ZASE NĚCO

[brankar]

zdravím PEER BLOCK ,BLOKUJE pořád se na počítač připojujICÍ ip adresU IANA PRIVATE USE RFC 1918 NEVÍTE CO TO JE .

TADY JE ZATÍM LOG
Logfile of random's system information tool 1.07 (written by random/random)
Run by user at 2010-06-03 10:09:20
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 74 GB (49%) free of 153 GB
Total RAM: 511 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:09:50, on 3.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\opera.exe
C:\Documents and Settings\user\Dokumenty\kikikikikikikikikikikiiá\RSIT.exe
C:\Program Files\trend micro\user.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS5\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O17 - HKLM\System\CS6\Services\Tcpip\..\{7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7}: NameServer = 10.1.1.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4612 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-02-02 1800464]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"AtiPTA"=C:\WINDOWS\system32\atiptaxx.exe [2005-11-23 344064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-11-23 47104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoResolveTrack"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoResolveTrack"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\2K Sports\NBA 2K10\nba2k10.exe"="C:\Program Files\2K Sports\NBA 2K10\nba2k10.exe:*:Enabled:2K Sports NBA 2K10"
"C:\Documents and Settings\user\Dokumenty\košikova nba\nba2k10.exe"="C:\Documents and Settings\user\Dokumenty\košikova nba\nba2k10.exe:*:Enabled:2K Sports NBA 2K10"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe:*:Enabled:Football Manager 2010"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe"="C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\Ares\Ares.exe"="C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\Program Files\opera.exe"="C:\Program Files\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-06-03 10:09:20 ----D---- C:\rsit
2010-06-03 09:37:20 ----SHD---- C:\RECYCLER
2010-06-03 09:32:46 ----A---- C:\ComboFix.txt
2010-06-03 09:12:04 ----A---- C:\WINDOWS\zip.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\SWSC.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\SWREG.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\sed.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\PEV.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\NIRCMD.exe
2010-06-03 09:12:04 ----A---- C:\WINDOWS\grep.exe
2010-06-03 09:11:51 ----D---- C:\WINDOWS\ERDNT
2010-06-03 09:11:29 ----D---- C:\Qoobox
2010-06-03 02:43:51 ----D---- C:\Program Files\PeerBlock
2010-06-02 16:54:47 ----D---- C:\Program Files\LucasArts
2010-06-01 20:58:44 ----D---- C:\WINDOWS\ PMDG 747-400 All In One 747-400F CARGO
2010-06-01 20:58:08 ----A---- C:\WINDOWS\ PMDG 747-400 All In One 747-400F CARGO Setup Log.txt
2010-05-30 20:35:43 ----D---- C:\WINDOWS\system32\Samsung_USB_Drivers
2010-05-09 18:10:11 ----D---- C:\Program Files\MultiRes
2010-05-09 18:08:50 ----D---- C:\Program Files\Radeon Omega Drivers
2010-05-09 16:39:28 ----D---- C:\Program Files\ATI Technologies
2010-05-06 18:46:48 ----D---- C:\Program Files\3D Driving-School

