Nefunkční některé programy

[relux]

Dobrý den, potřeboval bych pomoci s následujícími problémy, ačkoliv nevím, jestli jsou virového původu.
Nainstaloval jsem Microsoft Office 2003 (legální).Instalace proběhla normálně.Po otevření Wordu a kliknutí na
dříve vytvořený soubor se restartuje počítač.Zkoušel jsem reinstal, ale nepomohlo.Zajímavé je, že po kliknutí
na soubor, který je součástí přílohy e-mailu (doc,pps) se tyto soubory normálně načtou a zobrazí bez
restartu.Dále mi nechce pracovat program Pentax digital camera utility.Po kliknutí na ikonu tohoto programu
se chce načíst, ale v zápětí se vytratí.Zkoušel jsem odinstalovat přes Revounistaller, dočistit registry a znovu
nainstalovat.Jednou se mě ho podařilo spustit a tím to skončilo.V současné době mám Office odinstalovaný,ale
problémy ostatní přetrvávají.Myslím si, že všechno začalo po instalaci Office.Provedl jsem skeny MBAM,CUREIT, chtěl jse AVPTOOL, ale odkaz je nefunkční.Také obnova systému nepomohla.Provedl jsem skeny rsit, combofix (omlouvám se), které přikládám.Během skenu combofixu mi to hlásilo, že soubor
c: boot.ini je špatně formátovaný.Tento soubor je prázdný, ačkoliv má 211 bajtů.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Relux at 2010-08-01 11:11:03
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 49 GB (64%) free of 76 GB
Total RAM: 2031 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:11:09, on 1.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\windows\RTHDCPL.EXE
C:\windows\system32\ctfmon.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\windows\system32\PSIService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\windows\system32\wscntfy.exe
C:\windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Relux\Plocha\RSIT.exe
C:\Program Files\trend micro\Relux.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://atlas.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F459F154-5FAA-4ABD-A6D7-0FD0136DF40B}: NameServer = 192.168.1.1
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) Active Management Technology LMS Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe

--
End of file - 5881 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-23 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-07-23 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-04-07 2145000]
"RTHDCPL"=C:\windows\RTHDCPL.EXE [2008-06-13 16871936]
"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2008-04-14 536576]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\windows\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
C:\Program Files\FileHippo.com\UpdateChecker.exe [2010-04-29 248832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Relux\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-05-29 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe [2008-12-12 172032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\System32\igfxtray.exe [2008-12-12 143360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2005-02-16 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-02-16 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KEMailKb]
C:\PROGRA~1\KEMailKb\KEMailKb.EXE [2002-12-31 253952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\windows\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\System32\igfxpers.exe [2008-12-12 143360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2008-04-14 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2010-07-22 2403568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^FotoStation Easy AutoLaunch.lnk]
C:\PROGRA~1\FOTOST~1\FOTOST~1 [2010-07-30 244576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
C:\PROGRA~1\PANASO~1\LUMIXS~1\PHLEAU~1.EXE [2005-11-14 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^NkvMon.exe.lnk]
C:\PROGRA~1\Nikon\NkView5\NkvMon.exe [2002-05-23 233472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-09-04 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\windows\system32\Ati2evxx.dll [2009-03-04 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2008-12-12 217088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-08-01 11:11:03 ----D---- C:\rsit
2010-08-01 11:11:03 ----D---- C:\Program Files\trend micro
2010-08-01 10:45:31 ----A---- C:\ComboFix.txt
2010-08-01 10:36:52 ----A---- C:\windows\zip.exe
2010-08-01 10:36:52 ----A---- C:\windows\SWXCACLS.exe
2010-08-01 10:36:52 ----A---- C:\windows\SWSC.exe
2010-08-01 10:36:52 ----A---- C:\windows\SWREG.exe
2010-08-01 10:36:52 ----A---- C:\windows\sed.exe
2010-08-01 10:36:52 ----A---- C:\windows\PEV.exe
2010-08-01 10:36:52 ----A---- C:\windows\NIRCMD.exe
2010-08-01 10:36:52 ----A---- C:\windows\MBR.exe
2010-08-01 10:36:52 ----A---- C:\windows\grep.exe
2010-08-01 10:36:46 ----D---- C:\windows\ERDNT
2010-08-01 10:35:48 ----D---- C:\Qoobox
2010-08-01 10:11:07 ----D---- C:\Program Files\PENTAX
2010-07-31 20:54:52 ----D---- C:\Config.Msi
2010-07-29 11:32:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-07-25 17:52:19 ----HDC---- C:\windows\$NtUninstallKB952011$
2010-07-25 17:51:34 ----D---- C:\Program Files\Google
2010-07-23 04:01:33 ----D---- C:\Program Files\Common Files\Java
2010-07-23 04:01:16 ----A---- C:\windows\system32\javaws.exe
2010-07-23 04:01:16 ----A---- C:\windows\system32\javaw.exe
2010-07-23 04:01:16 ----A---- C:\windows\system32\java.exe
2010-07-23 04:00:58 ----D---- C:\Program Files\Java
2010-07-20 04:36:12 ----A---- C:\objektivy.txt
2010-07-17 16:07:26 ----ASH---- C:\windows\system32\KGyGaAvL.sys
2010-07-14 07:13:31 ----HDC---- C:\windows\$NtUninstallKB2229593$
2010-07-13 09:57:03 ----D---- C:\windows\Downloaded Installations
2010-07-13 08:25:18 ----D---- C:\FotkyPentax
2010-07-08 08:21:20 ----D---- C:\Documents and Settings\Relux\Data aplikací\AnvSoft
2010-07-08 08:20:57 ----D---- C:\Program Files\AnvSoft

