Nemůžu spustit RSIT

[motji]

Musíte počkat až doskenuje, mě trval asi těch 10minut, ale já mám málo souborů v počítači.

Musíte mít trochu trpělivost, to byste poznal, kdyby zamrzl

[SGC]

Tak DDT už mi šel spustit, měl jsem něco zablokovaný v xp-Antispy. Tady je ten log:

DDS (Ver_10-03-17.01) - NTFSx86
Run by Jun Fan 1 at 10:22:51,44 on Łt 06.07.2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3318.2337 [GMT 2:00]

SP: Spyware Terminator *enabled* (Updated) {55EE49A8-16BE-4601-BBE6-607B7F7317DE}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\tsnpstd3.exe
C:\Windows\vsnpstd3.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Karliček\Documents\My Completed Downloads\Downloads\dds.pif
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

mURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\toolbar\ctbr.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - AskBar BHO
BHO: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Pomocná služba pro přihlášení ke službě Windows Live ID: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: Foxit Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} -
TB: &Crawler lišta: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\crawler\toolbar\ctbr.dll
uRun: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
uRun: [SpywareTerminatorUpdate] "c:\program files\spyware terminator\SpywareTerminatorUpdate.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] "c:\windows\system32\ctfmon.exe"
uRunOnce: [mctadmin] c:\windows\system32\mctadmin.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
StartupFolder: c:\users\junfan~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Crawler Search - tbr:iemenu
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/cs/uno1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\crawler\toolbar\ctbr.dll
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\junfan~1\appdata\roaming\mozilla\firefox\profiles\76r6xln9.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\crawler\toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\crawler\toolbar\firefox\components\xshared.dll
FF - component: c:\program files\crawler\toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\crawler\toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.default.XMLHttpRequest.channel", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.jit.chrome", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("security.checkloaduri", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("bidi.characterset", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\channel-prefs.js - pref("app.update.channel", "release");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-6-28 165456]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2010-7-1 142592]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-18 176128]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-6-28 17744]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-6-28 50256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-6-29 40384]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2010-5-26 26352]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2010-5-26 493032]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-6-29 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-6-29 40384]
R3 PAC207;Webcam 1200;c:\windows\system32\drivers\PFC027.SYS [2010-6-29 611584]
R3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-6-28 54632]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\wat\WatAdminSvc.exe [2010-6-29 1343400]

