINDOWS\system32\drivers\VMkbd.sys []
R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\vmnetadapter.sys [2007-10-08 16816]
S1 69fd158;69fd158; C:\WINDOWS\System32\drivers\69fd158.sys []
S1 eusk2par;EUTRON SmartKey Parallel Driver; \??\C:\WINDOWS\system32\Drivers\eusk2par.sys []
S3 aaoc1lz2;aaoc1lz2; C:\WINDOWS\system32\drivers\aaoc1lz2.sys []
S3 ajny9gi7;ajny9gi7; C:\WINDOWS\system32\drivers\ajny9gi7.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 catchme;catchme; \??\C:\DOCUME~1\Racek\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2006-11-06 28672]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2007-11-14 104960]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-03 163908]
R2 uvnc_service;uvnc_service; C:\Program Files\UltraVNC\WinVNC.exe [2008-02-17 984640]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files\VMware\VMware Workstation\vmware-authd.exe [2007-10-08 109104]
R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2007-10-08 121392]
R2 vmount2;VMware Virtual Mount Manager Extended; C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe [2007-03-23 269104]
R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [2007-10-08 150064]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2009-01-07 26144]
S3 ufad-ws60;VMware Agent Service; C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe [2007-08-07 186928]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

[JaRon]

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{357337da-1d0c-11de-a63a-001fc6ddac98}]

Driver::
69fd158
aaoc1lz2
ajny9gi7

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[ramin1328]

Zdravim a dekuji tady je ten log



ComboFix 10-03-22.03 - Racek 23.03.2010 11:34:38.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1708 [GMT 1:00]
Spuštěný z: c:\documents and settings\Racek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Racek\Plocha\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_69fd158


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-23 do 2010-03-23 )))))))))))))))))))))))))))))))
.

2010-03-22 08:20 . 2010-03-22 08:20 -------- d-----w- c:\program files\trend micro
2010-03-22 08:20 . 2010-03-22 08:20 -------- d-----w- C:\rsit
2010-03-22 08:11 . 2010-03-22 08:11 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-21 23:53 . 2007-12-21 07:19 39944 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-03-21 23:53 . 2007-12-21 07:21 53768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2010-03-21 23:53 . 2007-12-21 07:21 71176 ----a-w- c:\windows\system32\drivers\epfw.sys
2010-03-21 23:53 . 2007-12-21 07:20 30216 ----a-w- c:\windows\system32\drivers\easdrv.sys
2010-03-21 23:32 . 2008-01-07 13:29 352 ---ha-w- c:\windows\nod32fixtemdono.reg
2010-03-21 23:25 . 2010-03-21 23:25 -------- d-----w- c:\program files\ESET
2010-03-21 23:16 . 2010-03-21 23:16 -------- d-sh--w- c:\documents and settings\Racek\IECompatCache
2010-03-21 23:14 . 2010-03-21 23:14 -------- d-sh--w- c:\documents and settings\Racek\PrivacIE
2010-03-21 23:04 . 2010-03-21 23:04 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-21 23:03 . 2010-03-21 23:03 -------- d-sh--w- c:\documents and settings\Racek\IETldCache
2010-03-21 22:58 . 2010-03-21 22:58 -------- d-----w- c:\windows\ie8updates
2010-03-21 22:57 . 2010-03-21 22:57 -------- dc-h--w- c:\windows\ie8
2010-03-21 22:56 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-21 22:56 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-21 22:56 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-21 22:54 . 2010-03-21 22:54 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- C:\79eeafb4d2555610f966
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- c:\windows\system32\LogFiles
2010-03-21 22:30 . 2010-03-21 22:30 -------- d-----w- c:\program files\ArcSoft
2010-03-21 22:16 . 2010-03-21 22:16 -------- d-----w- c:\program files\Software Informer
2010-03-21 16:11 . 2010-03-21 16:12 -------- d-----w- c:\program files\Verdict Free
2010-03-18 07:59 . 2010-03-18 07:59 -------- d-----w- c:\program files\VDOWNLOADER
2010-03-18 07:59 . 2010-03-18 07:59 -------- d-----w- c:\program files\Common Files\eBay
2010-03-17 16:58 . 2010-03-17 19:48 -------- d-----w- c:\program files\Eurotran XP
2010-03-10 23:08 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-07 18:46 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-05 11:26 . 2010-03-05 11:26 390144 ----a-w- c:\windows\system32\CF23263.exe
2010-03-05 10:49 . 2010-03-05 10:49 -------- d-----w- c:\program files\BitComet
2010-03-03 19:39 . 2010-03-03 20:22 -------- d-----w- c:\program files\UltraVNC
2010-03-03 18:22 . 2010-03-05 09:44 -------- d-----w- C:\SmartPhone Viewer V3
2010-02-23 19:55 . 2010-02-23 19:55 8 ----a-w- c:\windows\system32\nvModes.dat
2010-02-23 13:03 . 2010-02-23 13:04 -------- d-----w- c:\windows\v8320