======List of files/folders modified in the last 1 months======

2010-08-01 11:11:03 ----RD---- C:\Program Files
2010-08-01 10:45:41 ----D---- C:\windows\Temp
2010-08-01 10:44:51 ----SD---- C:\windows\Tasks
2010-08-01 10:43:38 ----D---- C:\WINDOWS
2010-08-01 10:43:38 ----A---- C:\windows\system.ini
2010-08-01 10:43:27 ----D---- C:\windows\system32\drivers\etc
2010-08-01 10:41:57 ----D---- C:\windows\system32
2010-08-01 10:40:38 ----D---- C:\windows\system32\drivers
2010-08-01 10:40:38 ----D---- C:\windows\AppPatch
2010-08-01 10:40:36 ----D---- C:\Program Files\Common Files
2010-08-01 10:38:28 ----D---- C:\windows\system32\CatRoot2
2010-08-01 10:37:02 ----A---- C:\windows\SchedLgU.Txt
2010-08-01 10:36:46 ----D---- C:\windows\Prefetch
2010-08-01 10:35:02 ----D---- C:\Documents and Settings\Relux\Data aplikací\Skype
2010-08-01 10:11:22 ----SHD---- C:\windows\Installer
2010-08-01 10:09:16 ----SHD---- C:\System Volume Information
2010-08-01 10:09:16 ----D---- C:\windows\system32\Restore
2010-08-01 10:07:51 ----A---- C:\windows\system32\log.txt
2010-08-01 10:07:43 ----D---- C:\Documents and Settings\Relux\Data aplikací\skypePM
2010-08-01 08:27:43 ----RSD---- C:\windows\assembly
2010-08-01 08:27:41 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-08-01 08:27:39 ----D---- C:\Program Files\Common Files\System
2010-08-01 08:27:38 ----RSD---- C:\windows\Fonts
2010-08-01 08:27:24 ----D---- C:\Program Files\Common Files\Designer
2010-07-31 21:12:34 ----D---- C:\windows\system32\config
2010-07-31 21:12:17 ----D---- C:\windows\system32\wbem
2010-07-31 21:12:16 ----D---- C:\windows\Registration
2010-07-31 21:10:15 ----D---- C:\Program Files\FotoStation Easy
2010-07-31 21:08:03 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-07-31 21:06:48 ----HD---- C:\windows\inf
2010-07-31 19:54:28 ----D---- C:\Documents and Settings\Relux\Data aplikací\Corel
2010-07-31 19:10:17 ----D---- C:\Program Files\MSBuild
2010-07-31 19:05:42 ----A---- C:\windows\win.ini
2010-07-30 23:23:47 ----D---- C:\windows\Minidump
2010-07-29 11:44:32 ----SD---- C:\Documents and Settings\Relux\Data aplikací\Microsoft
2010-07-29 11:37:01 ----D---- C:\windows\WinSxS
2010-07-29 08:17:39 ----D---- C:\TETA
2010-07-26 07:05:08 ----D---- C:\KOPR
2010-07-26 07:02:49 ----D---- C:\Stahování Kopr
2010-07-25 20:39:54 ----A---- C:\windows\NeroDigital.ini
2010-07-25 17:52:26 ----RSHDC---- C:\windows\system32\dllcache
2010-07-23 04:01:01 ----A---- C:\windows\system32\deployJava1.dll
2010-07-22 07:15:46 ----D---- C:\Program Files\SUPERAntiSpyware
2010-07-20 04:56:19 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-07-20 04:48:57 ----A---- C:\windows\ODBC.INI
2010-07-20 04:44:49 ----D---- C:\windows\system
2010-07-18 07:19:42 ----D---- C:\Program Files\SpeedFan
2010-07-17 16:06:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Corel
2010-07-17 16:06:42 ----D---- C:\Program Files\Common Files\Corel
2010-07-17 16:05:46 ----D---- C:\Program Files\Corel
2010-07-14 22:34:40 ----D---- C:\windows\Debug
2010-07-14 07:13:08 ----HD---- C:\windows\$hf_mig$
2010-07-14 07:13:08 ----D---- C:\windows\system32\CatRoot
2010-07-11 09:15:52 ----D---- C:\PRACOVNÍ
2010-07-08 07:02:20 ----D---- C:\Fotkypan
2010-07-07 07:54:26 ----D---- C:\EPS
2010-07-05 15:42:58 ----D---- C:\Hudba
2010-07-02 21:39:05 ----A---- C:\windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 giveio;giveio; C:\windows\system32\giveio.sys [1996-04-03 5248]