======List of files/folders modified in the last 1 months======

2010-06-03 10:09:28 ----D---- C:\WINDOWS\Prefetch
2010-06-03 10:09:26 ----D---- C:\Program Files\trend micro
2010-06-03 09:26:12 ----D---- C:\WINDOWS
2010-06-03 09:26:12 ----A---- C:\WINDOWS\system.ini
2010-06-03 09:24:02 ----D---- C:\WINDOWS\temp
2010-06-03 09:20:33 ----D---- C:\WINDOWS\system32\drivers
2010-06-03 09:20:33 ----D---- C:\WINDOWS\system32
2010-06-03 09:20:33 ----D---- C:\WINDOWS\AppPatch
2010-06-03 09:20:25 ----D---- C:\Program Files\Common Files
2010-06-03 09:12:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-03 08:40:21 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-03 02:49:20 ----A---- C:\WINDOWS\wincmd.ini
2010-06-03 02:48:04 ----SHD---- C:\System Volume Information
2010-06-03 02:48:04 ----D---- C:\WINDOWS\system32\Restore
2010-06-03 02:46:32 ----RD---- C:\Program Files
2010-06-02 20:45:44 ----D---- C:\Documents and Settings\user\Data aplikací\Hamachi
2010-06-02 20:34:52 ----SHD---- C:\WINDOWS\Installer
2010-06-02 20:34:52 ----D---- C:\Config.Msi
2010-06-02 16:55:03 ----HD---- C:\Program Files\InstallShield Installation Information
2010-06-01 20:44:09 ----D---- C:\Documents and Settings\user\Data aplikací\uTorrent
2010-05-31 08:41:31 ----D---- C:\Program Files\Microsoft Games
2010-05-30 20:36:52 ----D---- C:\Program Files\Samsung
2010-05-30 20:32:39 ----HD---- C:\WINDOWS\inf
2010-05-25 19:08:49 ----D---- C:\Program Files\EA GAMES
2010-05-22 11:43:20 ----D---- C:\Program Files\Electronic Arts
2010-05-09 19:33:09 ----D---- C:\Program Files\EA Sports
2010-05-09 19:07:50 ----D---- C:\Program Files\KONAMI
2010-05-09 18:08:51 ----A---- C:\WINDOWS\Radeon Omega Drivers v2.6.87 Uninstall.exe
2010-05-09 17:29:55 ----RSD---- C:\WINDOWS\assembly
2010-05-09 15:02:53 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-05 12:01:02 ----A---- C:\mbam-error.txt
2010-05-05 12:00:59 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-05-04 15:44:43 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-05-04 15:35:36 ----SD---- C:\Documents and Settings\user\Data aplikací\Microsoft
2010-05-04 15:17:13 ----D---- C:\WINDOWS\WinSxS
2010-05-04 14:45:58 ----RSD---- C:\WINDOWS\Fonts
2010-05-04 07:46:56 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-10-30 75072]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-02-02 134344]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service; C:\WINDOWS\System32\Drivers\ousbehci.sys [2005-07-15 45696]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-08-30 637713]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-11-23 1410560]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support; C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2005-07-15 56960]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 ATICDSDr;ATICDSDr; \??\C:\DOCUME~1\user\LOCALS~1\Temp\{9B94B~1\atiicdxx.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\user\LOCALS~1\Temp\catchme.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-06-02 25280]
S3 mbr;mbr; \??\C:\DOCUME~1\user\LOCALS~1\Temp\mbr.sys []
S3 pbfilter;pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys []
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 83592]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704]
S3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-10-10 721904]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-11-23 393216]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-02-02 723632]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-07-16 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-07-16 189744]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------