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2036-02-07 01:58 . 2010-02-01 11:37 1227482 ----a-w- c:\windows\system32\3_VETERANI.scr
2010-03-23 10:47 . 2010-01-24 13:30 802304 ----a-w- c:\windows\system32\drivers\uxlnpgz.sys
2010-03-21 23:03 . 2010-01-22 11:18 -------- d-----w- c:\program files\Hamachi
2010-03-21 22:30 . 2009-03-27 23:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-19 00:31 . 2009-03-29 00:57 -------- d-----w- c:\program files\PC Off
2010-03-08 14:47 . 2006-03-02 12:00 48070 ----a-w- c:\windows\system32\perfc005.dat
2010-03-08 14:47 . 2006-03-02 12:00 315304 ----a-w- c:\windows\system32\perfh005.dat
2010-03-05 14:09 . 2009-06-25 22:19 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-02-23 13:05 . 2009-07-28 21:55 -------- d-----w- c:\program files\DMMultiView
2010-02-13 12:50 . 2009-03-28 00:02 -------- d-----w- c:\program files\EXPERTool
2010-02-13 12:46 . 2009-03-28 00:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-13 12:40 . 2009-03-27 23:58 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-13 12:20 . 2010-02-13 12:20 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-13 02:46 . 2009-03-28 21:39 106496 ----a-w- c:\windows\DUMPd050.tmp
2010-02-12 16:30 . 2009-03-28 00:04 -------- d-----w- c:\program files\AGEIA Technologies
2010-02-11 10:32 . 2009-06-30 21:33 -------- d-----w- c:\program files\AlienGUIse
2010-02-11 10:30 . 2010-02-11 10:30 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-11 10:27 . 2009-07-09 10:41 -------- d-----w- c:\program files\Hexacto Games
2010-02-11 10:27 . 2009-11-11 11:18 -------- d-----w- c:\program files\ChateauXP
2010-02-05 12:25 . 2009-06-30 22:07 -------- d-----w- c:\program files\Winamp
2010-02-05 12:25 . 2010-02-05 12:25 -------- d-----w- c:\program files\Winamp Detect
2010-01-22 11:18 . 2009-06-10 16:28 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-01-18 08:03 . 2010-01-03 14:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-12 04:03 . 2009-03-28 00:03 592488 ----a-w- c:\windows\system32\nvudisp.exe
2010-01-05 09:58 . 2010-01-05 09:58 832512 ------w- c:\windows\system32\SET12.tmp
2010-01-05 09:58 . 2010-01-05 09:58 233472 ----a-w- c:\windows\system32\SET13.tmp
2010-01-05 09:58 . 2010-01-05 09:58 1168384 ----a-w- c:\windows\system32\SET14.tmp
2010-01-05 09:58 . 2010-01-05 09:58 105984 ----a-w- c:\windows\system32\SET15.tmp
2010-01-05 09:58 . 2010-01-05 09:58 3599360 ------w- c:\windows\system32\SET1B.tmp
2010-01-05 09:58 . 2010-01-05 09:58 52224 ----a-w- c:\windows\system32\SET1C.tmp
2010-01-05 09:58 . 2010-01-05 09:58 459264 ----a-w- c:\windows\system32\SET1D.tmp
2010-01-05 09:58 . 2010-01-05 09:58 6067200 ----a-w- c:\windows\system32\SET25.tmp
2010-01-05 09:58 . 2010-01-05 09:58 268288 ----a-w- c:\windows\system32\SET21.tmp
2010-01-05 09:57 . 2010-01-05 09:57 63488 ----a-w- c:\windows\system32\SET2C.tmp
2010-01-05 09:57 . 2010-01-05 09:57 380928 ----a-w- c:\windows\system32\SET27.tmp
2010-01-05 09:57 . 2010-01-05 09:57 124928 ----a-w- c:\windows\system32\SET30.tmp
2009-12-31 16:50 . 2006-03-02 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-08-03 19:39 . 2009-08-03 19:38 80 --sh--r- c:\windows\system32\A243A1656D.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-12-03 2181672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-10-08 1036288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"bgsmsnd.exe"="c:\windows\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe" [2006-06-02 106496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13672448]
"nwiz"="nwiz.exe" [2008-12-03 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-11-13 72192]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Racek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2010-1-22 625952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TMMonitor.lnk - c:\program files\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2010-3-21 258048]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\diskD\\flash\\flash1\\Programy\\VilarWizard_EN.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Remote Viewlog\\Vlsvr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\DMMultiView\\MultiView.exe"=
"c:\\Program Files\\UltraVNC\\vncviewer.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\v8200\\DMMultiView\\MultiView.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"12782:TCP"= 12782:TCP:BitComet 12782 TCP
"12782:UDP"= 12782:UDP:BitComet 12782 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.1.2010 15:54 691696]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [29.10.2009 12:27 1074568]
R2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [3.3.2010 20:39 984640]
R3 PKWCap;PKWCap service;c:\windows\system32\drivers\PKWCap.sys [15.12.2009 14:37 980608]
S1 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [20.1.2010 13:17 24786]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - uxlnpgz
.
Obsah adresáře 'Naplánované úlohy'