R0 speedfan;speedfan; C:\windows\system32\speedfan.sys [2006-09-24 5248]
R1 ehdrv;ehdrv; C:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R1 epfwtdi;epfwtdi; C:\windows\system32\DRIVERS\epfwtdi.sys [2010-04-07 55232]
R1 intelppm;Řadič procesoru Intel; C:\windows\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\windows\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\windows\System32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
R2 eamon;eamon; C:\windows\system32\DRIVERS\eamon.sys [2010-04-07 139192]
R2 epfw;epfw; C:\windows\system32\DRIVERS\epfw.sys [2010-04-07 134488]
R2 Hardlock;Hardlock; \??\C:\windows\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; C:\windows\system32\drivers\Haspnt.sys [2010-06-21 33280]
R3 ati2mtag;ati2mtag; C:\windows\System32\DRIVERS\ati2mtag.sys [2009-03-04 3565568]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\windows\system32\drivers\AtiHdmi.sys [2010-01-28 95232]
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver; C:\windows\System32\Drivers\DKbFltr.sys [2002-11-08 17071]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\windows\System32\DRIVERS\e1e5132.sys [2009-09-04 239120]
R3 Epfwndis;Eset Personal Firewall; C:\windows\system32\DRIVERS\Epfwndis.sys [2010-04-07 32584]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\windows\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HECI;Intel(R) Management Engine Interface; C:\windows\System32\DRIVERS\HECI.sys [2006-12-06 44416]
R3 HidUsb;Ovladač třídy standardu HID; C:\windows\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RtkHDAud.sys [2008-06-17 4756992]
R3 mouhid;Ovladač myši standardu HID; C:\windows\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\windows\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\Relux\LOCALS~1\Temp\catchme.sys []
S3 ialm;ialm; C:\windows\System32\DRIVERS\igxpmp32.sys [2008-12-12 6048768]
S3 mbr;mbr; \??\C:\DOCUME~1\Relux\LOCALS~1\Temp\mbr.sys []
S3 mf;mf; C:\windows\system32\DRIVERS\mf.sys [2008-04-13 63744]
S3 NmPar;PCI Parallel Port; C:\windows\system32\DRIVERS\NmPar.sys [2008-12-24 80256]
S3 nmserial;PCI Serial Port; C:\windows\system32\DRIVERS\nmserial.sys [2008-12-16 70016]
S3 StarOpen;StarOpen; C:\windows\system32\drivers\StarOpen.sys []
S3 usbprint;Třída USB Printer; C:\windows\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\windows\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\windows\System32\Ati2evxx.exe [2009-03-04 602112]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-04-07 810120]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-07-23 153376]
R2 LMS;Intel(R) Active Management Technology LMS Service; C:\Program Files\Intel\AMT\LMS.exe [2006-07-25 98304]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 ProtexisLicensing;ProtexisLicensing; C:\windows\system32\PSIService.exe [2006-11-02 174656]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-04-07 33560]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-12-22 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\windows\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


ComboFix 10-07-31.04 - Relux 01.08.2010 10:38:37.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2031.1529 [GMT 2:00]
Spuštěný z: c:\documents and settings\Relux\Plocha\ComboFix.exe
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Relux\LOCALS~1\Temp\install_flash_player.exe
c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-01 do 2010-08-01 )))))))))))))))))))))))))))))))
.