=============== Created Last 30 ================

2010-07-04 15:44:18 259378935 ----a-w- c:\windows\MEMORY.DMP
2010-07-03 12:07:43 0 d-----w- c:\program files\trend micro
2010-07-03 11:31:52 0 d-----w- c:\programdata\DonationCoder
2010-07-03 11:19:31 46 ----a-w- c:\windows\system32\DonationCoder_urlsnooper_InstallInfo.dat
2010-07-03 11:19:31 0 d-----w- c:\users\junfan~1\appdata\roaming\DonationCoder
2010-07-03 11:18:55 0 d-----w- c:\program files\WinPcap
2010-07-03 10:16:08 0 d-----w- c:\program files\GRETECH
2010-07-03 09:25:08 0 d-----w- c:\users\jun fan 1\Tracing
2010-07-03 08:50:45 0 d-----w- c:\programdata\NortonInstaller
2010-07-03 08:50:45 0 d-----w- c:\program files\NortonInstaller
2010-07-02 12:02:50 0 d-----w- c:\users\junfan~1\appdata\roaming\OpenOffice.org
2010-07-02 11:40:18 0 d-----w- c:\program files\OpenOffice.org 3
2010-07-02 11:39:35 0 d-----w- c:\program files\readmes
2010-07-02 11:39:35 0 d-----w- c:\program files\licenses
2010-07-01 11:54:49 0 d-----w- c:\program files\Crawler
2010-07-01 11:54:46 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-01 11:54:46 0 d-----w- c:\users\junfan~1\appdata\roaming\Spyware Terminator
2010-07-01 11:54:45 0 d-----w- c:\programdata\Spyware Terminator
2010-07-01 11:54:45 0 d-----w- c:\program files\Spyware Terminator
2010-07-01 11:01:04 0 d-----r- c:\program files\Skype
2010-07-01 10:48:36 0 d-----w- c:\users\junfan~1\appdata\roaming\CheckPoint
2010-07-01 10:14:49 0 d---a-w- c:\windows\rundll16.exe
2010-07-01 10:14:49 0 d---a-w- c:\windows\logo1_.exe
2010-07-01 10:12:31 0 d---a-w- c:\windows\VDLL.DLL
2010-07-01 10:12:31 0 d---a-w- c:\windows\system32\runouce.exe
2010-07-01 10:12:31 0 d---a-w- c:\windows\RUNDL132.EXE
2010-07-01 10:12:31 0 d---a-w- c:\windows\logo_1.exe
2010-07-01 10:10:56 53 ----a-w- c:\windows\Lic.xxx
2010-07-01 10:10:37 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-07-01 10:10:36 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-07-01 10:10:35 522 ----a-w- c:\windows\system32\Microsoft.VC80.CRT.manifest
2010-07-01 10:10:35 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-07-01 10:10:32 0 d-----w- c:\program files\common files\MicroWorld
2010-07-01 10:10:27 0 d-----w- c:\programdata\MicroWorld
2010-07-01 09:05:43 0 d-----w- C:\IswAppData
2010-06-30 13:19:55 0 d-----w- c:\programdata\Yahoo!
2010-06-30 13:18:30 0 d-----w- c:\program files\Yahoo!
2010-06-29 19:36:08 0 d-----w- c:\windows\system32\Adobe
2010-06-29 13:42:22 0 d-----w- c:\windows\PixArt
2010-06-29 13:38:27 6656 ----a-w- c:\windows\system32\CoInst_070629.dll
2010-06-29 13:38:27 611584 ----a-w- c:\windows\system32\drivers\PFC027.SYS
2010-06-29 13:38:27 0 d-----w- c:\windows\Webcam1200
2010-06-29 13:38:26 566 ----a-w- c:\windows\system32\SP207.INI
2010-06-29 13:38:26 129024 ----a-w- c:\windows\system32\SP207.AX
2010-06-29 13:38:25 0 d-----w- c:\program files\Webcam 1200
2010-06-29 13:12:10 16904 ----a-w- c:\windows\system32\authuitu.dll
2010-06-29 13:12:08 29704 ----a-w- c:\windows\system32\uxtuneup.dll
2010-06-29 13:12:03 0 d-----w- c:\programdata\TuneUp Software
2010-06-29 13:11:58 0 d-----w- c:\program files\TuneUp Utilities 2007
2010-06-29 13:10:57 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-06-29 12:55:04 880912 ----a-w- c:\windows\WM8EUTIL.exe
2010-06-29 12:55:04 0 d-----w- c:\program files\CD to MP3 Freeware
2010-06-29 12:50:23 0 d-----w- c:\program files\URLSnooper2
2010-06-29 12:43:21 0 d-----w- c:\programdata\Sun
2010-06-29 12:43:00 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-29 08:39:13 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-06-29 04:28:07 38848 ----a-w- c:\windows\avastSS.scr
2010-06-29 04:23:57 0 d-----w- c:\windows\system32\Wat
2010-06-29 04:22:30 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-29 04:22:30 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-29 04:22:30 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-29 04:22:30 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-29 04:22:30 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-29 04:20:23 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-06-28 19:40:12 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-06-28 19:39:55 132608 ----a-w- c:\windows\system32\cabview.dll
2010-06-28 18:38:15 0 d-----w- c:\program files\Foxit Software
2010-06-28 18:14:49 0 d-----w- c:\programdata\Skype
2010-06-28 18:06:54 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-06-28 17:07:23 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-06-28 17:06:44 0 d-----w- c:\programdata\Alwil Software
2010-06-28 16:47:40 0 d-----w- c:\program files\ZoneAlarm
2010-06-28 16:47:40 0 d-----w- c:\program files\Conduit
2010-06-28 16:47:21 0 d-----w- c:\program files\CheckPoint
2010-06-28 16:46:59 0 d-----w- c:\program files\Zone Labs
2010-06-28 16:43:44 0 d-----w- c:\windows\Internet Logs
2010-06-28 16:43:44 0 d-----w- c:\programdata\CheckPoint
2010-06-25 17:07:40 96784 ----a-w- c:\windows\system32\Packet.dll
2010-06-25 17:07:24 281104 ----a-w- c:\windows\system32\wpcap.dll
2010-06-25 17:07:14 35088 ----a-w- c:\windows\system32\drivers\npf.sys
2010-06-25 17:03:12 53299 ----a-w- c:\windows\system32\pthreadVC.dll
2010-06-10 13:37:18 455168 ----a-w- c:\program files\setup.exe
2010-06-10 12:22:28 0 d-----w- c:\programdata\Nero
2010-06-10 12:22:28 0 d-----w- c:\program files\Nero