2010-03-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-23 c:\windows\Tasks\User_Feed_Synchronization-{85963A21-23BC-4B12-AA40-B4D0742986EC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Verdict Free\etnxp.dll
DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} - hxxp://5.39.135.105/cab/OCXChecker_6110.cab
DPF: {2328F294-DD85-11D3-B4AF-00C04F2B300E} - hxxp://10.0.0.91/eng/activex/activex.CAB
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://194.149.102.106:8080/RtspVaPgDec.cab
DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} - hxxp://194.149.102.106/cab/OCXChecker_8320.cab
DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} - hxxp://5.230.103.81/cab/DownloadCenter_8300.cab
DPF: {FF3BA0DA-79B5-4110-8FAC-C402D85AAEDA} - hxxp://90.179.203.86:9900/view.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-fsm - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-23 11:46
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spmx.sys >>UNKNOWN [0x8A97D938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28
\Driver\ACPI -> ACPI.sys @ 0xb7e74cb8
\Driver\atapi -> atapi.sys @ 0xb7ce1b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb7bcdbb0
PacketIndicateHandler -> NDIS.sys @ 0xb7bdaa21
SendHandler -> NDIS.sys @ 0xb7bb887b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet005\Services\uxlnpgz]

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-839522115-861567501-2147137731-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3640)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~2\rapimgr.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\program files\VMware\VMware Workstation\vmware-authd.exe
.
**************************************************************************
.
Celkový čas: 2010-03-23 11:48:25 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-23 10:48
ComboFix2.txt 2010-03-05 11:40

Před spuštěním: Volných bajtů: 95 988 015 104
Po spuštění: Volných bajtů: 95 884 263 424

