Po restartu, vše jak před dvěma dny... pls. Help

[Spo.On]

Dobrý den, před dvěma dny mi začlo PC stávkovat. Pokud něco vymažu či změním data v nějakém dokumentu a restartuji počítač vše je tak jako kdybych to nezměnil... taky pozoruji zajímavost že pokud kliknu na hodiny tak mě to oznámí že nemám dostatečné oprávnění pro změnu systémového času, obnovení systému nepomáhá... začínám být zoufalý protože na reinstal a zálohování nemám čas...
budu rád za každou reakci..
tady log:


Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-04-07 18:22:53
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 184 GB (39%) free of 477 GB
Total RAM: 2046 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:09, on 7.4.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://hawxgame.com/demo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [GEST] m‘|\ü
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EasyTuneVI] C:\Program Files\GIGABYTE\ET6\ETcall.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESMART.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: GIGABYTE Gamer HUD.lnk = C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe
O4 - Startup: MemSet.exe.lnk = C:\WINDOWS\MemSave\MemSet.exe
O4 - Global Startup: forteManager.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: DFServ - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Služba Google Update (gupdate1ca9471cce7c6bc) (gupdate1ca9471cce7c6bc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6411 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll [2010-04-02 1602912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-04 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GEST"=m‘|\ü []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"nwiz"=nwiz.exe /install []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-08-02 13570048]
"EasyTuneVI"=C:\Program Files\GIGABYTE\ET6\ETcall.exe [2007-07-26 20480]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-01-04 149280]
"AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2010-04-02 2064224]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-07-27 1983816]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]
"DrvIcon"=C:\Program Files\Vista Drive Icon\DrvIcon.exe []
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [2004-04-17 196608]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-04-13 69632]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-08-02 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-10-30 16269312]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SmartGuardian"=C:\Program Files\ITE\Smart Guardian\ITESMART.exe [2006-01-18 196608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 40448]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe -silent []
"ICQ"=C:\Program Files\ICQ6.5\ICQ.exe silent []
"RGSC"=C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2010-01-24 306088]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
forteManager.lnk - C:\Program Files\LG Soft India\forteManager\bin\Monitor.exe

C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění
GIGABYTE Gamer HUD.lnk - C:\Program Files\GIGABYTE\Gamer HUD\HUD.exe
MemSet.exe.lnk - C:\WINDOWS\MemSave\MemSet.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2008-01-01 12464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
C:\WINDOWS\system32\LogonDll.dll [2009-08-05 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\GIGABYTE\ET6\UpdExe.exe"="C:\Program Files\GIGABYTE\ET6\UpdExe.exe:*:Enabled:Exe File"
"C:\Program Files\GIGABYTE\EnergySaver\run.exe"="C:\Program Files\GIGABYTE\EnergySaver\run.exe:*:Enabled:update"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe"="C:\Program Files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:*:Enabled:Burnout(TM) Paradise The Ultimate Box"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\GIGABYTE\ET6\GBTUpd.exe"="C:\Program Files\GIGABYTE\ET6\GBTUpd.exe:*:Enabled:GBTUpd.exe"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe"="C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service"
"C:\Program Files\GIGABYTE\@BIOS\gwflash.exe"="C:\Program Files\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:@BIOS Application"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\AVG\AVG9\avgemc.exe"="C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\Counter-Strike 1.6\hl.exe"="C:\Program Files\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\EA Games\Battlefield 1942\BF1942.exe"="C:\Program Files\EA Games\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"C:\Documents and Settings\Administrator\Plocha\TTDX\openttd.exe"="C:\Documents and Settings\Administrator\Plocha\TTDX\openttd.exe:*:Enabled:OpenTTD"
"C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon Demo\rct.exe"="C:\Program Files\Hasbro Interactive\RollerCoaster Tycoon Demo\rct.exe:*:Enabled:rct"
"C:\Documents and Settings\Administrator\Plocha\winbox.exe"="C:\Documents and Settings\Administrator\Plocha\winbox.exe:*:Enabled:winbox"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe"="C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\SETUP.EXE /UPDATE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1eac458e-1499-11df-ae3c-001fd02de8e2}]
shell\AutoRun\command - STOBOM/odlazim.exe
shell\explore\command - STOBOM/odlazim.exe
shell\open\command - STOBOM/odlazim.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3bca36e8-eee8-11de-b94a-001fd02de8e2}]
shell\AutoRun\command - STOBOM/odlazim.exe
shell\explore\command - STOBOM/odlazim.exe
shell\open\command - STOBOM/odlazim.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3bca36e9-eee8-11de-b94a-001fd02de8e2}]
shell\AutoRun\command - STOBOM/odlazim.exe
shell\explore\command - STOBOM/odlazim.exe
shell\open\command - STOBOM/odlazim.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51a8d543-ecd2-11de-acc2-806d6172696f}]
shell\AutoRun\command - D:\SETUP.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f18edcd6-082e-11df-ade7-001fd02de8e2}]
shell\AutoRun\command - STOBOM/odlazim.exe
shell\explore\command - STOBOM/odlazim.exe
shell\open\command - STOBOM/odlazim.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f18edcd7-082e-11df-ade7-001fd02de8e2}]
shell\AutoRun\command - STOBOM/odlazim.exe
shell\explore\command - STOBOM/odlazim.exe
shell\open\command - STOBOM/odlazim.exe