==================== Find3M ====================

2010-07-06 06:35:53 622422 ----a-w- c:\windows\system32\perfh005.dat
2010-07-06 06:35:53 118604 ----a-w- c:\windows\system32\perfc005.dat
2010-06-28 16:48:00 421442 ---ha-w- c:\windows\system32\drivers\vsconfig.xml
2010-06-23 11:51:22 1238528 ----a-w- c:\windows\system32\zpeng25.dll
2010-06-10 13:42:58 123504223 ----a-w- c:\program files\openofficeorg1.cab
2010-06-10 13:37:18 3074560 ----a-w- c:\program files\openofficeorg32.msi
2010-06-10 13:37:18 290 ----a-w- c:\program files\setup.ini
2010-06-07 10:03:26 178396 ----a-w- c:\windows\fonts\opens___.ttf
2010-05-27 07:24:13 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49:37 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 05:18:06 977920 ----a-w- c:\windows\system32\wininet.dll
2010-05-15 14:30:50 461400 ----a-w- c:\windows\system32\drivers\vsdatant.sys
2010-05-09 09:14:55 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-05-09 09:14:50 417792 ----a-w- c:\windows\system32\msdri.dll
2010-05-01 14:49:25 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-04-23 07:13:36 2048 ----a-w- c:\windows\system32\tzres.dll
2009-07-14 08:43:59 36232 ----a-w- c:\windows\inf\perflib\0405\perfd.dat
2009-07-14 08:43:59 36232 ----a-w- c:\windows\inf\perflib\0405\perfc.dat
2009-07-14 08:43:59 292004 ----a-w- c:\windows\inf\perflib\0405\perfi.dat
2009-07-14 08:43:59 292004 ----a-w- c:\windows\inf\perflib\0405\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2010-03-08 07:50:51 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 10:23:34,79 ===============
Ale RSIT se stále zastaví u listing services and drivers...

[motji]

Zkuste ještě ten Otl

[SGC]

Čekal jsem na OTL hodinu a nic. Zabrané místo na disku je jen 28 GB. Kdyby mi OTL aspoň ukazoval že skenuje...

[motji]

Máte to nějaké divné

Odinstalujte Asktoolbar

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[SGC]

Tady je ten log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4281

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6.7.2010 14:15:39
mbam-log-2010-07-06 (14-15-39).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 236764
Uplynulý čas: 21 minuta(y), 20 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Users\Maminka\Documents\Přenosné Programy\Opera10usb\profile\temporary_downloads\SetupCasino_7d1658_cs.exe (Adware.Casino) -> No action taken.

Ask toolbar jsem u sebe nenašel, pouze yahoo, zonealarm a crawler toolbar.

[motji]

Co našel mbam, smažte.

Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
-nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
-po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-počítač se restartuje


Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

[SGC]

Vše provedeno a tady je ten log:

ComboFix 10-07-06.01 - Jun Fan 1 06.07.2010 20:18:55.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3318.2339 [GMT 2:00]
Spuštěný z: c:\users\Jun Fan 1\Desktop\ComboFix.exe
SP: Spyware Terminator *disabled* (Updated) {55EE49A8-16BE-4601-BBE6-607B7F7317DE}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\\setup.exe
c:\program files\Setup.exe
C:\Thumbs.db
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-06 do 2010-07-06 )))))))))))))))))))))))))))))))
.