2010-08-01 08:11 . 2010-08-01 08:11 -------- d-----w- c:\program files\PENTAX
2010-07-31 19:12 . 2010-07-31 19:12 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-25 15:51 . 2010-07-31 17:43 -------- d-----w- c:\program files\Google
2010-07-23 02:01 . 2010-07-23 02:01 -------- d-----w- c:\program files\Common Files\Java
2010-07-23 02:00 . 2010-07-23 02:00 -------- d-----w- c:\program files\Java
2010-07-17 14:07 . 2010-08-01 06:22 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-07-14 05:09 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-13 07:57 . 2010-07-13 07:57 -------- d-----w- c:\windows\Downloaded Installations
2010-07-13 06:25 . 2010-07-31 16:48 -------- d-----w- C:\FotkyPentax
2010-07-08 06:20 . 2010-07-08 06:20 -------- d-----w- c:\program files\AnvSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-31 19:10 . 2010-05-29 08:08 -------- d-----w- c:\program files\FotoStation Easy
2010-07-31 17:10 . 2010-05-29 18:18 -------- d-----w- c:\program files\MSBuild
2010-07-23 02:01 . 2010-06-30 06:04 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-22 05:15 . 2010-05-29 21:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-20 02:56 . 2003-04-16 12:00 79242 ----a-w- c:\windows\system32\perfc005.dat
2010-07-20 02:56 . 2003-04-16 12:00 432278 ----a-w- c:\windows\system32\perfh005.dat
2010-07-18 05:19 . 2010-05-30 12:30 -------- d-----w- c:\program files\SpeedFan
2010-07-17 14:06 . 2010-05-28 17:42 -------- d-----w- c:\program files\Common Files\Corel
2010-07-17 14:05 . 2010-05-28 17:42 -------- d-----w- c:\program files\Corel
2010-06-27 05:19 . 2010-05-29 00:39 -------- d-----w- c:\program files\CCleaner
2010-06-25 05:55 . 2010-05-29 00:04 -------- d-----w- c:\program files\Windows Media Connect 2
2010-06-21 16:23 . 2010-06-21 16:23 5120 ----a-w- c:\windows\system32\haspvdd.dll
2010-06-21 16:23 . 2010-06-21 16:23 324 ----a-w- c:\windows\system32\haspdos.sys
2010-06-21 16:23 . 2010-06-21 16:23 33280 ----a-w- c:\windows\system32\drivers\Haspnt.sys
2010-06-19 10:56 . 2010-06-19 10:56 -------- d-----w- c:\program files\CDBurnerXP
2010-06-14 14:31 . 2010-05-26 12:41 744448 ----a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2010-06-13 07:48 . 2010-06-13 07:48 -------- d-----w- c:\program files\HD Tune
2010-06-08 08:20 . 2010-06-08 08:20 -------- d-----w- c:\program files\KEMailKb
2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr
2010-05-29 08:06 . 2010-05-29 08:06 28672 ----a-w- c:\windows\system32\qttask.exe
2010-05-28 23:56 . 2010-05-28 23:56 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-05-28 20:16 . 2010-05-26 12:43 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-05-28 20:16 . 2010-05-26 12:43 2982 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-05-28 18:12 . 2010-05-28 18:12 6016 ----a-w- c:\windows\fnerr.dat
2010-05-28 16:05 . 2010-05-26 12:43 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-05-28 12:40 . 2010-05-28 12:40 0 ----a-w- c:\windows\ativpsrm.bin
2010-05-26 12:55 . 2010-05-26 12:55 315392 ----a-w- c:\windows\HideWin.exe
2010-05-26 12:41 . 2010-05-26 12:41 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-05-06 10:35 . 2006-06-23 11:27 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-18 06:18 . 2010-02-18 06:18 125831629 ----a-w- c:\program files\openofficeorg1.cab
2010-02-18 06:13 . 2010-02-18 06:13 290 ----a-w- c:\program files\setup.ini
2010-02-18 06:13 . 2010-02-18 06:13 10156544 ----a-w- c:\program files\openofficeorg32.msi
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-04-07 2145000]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-13 16871936]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-04-14 536576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^FotoStation Easy AutoLaunch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\FotoStation Easy AutoLaunch.lnk
backup=c:\windows\pss\FotoStation Easy AutoLaunch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^NkvMon.exe.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\NkvMon.exe.lnk
backup=c:\windows\pss\NkvMon.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:22 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-04-29 12:57 248832 ----a-w- c:\program files\FileHippo.com\UpdateChecker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-05-29 06:58 136176 ----atw- c:\documents and settings\Relux\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-12-12 08:06 172032 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-12-12 08:05 143360 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 14:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 14:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KEMailKb]
2002-12-31 11:54 253952 ----a-w- c:\progra~1\KEMailKb\KEMailKb.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 03:22 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-12-12 08:05 143360 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2008-04-14 05:19 536576 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-22 05:15 2403568 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [7.4.2010 21:07 114984]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 20:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10.5.2010 20:41 67656]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [7.4.2010 21:07 810120]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys [24.12.2008 5:40 80256]
S3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [16.12.2008 6:10 70016]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://atlas.centrum.cz/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {F459F154-5FAA-4ABD-A6D7-0FD0136DF40B} = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-_{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91} - c:\program files\Corel\CorelDRAW Graphics Suite 13\Programs\MSILauncher {7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-01 10:43
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1000)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-08-01 10:45:29
ComboFix-quarantined-files.txt 2010-08-01 08:45

