Prosím o pomoc

[Marek19]

Mam problém s chatem na facebooku, když s někym píšu tak se mu ode mě posílá odkaz s virem aniž bych o tom já věděl. Děkuji za pomoc

Tady je výpis z RSIT:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Mára at 2010-11-22 13:30:22
Microsoft Windows 7 Ultimate
System drive C: has 146 GB (48%) free of 305 GB
Total RAM: 2814 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:31:21, on 22.11.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\ControlDeck\ControlDeck.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\SmartLogon\facemgr.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Windows\System32\ACEngSvr.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Users\Mára\AppData\Roaming\QipGuard\QipGuard.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Users\Public\nvsvc32.exe
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Windows\AsScrPro.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Elantech\ETDCtrlHelper.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\MRA~1\AppData\Local\Temp\0893934.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\SourceTec\Sothink FLV Player\FLVPlayer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Mára\Desktop\RSIT.exe
C:\Program Files\trend micro\Mára.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (file missing)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QipLI - {6B5863A0-C43F-4C0A-982B-CC0E9125783F} - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qstatsrv.dll (file missing)
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ETDWare] %ProgramFiles%\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" update "Software\CyberLink\PowerProducer\4.0"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [NVIDIA driver monitor] C:\Users\Public\nvsvc32.exe
O4 - HKCU\..\Run: [QIP Internet Guardian] C:\Users\Mára\AppData\Roaming\QipGuard\QipGuard.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [tihud] C:\Users\Mára\AppData\Roaming\Microsoft\pujoo.exe
O4 - HKCU\..\Run: [MSConfig] C:\Users\Mára\svpivg.exe \u
O4 - HKCU\..\Run: [zigy] C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: 5v6f5a2.exe
O4 - Startup: 5v6vqkk.exe
O4 - Startup: 6oytytj.exe
O4 - Startup: a0vq0k0f.exe
O4 - Startup: av1qqffv98q.exe
O4 - Startup: f6qqf5af7.exe
O4 - Startup: faakv1kkakk.exe
O4 - Startup: faqq1v5a.exe
O4 - Startup: ffaakv6v.exe
O4 - Startup: kkaavk4fv.exe
O4 - Startup: ojy6tjotto5.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: qk4fvvqf.exe
O4 - Startup: qk4fvvqffa.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: ttytjotto.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: FancyStart daemon.lnk = ?
O4 - Global Startup: SRS Premium Sound.lnk = ?
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: AFBAgent - ASUSTeK Computer Inc. - C:\Windows\system32\FBAgent.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 10957 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2010-09-29 197984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B5863A0-C43F-4C0A-982B-CC0E9125783F}]
QipLI Class - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qstatsrv.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27 1250696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-30 102400]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-01-13 509320]
"ATKOSD2"=C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-02-04 7350912]
"ATKMEDIA"=C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [2010-01-05 170624]
"HControlUser"=C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]
"amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"UpdateLBPShortCut"=C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [2008-02-21 222504]
"UpdateP2GoShortCut"=C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-09-24 210216]
"UpdatePPShortCut"=C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [2008-01-04 222504]
"UpdatePSTShortCut"=C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [2008-10-22 210216]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2007-12-21 1443072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"NVIDIA driver monitor"=C:\Users\Public\nvsvc32.exe [2010-10-12 56320]
"QIP Internet Guardian"=C:\Users\Mára\AppData\Roaming\QipGuard\QipGuard.exe [2010-04-12 181760]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2010-09-29 3245408]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-10-11 14940040]
"tihud"=C:\Users\Mára\AppData\Roaming\Microsoft\pujoo.exe []
"MSConfig"=C:\Users\Mára\svpivg.exe [2010-11-21 18432]
"zigy"=C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe [2010-11-21 201216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-12-03 35184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADSMTray]
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe [2009-06-24 272952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
C:\Windows\AsScrPro.exe [2010-10-09 3054136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [2008-07-18 104936]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2008-02-22 62760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2008-04-02 87336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-11-02 9808488]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
FancyStart daemon.lnk - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe
SRS Premium Sound.lnk - C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut4_E9C83B3EDF9141A39DA5EC05C79BBB91.exe

C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
5v6f5a2.exe
5v6vqkk.exe
6oytytj.exe
a0vq0k0f.exe
av1qqffv98q.exe
f6qqf5af7.exe
faakv1kkakk.exe
faqq1v5a.exe
ffaakv6v.exe
kkaavk4fv.exe
ojy6tjotto5.exe
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
qk4fvvqf.exe
qk4fvvqffa.exe
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
ttytjotto.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ASUS\ASUS Data Security Manager\ASPWDFLT