======List of files/folders created in the last 1 months======

2010-04-07 18:22:54 ----D---- C:\Program Files\trend micro
2010-04-07 18:22:53 ----D---- C:\rsit
2010-04-04 17:07:09 ----A---- C:\WINDOWS\system32\LogonDll.dll
2010-04-04 17:07:06 ----D---- C:\Program Files\Faronics
2010-04-04 11:20:34 ----RA---- C:\WINDOWS\system32\Ntport.dll
2010-04-04 11:20:34 ----RA---- C:\WINDOWS\system32\Msstdfmt.dll
2010-04-04 11:20:34 ----RA---- C:\WINDOWS\system32\itevio.dll
2010-04-04 11:20:33 ----D---- C:\WINDOWS\SysWow64
2010-04-04 11:20:33 ----D---- C:\Program Files\ITE
2010-04-04 10:53:49 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-04-04 10:53:49 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-04-04 10:53:48 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-04-04 10:53:48 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-04-04 10:38:33 ----D---- C:\Program Files\METRO 2033
2010-04-04 09:23:56 ----D---- C:\Config.Msi
2010-04-04 09:13:59 ----A---- C:\WINDOWS\ntbtlog.txt
2010-04-03 17:45:05 ----D---- C:\Program Files\Sophos
2010-04-03 10:00:05 ----D---- C:\Documents and Settings\Administrator\Data aplikací\DAEMON Tools Lite
2010-04-03 10:00:03 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2010-04-03 09:17:13 ----D---- C:\Program Files\Steam
2010-04-02 22:12:25 ----A---- C:\WINDOWS\Alcmtr.exe
2010-04-02 22:07:33 ----D---- C:\WINDOWS\NV3676340.TMP
2010-04-02 21:43:20 ----A---- C:\WINDOWS\system32\wshirda.dll
2010-04-02 21:43:20 ----A---- C:\WINDOWS\system32\irmon.dll
2010-04-02 21:43:20 ----A---- C:\WINDOWS\system32\irftp.exe
2010-03-31 19:25:29 ----HDC---- C:\WINDOWS\$NtUninstallKB980182$
2010-03-28 10:21:39 ----D---- C:\RAR
2010-03-16 03:37:50 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2010-03-16 03:37:50 ----A---- C:\WINDOWS\system32\nvmctray.dll
2010-03-16 03:37:50 ----A---- C:\WINDOWS\system32\nvmccs.dll
2010-03-16 03:37:50 ----A---- C:\WINDOWS\system32\nvcpl.dll
2010-03-16 03:37:50 ----A---- C:\WINDOWS\system32\nvcolor.exe
2010-03-16 03:37:44 ----A---- C:\WINDOWS\system32\nvwddi.dll
2010-03-15 20:59:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Codemasters
2010-03-15 20:56:41 ----D---- C:\Documents and Settings\Administrator\Data aplikací\vlc
2010-03-15 20:56:00 ----D---- C:\Program Files\BRS
2010-03-15 20:55:50 ----RA---- C:\WINDOWS\system32\tmp22D.tmp
2010-03-15 20:55:50 ----RA---- C:\WINDOWS\system32\tmp22C.tmp
2010-03-15 20:51:19 ----D---- C:\Program Files\Codemasters
2010-03-14 19:54:06 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Mikrotik
2010-03-12 15:32:40 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-03-12 15:32:39 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-03-12 15:32:39 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-03-12 15:32:38 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-03-12 15:32:38 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-03-11 21:39:35 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-11 00:57:52 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$