2010-07-06 18:23 . 2010-07-06 18:23 -------- d-----w- c:\users\Maminka\AppData\Local\temp
2010-07-06 11:49 . 2010-07-06 11:49 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\Malwarebytes
2010-07-06 11:48 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-06 11:48 . 2010-07-06 11:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-06 11:48 . 2010-07-06 11:48 -------- d-----w- c:\programdata\Malwarebytes
2010-07-06 11:48 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-03 12:07 . 2010-07-06 09:11 -------- d-----w- c:\program files\trend micro
2010-07-03 11:33 . 2010-07-03 11:33 -------- d-----w- c:\users\Jun Fan 1\AppData\Local\Diagnostics
2010-07-03 11:31 . 2010-07-03 11:31 -------- d-----w- c:\programdata\DonationCoder
2010-07-03 11:19 . 2010-07-03 11:19 46 ----a-w- c:\windows\system32\DonationCoder_urlsnooper_InstallInfo.dat
2010-07-03 11:19 . 2010-07-03 11:19 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\DonationCoder
2010-07-03 11:18 . 2010-07-03 11:18 -------- d-----w- c:\program files\WinPcap
2010-07-03 10:16 . 2010-07-03 10:51 -------- d-----w- c:\program files\GRETECH
2010-07-03 09:25 . 2010-07-06 08:27 -------- d-----w- c:\users\Jun Fan 1\Tracing
2010-07-03 08:50 . 2010-07-03 08:50 -------- d-----w- c:\programdata\NortonInstaller
2010-07-03 08:50 . 2010-07-03 08:50 -------- d-----w- c:\program files\NortonInstaller
2010-07-02 12:02 . 2010-07-02 12:02 1 ----a-w- c:\users\Jun Fan 1\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-02 12:02 . 2010-07-02 12:02 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\OpenOffice.org
2010-07-02 11:40 . 2010-07-02 11:40 -------- d-----w- c:\program files\OpenOffice.org 3
2010-07-02 11:39 . 2010-07-02 11:39 -------- d-----w- c:\program files\readmes
2010-07-02 11:39 . 2010-07-02 11:39 -------- d-----w- c:\program files\licenses
2010-07-01 15:02 . 2010-07-05 23:22 -------- d-----w- c:\users\Maminka\AppData\Roaming\Spyware Terminator
2010-07-01 11:54 . 2010-07-01 11:54 -------- d-----w- c:\program files\Crawler
2010-07-01 11:54 . 2010-07-04 19:39 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\Spyware Terminator
2010-07-01 11:54 . 2010-07-01 11:54 6144 ----a-w- c:\programdata\Spyware Terminator\sp_rsdel.exe
2010-07-01 11:54 . 2010-07-01 11:54 5632 ----a-w- c:\programdata\Spyware Terminator\fileobjinfo.sys
2010-07-01 11:54 . 2010-07-01 11:54 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-01 11:54 . 2010-07-06 10:54 -------- d-----w- c:\program files\Spyware Terminator
2010-07-01 11:54 . 2010-07-05 13:59 -------- d-----w- c:\programdata\Spyware Terminator
2010-07-01 11:17 . 2010-07-01 11:21 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\vlc
2010-07-01 11:17 . 2010-07-01 11:17 114216 ----a-w- c:\users\Jun Fan 1\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-01 11:02 . 2010-07-01 14:42 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\skypePM
2010-07-01 11:01 . 2010-07-01 14:46 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\Skype
2010-07-01 11:01 . 2010-07-01 11:01 -------- d-----w- c:\program files\Common Files\Skype
2010-07-01 11:01 . 2010-07-01 11:01 -------- d-----r- c:\program files\Skype
2010-07-01 10:14 . 2010-07-01 10:14 -------- d---a-w- c:\windows\rundll16.exe
2010-07-01 10:14 . 2010-07-01 10:14 -------- d---a-w- c:\windows\logo1_.exe
2010-07-01 10:12 . 2010-07-01 10:12 -------- d---a-w- c:\windows\VDLL.DLL
2010-07-01 10:12 . 2010-07-01 10:12 -------- d---a-w- c:\windows\system32\runouce.exe
2010-07-01 10:12 . 2010-07-01 10:12 -------- d---a-w- c:\windows\RUNDL132.EXE
2010-07-01 10:12 . 2010-07-01 10:12 -------- d---a-w- c:\windows\logo_1.exe
2010-07-01 10:10 . 2010-07-01 10:10 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-07-01 10:10 . 2010-07-01 10:10 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-07-01 10:10 . 2010-07-01 10:10 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-07-01 10:10 . 2010-07-01 10:10 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-07-01 10:10 . 2010-07-01 10:10 -------- d-----w- c:\programdata\MicroWorld
2010-07-01 09:05 . 2010-07-01 09:05 -------- d-----w- C:\IswAppData
2010-06-30 13:19 . 2010-06-30 13:27 -------- d-----w- c:\programdata\Yahoo!