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-22 13:25:52 ----D---- C:\Program Files\trend micro
2010-11-22 13:25:51 ----D---- C:\rsit
2010-11-21 13:47:34 ----RA---- C:\Users\Mára\AppData\Roaming\BG0Ai.txt
2010-11-20 23:54:15 ----RSHD---- C:\RECYCLER
2010-11-20 23:53:08 ----RSH---- C:\Users\Mára\AppData\Roaming\juzjf.exe
2010-11-19 09:24:34 ----D---- C:\Users\Mára\AppData\Roaming\OpenOffice.org2
2010-11-19 09:23:35 ----D---- C:\Program Files\OpenOffice.org 2.3
2010-11-18 17:32:52 ----D---- C:\Users\Mára\AppData\Roaming\skypePM
2010-11-18 17:29:14 ----D---- C:\Program Files\Common Files\Skype
2010-11-18 17:29:13 ----RD---- C:\Program Files\Skype
2010-11-18 17:29:12 ----D---- C:\Users\Mára\AppData\Roaming\Skype
2010-11-18 17:29:09 ----D---- C:\ProgramData\Skype
2010-11-18 07:50:51 ----D---- C:\Program Files\Metinn2
2010-11-17 22:23:23 ----D---- C:\Program Files\Metin2
2010-11-14 19:35:12 ----D---- C:\Users\Mára\AppData\Roaming\Hamachi
2010-11-14 19:03:18 ----D---- C:\Program Files\Vietcong
2010-11-09 14:31:35 ----D---- C:\Program Files\Common Files\SourceTec
2010-11-08 17:25:14 ----D---- C:\Windows\system32\RTCOM
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RtkPgExt.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RtkCoInst.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RtkApoApi.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RTEEP32A.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RTEEL32A.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RTEEG32A.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RTEED32A.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RP3DHT32.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\RP3DAA32.dll
2010-11-08 17:24:50 ----A---- C:\Windows\system32\drivers\RTKVHDA.sys
2010-11-08 17:24:46 ----A---- C:\Windows\system32\FMAPO.dll
2010-11-08 17:24:46 ----A---- C:\Windows\system32\AERTARen.dll
2010-11-08 17:24:46 ----A---- C:\Windows\system32\AERTACap.dll
2010-11-08 17:24:44 ----A---- C:\Windows\RtlExUpd.dll
2010-11-08 17:16:55 ----A---- C:\Windows\system32\rmoc3260.dll
2010-11-08 17:16:55 ----A---- C:\Windows\system32\pndx5032.dll
2010-11-08 17:16:55 ----A---- C:\Windows\system32\pndx5016.dll
2010-11-08 17:16:55 ----A---- C:\Windows\system32\pncrt.dll
2010-11-08 17:16:46 ----A---- C:\Windows\system32\yv12vfw.dll
2010-11-08 17:16:46 ----A---- C:\Windows\system32\xvidvfw.dll
2010-11-08 17:16:46 ----A---- C:\Windows\system32\xvidcore.dll
2010-11-08 17:16:45 ----A---- C:\Windows\system32\qt-dx331.dll
2010-11-08 17:16:45 ----A---- C:\Windows\system32\dpl100.dll
2010-11-08 17:16:43 ----A---- C:\Windows\system32\divx.dll
2010-11-08 17:16:42 ----A---- C:\Windows\system32\ff_vfw.dll.manifest
2010-11-08 17:16:42 ----A---- C:\Windows\system32\ff_vfw.dll
2010-11-08 17:16:40 ----D---- C:\Users\Mára\AppData\Roaming\Real
2010-11-08 17:16:40 ----D---- C:\ProgramData\Real
2010-11-08 17:16:40 ----D---- C:\Program Files\K-Lite Codec Pack
2010-11-08 15:54:36 ----D---- C:\Users\Mára\AppData\Roaming\CyberLink
2010-11-08 15:44:18 ----N---- C:\Windows\system32\msxml3a.dll
2010-11-08 15:38:14 ----D---- C:\MyWorks
2010-11-08 15:37:55 ----N---- C:\Windows\system32\msvcp71.dll
2010-11-08 15:37:55 ----N---- C:\Windows\system32\MFC71u.dll
2010-11-08 15:37:55 ----N---- C:\Windows\system32\MFC71.dll
2010-11-08 15:37:23 ----D---- C:\Program Files\CyberLink
2010-11-08 15:37:19 ----D---- C:\ProgramData\CyberLink
2010-11-08 15:37:10 ----D---- C:\ProgramData\Temp
2010-11-07 20:50:14 ----A---- C:\Windows\system32\RtkAPO.dll
2010-11-07 20:44:26 ----A---- C:\Windows\system32\msvcr71.dll
2010-11-04 10:59:18 ----A---- C:\Windows\system32\dxtmeta2.dll
2010-11-03 13:38:28 ----D---- C:\Users\Mára\AppData\Roaming\Leadertech
2010-11-03 13:12:34 ----D---- C:\Program Files\EA Sports
2010-11-03 12:10:07 ----D---- C:\Users\Mára\AppData\Roaming\Unigraphics Solutions
2010-11-03 09:54:28 ----D---- C:\Program Files\THQ
2010-11-03 09:03:14 ----D---- C:\Program Files\Solid Edge V20
2010-11-02 16:41:00 ----A---- C:\Windows\system32\drivers\AmdLLD.sys
2010-11-02 16:39:54 ----A---- C:\Windows\system32\XAudio2_7.dll
2010-11-02 16:39:54 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2010-11-02 16:39:53 ----A---- C:\Windows\system32\xactengine3_7.dll
2010-11-02 16:39:53 ----A---- C:\Windows\system32\d3dcsx_43.dll
2010-11-02 16:39:53 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2010-11-02 16:39:52 ----A---- C:\Windows\system32\D3DX9_43.dll
2010-11-02 16:39:52 ----A---- C:\Windows\system32\d3dx11_43.dll
2010-11-02 16:39:52 ----A---- C:\Windows\system32\d3dx10_43.dll
2010-11-02 16:39:51 ----A---- C:\Windows\system32\XAudio2_6.dll
2010-11-02 16:39:51 ----A---- C:\Windows\system32\XAudio2_5.dll
2010-11-02 16:39:51 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2010-11-02 16:39:51 ----A---- C:\Windows\system32\xactengine3_6.dll