======List of files/folders modified in the last 1 months======

2010-04-07 18:22:55 ----D---- C:\WINDOWS\Prefetch
2010-04-07 18:22:54 ----RD---- C:\Program Files
2010-04-07 18:17:07 ----D---- C:\Program Files\Mozilla Firefox
2010-04-07 18:15:56 ----D---- C:\WINDOWS\Temp
2010-04-07 18:15:51 ----D---- C:\WINDOWS
2010-04-07 18:15:42 ----D---- C:\WINDOWS\system32
2010-04-04 17:07:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-04 17:07:15 ----D---- C:\WINDOWS\system32\drivers
2010-04-04 11:20:33 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-04 10:57:19 ----SHD---- C:\WINDOWS\Installer
2010-04-04 10:55:49 ----D---- C:\Program Files\NVIDIA Corporation
2010-04-04 10:55:48 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-04-04 10:53:49 ----HD---- C:\WINDOWS\inf
2010-04-04 10:53:20 ----RSD---- C:\WINDOWS\assembly
2010-04-04 10:53:09 ----D---- C:\WINDOWS\system32\CatRoot
2010-04-04 10:53:07 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-04 10:51:28 ----D---- C:\WINDOWS\system32\DirectX
2010-04-04 09:31:05 ----D---- C:\WINDOWS\system32\config
2010-04-04 09:30:30 ----D---- C:\WINDOWS\system32\wbem
2010-04-04 09:30:23 ----D---- C:\WINDOWS\Registration
2010-04-04 09:25:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-04 09:24:52 ----D---- C:\WINDOWS\Help
2010-04-03 13:19:23 ----A---- C:\WINDOWS\system.ini
2010-04-03 10:58:29 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Real
2010-04-03 09:16:56 ----D---- C:\WINDOWS\WinSxS
2010-04-02 22:12:54 ----D---- C:\WINDOWS\system32\RTCOM
2010-04-02 22:12:25 ----D---- C:\Program Files\Realtek
2010-04-02 22:07:34 ----D---- C:\WINDOWS\nview
2010-04-02 21:43:20 ----D---- C:\WINDOWS\Media
2010-03-31 15:42:16 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-29 18:47:45 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-03-15 17:34:18 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-14 22:34:29 ----D---- C:\Documents and Settings\Administrator\Data aplikací\dvdcss
2010-03-13 11:37:04 ----D---- C:\Fraps
2010-03-12 16:25:54 ----D---- C:\Program Files\Electronic Arts
2010-03-12 16:25:04 ----D---- C:\WINDOWS\Logs
2010-03-11 00:57:58 ----A---- C:\WINDOWS\imsins.BAK
2010-03-11 00:57:54 ----D---- C:\Program Files\Movie Maker
2010-03-10 06:43:10 ----A---- C:\WINDOWS\system32\shdocvw.dll
2010-03-10 06:43:04 ----A---- C:\WINDOWS\system32\browseui.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-01-01 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-01-01 29512]
R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-01-01 242696]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-03 4394496]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-08-02 6121856]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-06-16 109184]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 AODDriver;AODDriver; \??\C:\Program Files\GIGABYTE\ET6\i386\AODDriver.sys []
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cpuz130\cpuz_x32.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 etdrv;etdrv; \??\C:\WINDOWS\etdrv.sys []
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt []
S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2010-01-25 13224]
S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2010-01-25 25512]
S3 GVTDrv;GVTDrv; \??\C:\WINDOWS\system32\Drivers\GVTDrv.sys []
S3 LGDDCDevice;LGDDCDevice; \??\C:\Program Files\LG Soft India\forteManager\bin\I2CDriver.sys []
S3 LGII2CDevice;LGII2CDevice; \??\C:\Program Files\LG Soft India\forteManager\bin\PII2CDriver.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg9emc;AVG Free E-mail Scanner; C:\Program Files\AVG\AVG9\avgemc.exe [2008-01-01 916760]
R2 avg9wd;AVG Free WatchDog; C:\Program Files\AVG\AVG9\avgwdsvc.exe [2008-01-01 308064]
R2 DFServ;DFServ; C:\Program Files\Faronics\Deep Freeze\Install C-0\DFServ.exe [2009-08-05 1056256]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2009-02-10 116104]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-04 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-08-02 163908]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-02-23 75064]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S2 GEST Service;GEST Service for program management.; C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe [2008-07-11 80392]
S2 gupdate1ca9471cce7c6bc;Služba Google Update (gupdate1ca9471cce7c6bc); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-13 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Spo.On]