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 8E2653BB85AACC78B40A7B8152DC2677

[JaRon]

zopakuj akciu - dalsi CFScript:

Kód: Vybrat vše

Driver::
uxlnpgz

File::
c:\windows\nod32fixtemdono.reg
c:\windows\system32\drivers\uxlnpgz.sys

[ramin1328]

ComboFix 10-03-22.03 - Racek 23.03.2010 12:13:30.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1716 [GMT 1:00]
Spuštěný z: c:\documents and settings\Racek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Racek\Plocha\CFScript.txt.txt

FILE ::
"c:\windows\nod32fixtemdono.reg"
"c:\windows\system32\drivers\uxlnpgz.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\nod32fixtemdono.reg
c:\windows\system32\drivers\uxlnpgz.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_UXLNPGZ
-------\Service_uxlnpgz


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-23 do 2010-03-23 )))))))))))))))))))))))))))))))
.

2010-03-22 08:20 . 2010-03-22 08:20 -------- d-----w- c:\program files\trend micro
2010-03-22 08:20 . 2010-03-22 08:20 -------- d-----w- C:\rsit
2010-03-22 08:11 . 2010-03-22 08:11 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-21 23:53 . 2007-12-21 07:19 39944 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-03-21 23:53 . 2007-12-21 07:21 53768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2010-03-21 23:53 . 2007-12-21 07:21 71176 ----a-w- c:\windows\system32\drivers\epfw.sys
2010-03-21 23:53 . 2007-12-21 07:20 30216 ----a-w- c:\windows\system32\drivers\easdrv.sys
2010-03-21 23:25 . 2010-03-21 23:25 -------- d-----w- c:\program files\ESET
2010-03-21 23:16 . 2010-03-21 23:16 -------- d-sh--w- c:\documents and settings\Racek\IECompatCache
2010-03-21 23:14 . 2010-03-21 23:14 -------- d-sh--w- c:\documents and settings\Racek\PrivacIE
2010-03-21 23:04 . 2010-03-21 23:04 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-21 23:03 . 2010-03-21 23:03 -------- d-sh--w- c:\documents and settings\Racek\IETldCache
2010-03-21 22:58 . 2010-03-21 22:58 -------- d-----w- c:\windows\ie8updates
2010-03-21 22:57 . 2010-03-21 22:57 -------- dc-h--w- c:\windows\ie8
2010-03-21 22:56 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-21 22:56 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-21 22:56 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-21 22:54 . 2010-03-21 22:54 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- C:\79eeafb4d2555610f966
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-03-21 22:53 . 2010-03-21 22:53 -------- d-----w- c:\windows\system32\LogFiles
2010-03-21 22:30 . 2010-03-21 22:30 -------- d-----w- c:\program files\ArcSoft
2010-03-21 22:16 . 2010-03-21 22:16 -------- d-----w- c:\program files\Software Informer
2010-03-21 16:11 . 2010-03-21 16:12 -------- d-----w- c:\program files\Verdict Free
2010-03-18 07:59 . 2010-03-18 07:59 -------- d-----w- c:\program files\VDOWNLOADER
2010-03-18 07:59 . 2010-03-18 07:59 -------- d-----w- c:\program files\Common Files\eBay
2010-03-17 16:58 . 2010-03-17 19:48 -------- d-----w- c:\program files\Eurotran XP
2010-03-10 23:08 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-07 18:46 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-05 11:26 . 2010-03-05 11:26 390144 ----a-w- c:\windows\system32\CF23263.exe
2010-03-05 10:49 . 2010-03-05 10:49 -------- d-----w- c:\program files\BitComet
2010-03-03 19:39 . 2010-03-03 20:22 -------- d-----w- c:\program files\UltraVNC
2010-03-03 18:22 . 2010-03-05 09:44 -------- d-----w- C:\SmartPhone Viewer V3
2010-02-23 19:55 . 2010-02-23 19:55 8 ----a-w- c:\windows\system32\nvModes.dat
2010-02-23 13:03 . 2010-02-23 13:04 -------- d-----w- c:\windows\v8320