info.txt logfile of random's system information tool 1.06 2010-06-03 10:10:04

======Uninstall list======

PMDG 747-400 All In One 747-400F CARGO-->"C:\WINDOWS\ PMDG 747-400 All In One 747-400F CARGO\uninstall.exe" "/U:C:\Program Files\Microsoft Games\Flight Simulator 9\Uninstall\uninstall.xml"
-->MsiExec.exe /X{7B4AB13C-1A5C-4BC5-ABA6-762F8198444C}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
18 Wheels of Steel Pedal to the Metal-->C:\Program Files\18 WoS Pedal to the Metal\uninst.exe
3D Driving-School-->"C:\program files\3D Driving-School\uninstall.exe"
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
AbsoluteShield File Shredder-->"C:\Program Files\SysShield Tools\File Shredder\unins000.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3.2 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A93000000001}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
AGEIA PhysX v6.10.25-->MsiExec.exe /X{7104189A-C592-4A56-AC9E-7C0CA135DA3C}
AGEIA PhysX v7.07.09-->MsiExec.exe /X{65F1CF63-31E0-450B-96F3-4A88BE7361A6}
Aktualizace systému Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aktualizace zabezpečení systému Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Ares 2.1.0-->"C:\Program Files\Ares\uninstall.exe"
ATI Catalyst Control Center-->MsiExec.exe /I{F85B3B0A-E302-4B67-9220-6B57F075B311}
ATI Display Driver (Omega 2.6.87)-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Autodesk DWF Writer-->MsiExec.exe /X{A2A5C34C-BD78-4505-9E57-AFCDF2FB926C}
Catalyst Control Center - Branding-->MsiExec.exe /I{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}
CCC-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
COMODO Internet Security-->C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe -u
Creation Master 10 Release 10.1-->"C:\Program Files\Fifa Master\Creation Master 10\unins000.exe"
Domácí násilí - Game Over-->C:\Program Files\Centauri\GameOver\uninstall.exe
Euro Truck Simulator-->C:\Program Files\Euro Truck Simulator\Uninstal_EuroTruckSimulator.exe
Football Manager 2010-->"C:\Program Files\Sports Interactive\Football Manager 2010\Uninstall_Football Manager 2010\Uninstall Football Manager 2010.exe"
Free Mp3/Wma/Ogg Converter 4.0.1-->"C:\Program Files\Free Mp3WmaOgg Converter\unins000.exe"
Harry Potter a Princ Dvojí Krve™-->MsiExec.exe /X{FD1B1980-8CAB-4474-89F8-1245AF657AD1}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Landwirtschafts-Simulator 2009-->"C:\Program Files\Landwirtschafts-Simulator 2009\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MariusSoft Disk Scrubber-->MsiExec.exe /I{083A7AA2-8871-42B0-8513-7428F44DFC38}
Medal of Honor Allied Assault(tm) Spearhead-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7914BE1E-F186-4790-B8F4-9F63C52A41C1}\Setup.exe" -l0x9
Medal of Honor Allied Assault-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DEA94ED-915A-4834-A87E-388D012C8E02}\Setup.exe" -l0x9
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Flight Simulator 2004 A Century of Flight-->"C:\Program Files\Microsoft Games\Flight Simulator 9\UNINSTAL.EXE" /runtemp /addremove
Microsoft Midtown Madness Trial Version-->"C:\Program Files\Microsoft Games\Midtown Madness Trial\UNINSTAL.EXE" /runtemp /uninstall
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110405-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MultiRes (remove only)-->C:\Program Files\MultiRes\uninstal.exe
NHL® 09-->MsiExec.exe /X{F2B5A2A7-2DF9-4361-8BD5-362714528B51}
Opera 10.10-->MsiExec.exe /X{FB8148DD-C575-4B0A-9F6C-0CFC46937930}
Opera 9.61-->MsiExec.exe /X{F8CCEF4F-6EEF-4B81-B70D-821E72451D93}
Oprava Hotfix systému Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Ovladače ATI-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC}\setup.exe"
PeerBlock 1.0.0 (r181)-->"C:\Program Files\PeerBlock\unins000.exe"
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
Pro Evolution Soccer 2009-->MsiExec.exe /X{A8DB611A-D80E-450D-85F6-3ACDD164BE31}
Pro Evolution Soccer 2010-->MsiExec.exe /X{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}
Radeon Omega Drivers v2.6.87 Setup Files and Tools-->"C:\WINDOWS\Radeon Omega Drivers v2.6.87 Uninstall.exe" "/U:C:\Program Files\Radeon Omega Drivers\v2.6.87\Omega Uninstall.xml"
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x0005 -removeonly
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Star Wars Jedi Knight Jedi Academy-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1EECBA68-8BE4-4076-94DF-E9ED206B1D21}\Setup.exe" -l0x9
Star Wars: Jedi Knight - Jedi Academy CZ-->C:\Program Files\LucasArts\Star Wars Jedi Knight Jedi Academy\Uninstal.exe
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Total Commander (Remove or Repair)-->C:\Program Files\totalcmd\tcuninst.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Virtua Tennis 3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9B63540D-D942-4C38-B42E-A48AE0145970}\setup.exe" -l0x9 -removeonly
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
WinXP Manager-->MsiExec.exe /I{1043E281-B080-4947-9BD7-3F1D233BF6D2}
WinXP Manager-->MsiExec.exe /I{DE6A7775-D036-4216-AD8A-2ACBAC49F532}
World of Warcraft FREE Trial-->MsiExec.exe /X{02EBDBB9-4600-41D3-B566-40CB861511D2}

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: COMODO Antivirus (disabled)
AV: AVG (disabled) (outdated)