2010-06-30 13:18 . 2010-07-01 07:13 -------- d-----w- c:\program files\Yahoo!
2010-06-29 19:36 . 2010-06-29 19:36 -------- d-----w- c:\windows\system32\Adobe
2010-06-29 13:42 . 2010-06-29 13:42 -------- d-----w- c:\windows\PixArt
2010-06-29 13:38 . 2010-06-29 13:38 -------- d-----w- c:\windows\Webcam1200
2010-06-29 13:38 . 2007-06-29 14:32 611584 ----a-w- c:\windows\system32\drivers\PFC027.SYS
2010-06-29 13:38 . 2006-11-20 07:04 6656 ----a-w- c:\windows\system32\CoInst_070629.dll
2010-06-29 13:38 . 2010-06-29 13:38 -------- d-----w- c:\program files\Webcam 1200
2010-06-29 13:12 . 2007-04-26 13:57 16904 ----a-w- c:\windows\system32\authuitu.dll
2010-06-29 13:12 . 2007-05-16 07:41 29704 ----a-w- c:\windows\system32\uxtuneup.dll
2010-06-29 13:12 . 2010-06-29 13:12 -------- d-----w- c:\programdata\TuneUp Software
2010-06-29 13:11 . 2010-07-01 09:34 -------- d-----w- c:\program files\TuneUp Utilities 2007
2010-06-29 13:10 . 2010-06-29 13:10 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-29 12:55 . 2010-06-29 12:55 -------- d-----w- c:\program files\CD to MP3 Freeware
2010-06-29 12:55 . 2001-03-23 14:29 880912 ----a-w- c:\windows\WM8EUTIL.exe
2010-06-29 12:50 . 2010-07-03 11:31 -------- d-----w- c:\program files\URLSnooper2
2010-06-29 12:43 . 2010-06-29 12:43 -------- d-----w- c:\program files\Common Files\Java
2010-06-29 12:43 . 2010-06-29 12:42 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-29 12:42 . 2010-06-29 12:42 -------- d-----w- c:\program files\Java
2010-06-29 08:53 . 2010-06-29 08:53 -------- d-----w- c:\users\Maminka\AppData\Local\Mozilla
2010-06-29 08:39 . 2010-07-06 14:24 -------- d-----w- c:\users\Maminka\AppData\Roaming\skypePM
2010-06-29 07:20 . 2010-06-29 19:38 -------- d-----w- c:\windows\system32\Macromed
2010-06-29 04:28 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-06-29 04:23 . 2010-06-29 04:23 -------- d-----w- c:\windows\system32\Wat
2010-06-29 04:22 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-29 04:22 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-29 04:22 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-29 04:22 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-29 04:22 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-29 04:20 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-06-28 19:40 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-06-28 19:39 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-06-28 18:38 . 2010-06-28 18:49 -------- d-----w- c:\program files\Foxit Software
2010-06-28 18:15 . 2010-07-06 18:02 -------- d-----w- c:\users\Maminka\AppData\Roaming\Skype
2010-06-28 18:14 . 2010-07-01 11:01 -------- d-----w- c:\programdata\Skype
2010-06-28 18:06 . 2009-08-05 20:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-06-28 17:57 . 2010-07-06 14:23 -------- d-----w- c:\users\Maminka\Tracing
2010-06-28 17:41 . 2010-07-02 14:43 114216 ----a-w- c:\users\Maminka\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-28 17:37 . 2010-07-06 13:42 -------- d-----w- c:\users\Public\Portable Programes
2010-06-28 17:07 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-28 17:07 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 17:07 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-28 17:07 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-28 17:07 . 2010-06-28 20:32 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-06-28 17:06 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 17:06 . 2010-06-28 17:06 -------- d-----w- c:\programdata\Alwil Software
2010-06-28 17:06 . 2010-06-28 17:06 -------- d-----w- c:\program files\Alwil Software
2010-06-28 16:46 . 2010-06-28 16:46 -------- d-----w- c:\program files\Zone Labs
2010-06-28 16:43 . 2010-07-06 18:14 -------- d-----w- c:\windows\Internet Logs
2010-06-28 16:43 . 2010-06-28 16:43 -------- d-----w- c:\programdata\CheckPoint
2010-06-28 15:46 . 2010-07-01 09:17 -------- d-----w- c:\users\Karliček
2010-06-25 17:07 . 2010-06-25 17:07 96784 ----a-w- c:\windows\system32\Packet.dll
2010-06-25 17:07 . 2010-06-25 17:07 281104 ----a-w- c:\windows\system32\wpcap.dll
2010-06-25 17:07 . 2010-06-25 17:07 35088 ----a-w- c:\windows\system32\drivers\npf.sys
2010-06-25 17:03 . 2010-06-25 17:03 53299 ----a-w- c:\windows\system32\pthreadVC.dll