nikdo nic?...

[motji]

Dobrý večer
Musíte vyčkat než se Vás někdo ujme, nejsme zde pořád

Jinak zálohu důležitých dat by jste měl vždy, je to jen počítač , takže i ted, před odvirováním, to nejdůležitější zazálohujte

Zapojte do pc všechny usb klíče, flashky...co používáte


Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

[Spo.On]

Tak s tím bude trochu problém protože se po každém testu restartuje PC... tím pádem sem tam kde před tím a k logu se ani nedostanu...

[motji]

ted Vám nerozumím .
Když spustíte combofix, po fázi 50 se restartuje, pak znovu naběhne combofix a vytvoří se log.
U Vás to tak neproběhne?

[Spo.On]

Bohužel, po restartu se obnový všechno, tak jak tomu bylo před několika dny, takže po restartu tam není ani combofix stáhlý....

[motji]

Stahněte AVZ http://z-oleg.com/avz4.zip na plochu
- rozbalte tak aby byla jen jedna slozka avz4
- spusťe AVZ.exe

--------------

-klikněte na file-customscripts
-do okna vložte text

Kód: Vybrat vše

begin
ExecuteStdScr(1);
ExecuteStdScr(3);
RebootWindows(true);
end.

-klikněte na Run
-log pak vložte zde jako přílohu v zipu

[Spo.On]

A zase restart , ale snad sem si s tím poradil, vynechal jsem: "RebootWindows(true);" snad je ten log v pořádku

[motji]

omlouvám se
Dejte mi chvilku na log

[motji]

Předpokládám, že to dělá i v nouzovém režimu?

[Spo.On]

Ano chová se úplně stejně..

[motji]

Dejte soubor otestovat na http://www.virustotal.com


c:\program files\internet explorer\wmpscfgs.exe
C:\WINDOWS\SYSTEM32\LogonDll.dll
c:\docume~1\monika~1\locals~1\temp\rtkbtmnt.exe
C:\WINDOWS\system32\app_dll.dll
C:\WINDOWS\system32\1028s.exe

-Na virustotalu dáte procházet, a do spodního okénka nakopírujete přímo cestu k souboru a dáte odeslat
-z prohlížeče zkopírujete adresu ke stránce s výsledky
-pokud se Vás zeptá, dejte soubor otestovat znovu, tak aby to byl soubor z Vašeho počítače

[Spo.On]

Otestuje mi to jen C:\WINDOWS\SYSTEM32\LogonDll.dll a ten je v pořádku, ostatní nemůže najít ... v dokumentech ani žádnou Moniku nemám... vypadá to na jiné odkazy...

[motji]

omlouvám se,zaměnila jsem Váš log z jiným . Jdu kouknout na ten správný. Nezlobte se .

[motji]

Takže log z AVZ byl v pořádku .
Jdeme tedy hledat dál. V registrech asi ručně dělat upravy nemůžete

Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
-nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
-po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.

Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-počítač se restartuje


Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

A jestli mbam nic nenajde, půjdeme na to live cd