======System event log======

Computer Name: VLASTN-81FD8C78
Event Code: 7036
Message: Stav služby Správce vzdáleného přístupu byl změněn na: Spuštěno

Record Number: 22623
Source Name: Service Control Manager
Time Written: 20100502082357.000000+120
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 7036
Message: Stav služby Prohledávání počítačů byl změněn na: Zastaveno

Record Number: 22622
Source Name: Service Control Manager
Time Written: 20100502082356.000000+120
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 7036
Message: Stav služby Služba brány aplikačního rozhraní byl změněn na: Spuštěno

Record Number: 22621
Source Name: Service Control Manager
Time Written: 20100502082355.000000+120
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 7035
Message: Řídící příkaz Spuštěno byl službě Služba brány aplikačního rozhraní úspěšně odeslán.

Record Number: 22620
Source Name: Service Control Manager
Time Written: 20100502082355.000000+120
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: VLASTN-81FD8C78
Event Code: 7036
Message: Stav služby Služba rozpoznávání pomocí protokolu SSDP byl změněn na: Spuštěno

Record Number: 22619
Source Name: Service Control Manager
Time Written: 20100502082354.000000+120
Event Type: Informace
User:

=====Application event log=====

Computer Name: VLASTN-81FD8C78
Event Code: 11708
Message: Product: Pro Evolution Soccer 2010 -- Installation operation failed.

Record Number: 5
Source Name: MsiInstaller
Time Written: 20091026164511.000000+060
Event Type: Informace
User: VLASTN-81FD8C78\user

Computer Name: VLASTN-81FD8C78
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 4
Source Name: SecurityCenter
Time Written: 20091026083853.000000+060
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 3
Source Name: SecurityCenter
Time Written: 20091026073416.000000+060
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 2
Source Name: SecurityCenter
Time Written: 20091025134906.000000+060
Event Type: Informace
User:

Computer Name: VLASTN-81FD8C78
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 1
Source Name: SecurityCenter
Time Written: 20091025122357.000000+060
Event Type: Informace
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Samsung\Samsung PC Studio 3;C:\Program Files\ATI Technologies\ATI.ACE
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0103
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

[Rudy]

Když nejdřív uděláte sken CF a pak nám dáte RSIT, nezjistíme nic. Dejte log z ComboFix, jehož sken jste dnes dělal.

[brankar]

OMLOUVÁM SE TADY JE


ComboFix 10-06-02.03 - user 03.06.2010 9:14.45.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.511.248 [GMT 2:00]
SpuÜtýnř z: c:\documents and settings\user\Dokumenty\kikikikikikikikikikikiiß\ComboFix.exe
AV: AVG *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Soubory vytvo°enÚ od 2010-05-03 do 2010-06-03 )))))))))))))))))))))))))))))))
.

2010-06-03 00:43 . 2010-06-03 07:10 -------- d-----w- c:\program files\PeerBlock
2010-06-02 14:54 . 2010-06-02 14:54 -------- d-----w- c:\program files\LucasArts
2010-06-01 18:58 . 2010-06-01 18:58 -------- d-----w- c:\windows\ PMDG 747-400 All In One 747-400F CARGO
2010-05-31 09:40 . 2010-05-31 09:40 61 --sh--w- c:\windows\cnerolf.dat
2010-05-30 18:35 . 2010-05-30 18:35 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2010-05-30 18:34 . 2006-07-24 14:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-05-09 16:10 . 2010-05-19 09:11 -------- d-----w- c:\program files\MultiRes
2010-05-09 16:08 . 2010-05-09 16:08 -------- d-----w- c:\program files\Radeon Omega Drivers
2010-05-09 14:39 . 2010-05-09 14:39 -------- d-----w- c:\program files\ATI Technologies
2010-05-06 16:46 . 2010-05-22 13:35 -------- d-----w- c:\program files\3D Driving-School