2010-06-10 13:37 . 2010-06-10 13:37 3074560 ----a-w- c:\program files\openofficeorg32.msi
2010-06-10 12:22 . 2010-06-10 12:22 -------- d-----w- c:\program files\Common Files\Ahead
2010-06-10 12:22 . 2010-06-10 12:22 -------- d-----w- c:\programdata\Nero
2010-06-10 12:22 . 2010-06-10 12:22 -------- d-----w- c:\program files\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-06 18:14 . 2009-07-14 08:44 622422 ----a-w- c:\windows\system32\perfh005.dat
2010-07-06 18:14 . 2009-07-14 08:44 118604 ----a-w- c:\windows\system32\perfc005.dat
2010-07-06 18:09 . 2010-07-06 18:10 1921536 ----a-w- c:\windows\Internet Logs\xDB4AF4.tmp
2010-07-06 18:09 . 2010-07-06 18:10 1290240 ----a-w- c:\windows\Internet Logs\xDB46EC.tmp
2010-07-06 10:53 . 2010-07-06 10:54 1913856 ----a-w- c:\windows\Internet Logs\xDB48E1.tmp
2010-07-06 10:53 . 2010-07-06 10:54 594432 ----a-w- c:\windows\Internet Logs\xDB4824.tmp
2010-07-06 10:23 . 2010-07-06 10:26 1591808 ----a-w- c:\windows\Internet Logs\xDB4D26.tmp
2010-07-05 18:48 . 2010-07-05 18:49 2885120 ----a-w- c:\windows\Internet Logs\xDB512E.tmp
2010-07-05 18:48 . 2010-07-05 18:49 1908224 ----a-w- c:\windows\Internet Logs\xDB538F.tmp
2010-07-03 20:08 . 2010-07-04 07:10 1897472 ----a-w- c:\windows\Internet Logs\xDB54D7.tmp
2010-07-03 20:08 . 2010-07-04 07:10 2432000 ----a-w- c:\windows\Internet Logs\xDB512D.tmp
2010-07-02 20:04 . 2010-07-03 07:10 1872384 ----a-w- c:\windows\Internet Logs\xDB84E0.tmp
2010-07-02 20:04 . 2010-07-03 07:10 1068032 ----a-w- c:\windows\Internet Logs\xDB83B6.tmp
2010-07-01 23:40 . 2010-07-02 05:42 194048 ----a-w- c:\windows\Internet Logs\xDB52E2.tmp
2010-07-01 23:40 . 2010-07-02 05:42 1864192 ----a-w- c:\windows\Internet Logs\xDB539F.tmp
2010-07-01 10:48 . 2010-07-01 10:48 -------- d-----w- c:\users\Jun Fan 1\AppData\Roaming\CheckPoint
2010-07-01 09:40 . 2010-07-01 09:42 203264 ----a-w- c:\windows\Internet Logs\xDB5D23.tmp
2010-07-01 09:40 . 2010-07-01 09:42 1835520 ----a-w- c:\windows\Internet Logs\xDB5E7C.tmp
2010-07-01 09:17 . 2009-10-14 06:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-30 18:24 . 2009-10-14 07:14 -------- d-----w- c:\program files\Microsoft
2010-06-29 20:51 . 2010-06-30 06:03 2946560 ----a-w- c:\windows\Internet Logs\xDB5CF4.tmp
2010-06-29 20:51 . 2010-06-30 06:03 1779200 ----a-w- c:\windows\Internet Logs\xDB5E1E.tmp
2010-06-29 13:38 . 2009-11-19 08:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-29 08:39 . 2010-06-29 08:39 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-06-29 04:23 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-06-29 04:22 . 2009-10-14 06:59 -------- d-----w- c:\programdata\Microsoft Help
2010-06-28 19:34 . 2010-06-28 19:34 1710080 ----a-w- c:\windows\Internet Logs\xDB51AB.tmp
2010-06-28 19:34 . 2010-06-28 19:34 2722304 ----a-w- c:\windows\Internet Logs\xDB4F29.tmp
2010-06-28 18:06 . 2009-10-14 07:14 -------- d-----w- c:\program files\Windows Live
2010-06-28 17:19 . 2010-06-28 17:19 -------- d-----w- c:\users\Maminka\AppData\Roaming\CheckPoint
2010-06-28 16:48 . 2010-06-28 16:47 421442 ---ha-w- c:\windows\system32\drivers\vsconfig.xml
2010-05-09 09:14 . 2010-06-28 19:43 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-05-09 09:14 . 2010-06-28 19:43 417792 ----a-w- c:\windows\system32\msdri.dll
2010-05-01 14:49 . 2010-06-28 19:43 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-04-23 07:13 . 2010-06-28 19:43 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-09 07:24 . 2010-06-28 16:47 1285000 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-09 07:24 . 2010-06-28 16:47 240008 ----a-w- c:\windows\system32\drivers\netio.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2010-05-09 09:50 2517088 ----a-w- c:\program files\ZoneAlarm\tbZone.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2009-07-14 1173504]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-07-01 3037696]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="c:\windows\System32\mctadmin.exe" [2009-07-14 93696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-22 7739936]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-16 150552]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-03-30 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-07-01 2176512]