Před spuštěním: Volných bajtů: 49 816 141 824
Po spuštění: Volných bajtů: 51 300 048 896

- - End Of File - - 58EA233760177B38B7705177C2277C6B

[Rudy]

Dávat log z RSIT po skenu Combofix je naprostý nesmysl, neboť v případě zavirování CF zničí všechny stopy a my se nemáme čeho chytit. Dejte log z ComboFix, měl by být umístěn v C:\combofix.txt .

[relux]

log Combofix je v předchozím příspěvku

[Rudy]

Pokud se po použití CF (smazány 2 položky, zbytek čistý), zkuste obnovu systému k datu, kdy korektně fungoval.

[relux]

Obnovu systému jsem zkoušel již před žádostí o pomoc na tomto fóru, bohužel bez úspěchu.Měl jsem možnost jít zpět zhruba 10 dnů, nepomohlo.Zkoušel jsm postupně všechny možné body obnovy, neúspěšně.Nakonec jsem už v zoufalství vypnul a zapnul (restart) nástroj obnovení systému, což bylo dnes ráno.Bez výsledku.

[Rudy]

Buď je poškozen systém, nebo instalace oněch aplikací. Na zkoušku některou přeinstalujte.

[relux]

Všechno jsem zkoušel, jak píšu na úvod prvního příspěvku.Programy jsem korektně odinstaloval, vyčistil registry (revounistaller, Ccleaner, ručně, vlastní odinstalátory).Potíž je trošku v tom, že jsem tento PC koupil asi před dvěma měsíci jako starší.Je to tento typ: http://h20000.www2.hp.com/bizsupport/Te ... nvOID=1098
Disk byl zformátovaný a systém předinstalovaný.Do dnešního dne s ním nebyl problém (pominu to, že mi na něm nefunguje jeden starší program - epscut, ale to je hardwerový problém, řešeno s HP).Proto jsem z toho na makovici a nerozumím tomu.Nabořený systém by mě trošku překvapil, protože si ho hýčkám, přestože je to
pěkná potvora.Ale čert nikdy nespí.....

[Rudy]

Na viry je systém čistý. Zbývá už jen chyba systému, nebo samotných aplikací (nekompatibilita), příp. hw, díky němuž se se mohla poškodit uložená data.

[relux]

Také si myslím, že po virové stránce bude PC čisté.Program pro Pentax mám originál na CD dodaný s novým
foťákem(K-x).14 dnů fungoval bez problému, právě až po instalaci Office se všechno zvrtlo.Po první instalaci Office a jejich spuštění v PC nějak divně zahrkalo a nastal restart bez fáze ukládání a vypínání.No nic, zkusím
XP managera a pak se uvidí.HP už asi nikdy.Každopádně děkuji za úsilí, které jste věnoval mým problémům.
Mnoho úspěchů při nikdy nekončícím boji s havětí.

[Rudy]

XPM by mohl pomoci. Pokud ne, pak oprava z instal. CD. Děkuji za přání a vy nemáte zač!