.
(((((((((((((((((((((((((((((((((((((((( Find3M vřpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-02 18:38 . 2009-07-09 18:19 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-06-02 14:55 . 2008-10-17 21:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-31 06:41 . 2009-10-26 12:45 -------- d-----w- c:\program files\Microsoft Games
2010-05-30 18:36 . 2008-12-24 18:35 -------- d-----w- c:\program files\Samsung
2010-05-25 17:08 . 2010-01-24 11:55 -------- d-----w- c:\program files\EA GAMES
2010-05-22 09:43 . 2009-10-10 16:24 -------- d-----w- c:\program files\Electronic Arts
2010-05-09 17:33 . 2008-10-26 06:54 -------- d-----w- c:\program files\EA Sports
2010-05-09 17:07 . 2010-02-01 19:25 -------- d-----w- c:\program files\KONAMI
2010-05-09 16:08 . 2010-02-02 12:16 451072 ----a-w- c:\windows\Radeon Omega Drivers v2.6.87 Uninstall.exe
2010-05-09 13:42 . 2009-10-03 14:02 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-05 10:00 . 2010-02-18 11:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-29 13:39 . 2010-02-18 11:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2010-02-18 11:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 09:07 . 2010-04-25 09:07 -------- d-----w- c:\program files\Centauri
2010-04-21 16:12 . 2010-04-21 16:12 -------- d-----w- c:\program files\18 WoS Pedal to the Metal
2010-04-14 09:36 . 2010-04-14 09:36 -------- d-----w- c:\program files\GetData
2010-04-05 12:39 . 2010-04-05 11:31 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-05 11:30 . 2008-10-22 14:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-28 12:57 . 2006-03-02 12:00 91866 ----a-w- c:\windows\system32\perfc005.dat
2010-03-28 12:57 . 2006-03-02 12:00 469558 ----a-w- c:\windows\system32\perfh005.dat
2010-01-06 12:46 . 2010-01-06 12:23 209 ----a-w- c:\program files\operaprefs_default.ini
2009-11-20 18:11 . 2009-11-20 18:11 15828 ----a-w- c:\program files\license.rtf
2009-11-20 18:01 . 2009-11-20 18:01 832296 ----a-w- c:\program files\opera.exe
2009-11-20 18:01 . 2009-11-20 18:01 4450088 ----a-w- c:\program files\opera.dll
2009-11-20 18:00 . 2009-11-20 18:00 653419 ----a-w- c:\program files\encoding.bin
2009-06-17 13:41 . 2009-06-17 13:41 3870 ----a-w- c:\program files\lngcode.txt
2004-02-26 12:35 . 2004-02-26 12:35 7904 ----a-w- c:\program files\html40_entities.dtd
.

(((((((((((((((((((((((((((((((((( SpouÜtýcÝ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznßmka* prßzdnÚ zßznamy a legitimnÝ vřchozÝ ˙daje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-02-02 1800464]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"AtiPTA"="atiptaxx.exe" [2005-11-23 344064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 12:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\2K Sports\\NBA 2K10\\nba2k10.exe"=
"c:\\Documents and Settings\\user\\Dokumenty\\koÜikova nba\\nba2k10.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2010\\fm.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\opera.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27.1.2009 11:14 64160]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [21.4.2009 10:57 134344]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17.2.2010 10:15 66632]
R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [3.2.2010 21:50 45696]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [3.2.2010 21:50 56960]
S3 ATICDSDr;ATICDSDr;\??\c:\docume~1\user\LOCALS~1\Temp\{9B94B~1\atiicdxx.sys --> c:\docume~1\user\LOCALS~1\Temp\{9B94B~1\atiicdxx.sys [?]
S3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [3.6.2010 2:43 14424]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17.2.2010 10:15 12872]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.10.2009 19:15 721904]
.
.
------- Dopl˛kovř sken -------
.
uDefault_Search_URL = hxxp://www.google.com
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {7E1B775D-FB9F-4945-8B6B-60D8BA4F52C7} = 10.1.1.1
.
- - - - NEPLATN╔ POLOÄKY ODSTRAN╠N╔ Z REGISTRU - - - -