c:\users\Karliźek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]

c:\users\Jun Fan 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 14:45 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-29 1343400]
S1 aswSP;aswSP; [x]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2010-07-01 142592]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2010-05-26 26352]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2010-05-26 493032]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S3 PAC207;Webcam 1200;c:\windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-07-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 17:35]
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\users\Jun Fan 1\AppData\Roaming\Mozilla\Firefox\Profiles\76r6xln9.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\Wat\npWatWeb.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)


.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,29,50,bf,87,ab,0b,03,4b,96,41,74,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,29,50,bf,87,ab,0b,03,4b,96,41,74,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(3904)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(568)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Celkový čas: 2010-07-06 20:25:11
ComboFix-quarantined-files.txt 2010-07-06 18:25

Před spuštěním: Volných bajtů: 469 616 254 976
Po spuštění: Volných bajtů: 469 671 882 752

- - End Of File - - BAD07A6901C5463E5F1FD39C24B5CFEC

[motji]

Ještě prosím otestujte na www.virustotal.com
c:\windows\system32\drivers\tcpip.sys

[SGC]

Tak virustotal nenašel v tom souboru nic:
http://bit.ly/bdVHCH

[motji]

Jak to vypadá s počítačem?

[SGC]

Zatím jediná vada na kráse je, že nejde spustit RSIT, jinak vše je jak má být.

[motji]

Pro jistotu

Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky

[SGC]

Zde je tu ten log:

Autoscan: completed 2 minutes ago (events: 2, objects: 370276, time: 01:06:26)
9.7.2010 10:50:26 Task started
9.7.2010 11:56:52 Task completed

[motji]

AVPtool odinstalujte.
Pokud nejsou problémy, je to vše