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2036-02-07 01:58 . 2010-02-01 11:37 1227482 ----a-w- c:\windows\system32\3_VETERANI.scr
2010-03-21 23:03 . 2010-01-22 11:18 -------- d-----w- c:\program files\Hamachi
2010-03-21 22:30 . 2009-03-27 23:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-19 00:31 . 2009-03-29 00:57 -------- d-----w- c:\program files\PC Off
2010-03-08 14:47 . 2006-03-02 12:00 48070 ----a-w- c:\windows\system32\perfc005.dat
2010-03-08 14:47 . 2006-03-02 12:00 315304 ----a-w- c:\windows\system32\perfh005.dat
2010-03-05 14:09 . 2009-06-25 22:19 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-02-23 13:05 . 2009-07-28 21:55 -------- d-----w- c:\program files\DMMultiView
2010-02-13 12:50 . 2009-03-28 00:02 -------- d-----w- c:\program files\EXPERTool
2010-02-13 12:46 . 2009-03-28 00:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-13 12:40 . 2009-03-27 23:58 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-13 12:20 . 2010-02-13 12:20 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-13 02:46 . 2009-03-28 21:39 106496 ----a-w- c:\windows\DUMPd050.tmp
2010-02-12 16:30 . 2009-03-28 00:04 -------- d-----w- c:\program files\AGEIA Technologies
2010-02-11 10:32 . 2009-06-30 21:33 -------- d-----w- c:\program files\AlienGUIse
2010-02-11 10:30 . 2010-02-11 10:30 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-11 10:27 . 2009-07-09 10:41 -------- d-----w- c:\program files\Hexacto Games
2010-02-11 10:27 . 2009-11-11 11:18 -------- d-----w- c:\program files\ChateauXP
2010-02-05 12:25 . 2009-06-30 22:07 -------- d-----w- c:\program files\Winamp
2010-02-05 12:25 . 2010-02-05 12:25 -------- d-----w- c:\program files\Winamp Detect
2010-01-22 11:18 . 2009-06-10 16:28 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-01-18 08:03 . 2010-01-03 14:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-12 04:03 . 2009-03-28 00:03 592488 ----a-w- c:\windows\system32\nvudisp.exe
2010-01-05 09:58 . 2010-01-05 09:58 832512 ------w- c:\windows\system32\SET12.tmp
2010-01-05 09:58 . 2010-01-05 09:58 233472 ----a-w- c:\windows\system32\SET13.tmp
2010-01-05 09:58 . 2010-01-05 09:58 1168384 ----a-w- c:\windows\system32\SET14.tmp
2010-01-05 09:58 . 2010-01-05 09:58 105984 ----a-w- c:\windows\system32\SET15.tmp
2010-01-05 09:58 . 2010-01-05 09:58 3599360 ------w- c:\windows\system32\SET1B.tmp
2010-01-05 09:58 . 2010-01-05 09:58 52224 ----a-w- c:\windows\system32\SET1C.tmp
2010-01-05 09:58 . 2010-01-05 09:58 459264 ----a-w- c:\windows\system32\SET1D.tmp
2010-01-05 09:58 . 2010-01-05 09:58 6067200 ----a-w- c:\windows\system32\SET25.tmp
2010-01-05 09:58 . 2010-01-05 09:58 268288 ----a-w- c:\windows\system32\SET21.tmp
2010-01-05 09:57 . 2010-01-05 09:57 63488 ----a-w- c:\windows\system32\SET2C.tmp
2010-01-05 09:57 . 2010-01-05 09:57 380928 ----a-w- c:\windows\system32\SET27.tmp
2010-01-05 09:57 . 2010-01-05 09:57 124928 ----a-w- c:\windows\system32\SET30.tmp
2009-12-31 16:50 . 2006-03-02 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-08-03 19:39 . 2009-08-03 19:38 80 --sh--r- c:\windows\system32\A243A1656D.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-23_10.45.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-23 11:20 . 2010-03-23 11:20 16384 c:\windows\Temp\Perflib_Perfdata_8c.dat
+ 2010-03-23 11:20 . 2010-03-23 11:20 16384 c:\windows\Temp\Perflib_Perfdata_428.dat
+ 2010-03-23 11:11 . 2010-03-23 11:11 16384 c:\windows\Temp\Perflib_Perfdata_128.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-12-03 2181672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-10-08 1036288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"bgsmsnd.exe"="c:\windows\System32\spool\DRIVERS\W32X86\2\bgsmsnd.exe" [2006-06-02 106496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13672448]
"nwiz"="nwiz.exe" [2008-12-03 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-11-13 72192]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Racek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2010-1-22 625952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TMMonitor.lnk - c:\program files\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2010-3-21 258048]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\diskD\\flash\\flash1\\Programy\\VilarWizard_EN.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Remote Viewlog\\Vlsvr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\DMMultiView\\MultiView.exe"=
"c:\\Program Files\\UltraVNC\\vncviewer.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\v8200\\DMMultiView\\MultiView.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"12782:TCP"= 12782:TCP:BitComet 12782 TCP
"12782:UDP"= 12782:UDP:BitComet 12782 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.1.2010 15:54 691696]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [29.10.2009 12:27 1074568]
R2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [3.3.2010 20:39 984640]
R3 PKWCap;PKWCap service;c:\windows\system32\drivers\PKWCap.sys [15.12.2009 14:37 980608]
S1 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [20.1.2010 13:17 24786]
.
Obsah adresáře 'Naplánované úlohy'