HKLM-Run-StartCCC - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
HKLM-Run-ATICCC - c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe
AddRemove-69083DC58646DE46A09847A522A1CC487F918039 - c:\progra~1\DIFX\270581355A767BF1\dpinst32.exe
AddRemove-9722CA1E8F72F362E93CBEC75A707FDABFC8D880 - c:\progra~1\DIFX\270581355A767BF1\dpinst32.exe
AddRemove-All ATI Software - c:\program files\ATI Technologies\UninstallAll\AtiCimUn.exe
AddRemove-Medal of Honor Allied Assault v 1.0.0.1_is1 - c:\program files\EA GAMES\MOHAA\unins000.exe
AddRemove-PeerGuardian_is1 - c:\program files\PeerGuardian2\unins000.exe
AddRemove-Recuva - c:\program files\Recuva\uninst.exe
AddRemove-{2758691A-2CDE-4942-A4AC-0E8F61FE2067} - c:\program files\InstallShield Installation Information\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}\setup.exe
AddRemove-Airplanes Installer - c:\program files\Airplanes Installer\Uninstal.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-03 09:26
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

skenovßnÝ skrytřch proces¨ ...

skenovßnÝ skrytřch polo×ek 'Po spuÜtýnÝ' ...

skenovßnÝ skrytřch soubor¨ ...

sken byl ˙speÜný dokonŔen
skrytÚ soubory: 0

**************************************************************************
.
--------------------- ZAMKNUT╔ KL═╚E V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1409082233-1580818891-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1409082233-1580818891-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b7,4a,67,15,5b,a9,6a,5b,cd,e9,29,0d,e8,6d,03,26,ab,ed,d4,03,b1,05,91,
9e,12,18,64,cd,52,6a,9b,30,35,dd,39,6d,c6,2c,07,28,e0,cc,4d,3d,fe,d3,a7,b4,\
"??"=hex:8a,95,0c,91,36,dd,90,2c,2c,e3,05,7a,7a,8f,80,cc

[HKEY_USERS\S-1-5-21-1409082233-1580818891-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:01,38,c0,f0,9f,86,ce,1b,9b,97,ec,02,a1,a1,36,1d,98,51,81,c5,8c,
68,61,8a,14,b7,48,c9,32,14,df,e7,50,bc,54,d5,aa,8d,f6,19,7a,aa,ed,ff,ce,8b,\
"rkeysecu"=hex:03,a4,a8,d4,d9,9b,91,ef,48,52,9f,6c,1c,34,21,ac
.
--------------------- Knihovny navßzanÚ na bý×ÝcÝ procesy ---------------------

- - - - - - - > 'winlogon.exe'(628)
c:\windows\system32\guard32.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(684)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2800)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkovř Ŕas: 2010-06-03 09:32:43
ComboFix-quarantined-files.txt 2010-06-03 07:32

P°ed spuÜtýnÝm: Volnřch bajt¨: 77á667á229á696
Po spuÜtýnÝ: Volnřch bajt¨: 77á618á135á040

Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - F313E930093966E43034D0E8CC2984B5

[Rudy]

CF patrně smazal nějaké registry, ale ty nevypisuje. Log je jinak čistý. Jaká je IP adresa toho připojení?

[brankar]

ta IP adresa se pořád každou minutu mění
239.255.255.250.1900 UDP
10.1.1.6.255.137.UDP
ten program blokuje každou minutu 1až 3 tyto adresy POD NAZVEM IANA PRIVATE USE RFC 1918

[Rudy]

Zavřete ve firewallu porty 137 a 1900UDP. Problém by měl zmizet. 1. IP je nějeká speciální síť a 2. je vaše místní síť.

[brankar]

Rudo nevím co dělam špatně ale nemužu to najit

[Rudy]

Zde: http://www.viry.cz/forum/viewtopic.php?f=41&t=2783 je návod.

[brankar]

zdravím tak ani v tom Keriu jsem nenašel ......Síťová bezpečnost - paketový filtr - přidat -
je to verze 6.5.1

[Rudy]

Já vám to také přesněji nepovím, neznám detailně každou verzi, ale musí to být někde v síť zabezpečení (network security).

[mahajana]

Omlouvám se za vstup. RUDY ale

pro brankare:v programu PEERBLOCK prosimte dej pryc filtry--IANA+BOGON+NON LAN LIST
poradne nastuduj k cemu tyto filtry sou a potom sa dej rucne vyjimku pro tyto IP adresy sveho poskytovatele! nebo tyto filtry nepouzivej!!!!