2010-03-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-03-23 c:\windows\Tasks\User_Feed_Synchronization-{85963A21-23BC-4B12-AA40-B4D0742986EC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - c:\program files\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - c:\program files\Verdict Free\etnxp.dll
DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} - hxxp://5.39.135.105/cab/OCXChecker_6110.cab
DPF: {2328F294-DD85-11D3-B4AF-00C04F2B300E} - hxxp://10.0.0.91/eng/activex/activex.CAB
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://194.149.102.106:8080/RtspVaPgDec.cab
DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} - hxxp://194.149.102.106/cab/OCXChecker_8320.cab
DPF: {FEC048AB-277A-460C-BF50-1A4193AEF148} - hxxp://5.230.103.81/cab/DownloadCenter_8300.cab
DPF: {FF3BA0DA-79B5-4110-8FAC-C402D85AAEDA} - hxxp://90.179.203.86:9900/view.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-23 12:21
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spnf.sys >>UNKNOWN [0x8A97D938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28
\Driver\ACPI -> ACPI.sys @ 0xb7e74cb8
\Driver\atapi -> atapi.sys @ 0xb7ce1b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb7bcdbb0
PacketIndicateHandler -> NDIS.sys @ 0xb7bdaa21
SendHandler -> NDIS.sys @ 0xb7bb887b
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-839522115-861567501-2147137731-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3984)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~2\rapimgr.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\program files\VMware\VMware Workstation\vmware-authd.exe
.
**************************************************************************
.
Celkový čas: 2010-03-23 12:23:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-23 11:23
ComboFix2.txt 2010-03-23 10:48
ComboFix3.txt 2010-03-05 11:40

Před spuštěním: Volných bajtů: 95 898 812 416
Po spuštění: Volných bajtů: 95 856 340 992

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - DFEED87C1764D8E7756B4C21DC985FC0

[JaRon]

su este nejake problemy ?

[ramin1328]

modra obrazovka se objevi jen nekdy pri chybe videa ve vlc payer /nv4/
ale stale trva vytuhnuti PC po prvním startu...

[JaRon]

vytvor bootCD http://www.viry.cz/forum/viewtopic.php?f=29&t=66880 a otestuj PC >> doporucujem Avira alebo Kaspersky