2010-11-02 16:39:51 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2010-11-02 16:39:50 ----A---- C:\Windows\system32\xactengine3_5.dll
2010-11-02 16:39:50 ----A---- C:\Windows\system32\d3dcsx_42.dll
2010-11-02 16:39:50 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2010-11-02 16:39:49 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-11-02 16:39:49 ----A---- C:\Windows\system32\d3dx11_42.dll
2010-11-02 16:39:49 ----A---- C:\Windows\system32\d3dx10_42.dll
2010-11-02 16:39:48 ----A---- C:\Windows\system32\D3DX9_41.dll
2010-11-02 16:39:48 ----A---- C:\Windows\system32\d3dx10_41.dll
2010-11-02 16:39:48 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\XAudio2_4.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\xactengine3_4.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\d3dx10_40.dll
2010-11-02 16:39:47 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2010-11-02 16:39:46 ----A---- C:\Windows\system32\D3DX9_40.dll
2010-11-02 16:39:45 ----A---- C:\Windows\system32\XAudio2_3.dll
2010-11-02 16:39:45 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2010-11-02 16:39:45 ----A---- C:\Windows\system32\xactengine3_3.dll
2010-11-02 16:39:45 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2010-11-02 16:39:44 ----A---- C:\Windows\system32\XAudio2_2.dll
2010-11-02 16:39:44 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2010-11-02 16:39:44 ----A---- C:\Windows\system32\xactengine3_2.dll
2010-11-02 16:39:44 ----A---- C:\Windows\system32\d3dx10_39.dll
2010-11-02 16:39:44 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2010-11-02 16:39:43 ----A---- C:\Windows\system32\XAudio2_1.dll
2010-11-02 16:39:43 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2010-11-02 16:39:43 ----A---- C:\Windows\system32\D3DX9_39.dll
2010-11-02 16:39:42 ----A---- C:\Windows\system32\xactengine3_1.dll
2010-11-02 16:39:42 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2010-11-02 16:39:42 ----A---- C:\Windows\system32\d3dx10_38.dll
2010-11-02 16:39:42 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\XAudio2_0.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\xactengine3_0.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\D3DX9_38.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\d3dx10_37.dll
2010-11-02 16:39:41 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2010-11-02 16:39:40 ----A---- C:\Windows\system32\xactengine2_10.dll
2010-11-02 16:39:40 ----A---- C:\Windows\system32\D3DX9_37.dll
2010-11-02 16:39:39 ----A---- C:\Windows\system32\d3dx10_36.dll
2010-11-02 16:39:39 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2010-11-02 16:39:38 ----A---- C:\Windows\system32\xactengine2_9.dll
2010-11-02 16:39:38 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-11-02 16:39:38 ----A---- C:\Windows\system32\d3dx10_35.dll
2010-11-02 16:39:38 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2010-11-02 16:39:37 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-11-02 16:39:37 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2010-11-02 16:39:37 ----A---- C:\Windows\system32\d3dx9_35.dll
2010-11-02 16:39:36 ----A---- C:\Windows\system32\xinput1_3.dll
2010-11-02 16:39:36 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-11-02 16:39:36 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-11-02 16:39:36 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-11-02 16:39:35 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-11-02 16:39:35 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-11-02 16:39:35 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-11-02 16:39:34 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-11-02 16:39:34 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-11-02 16:39:34 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-11-02 16:39:34 ----A---- C:\Windows\system32\d3dx10.dll
2010-11-02 16:39:33 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-11-02 16:39:33 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-11-02 16:39:33 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-11-02 16:39:33 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-11-02 16:39:33 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-11-02 16:39:32 ----A---- C:\Windows\system32\xinput1_2.dll
2010-11-02 16:39:32 ----A---- C:\Windows\system32\xinput1_1.dll
2010-11-02 16:39:32 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-11-02 16:39:32 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-11-02 16:39:26 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-11-02 16:39:26 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-11-02 16:39:26 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-11-02 16:39:25 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-11-02 16:39:25 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-11-02 16:39:24 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-11-02 16:39:24 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-11-02 16:39:23 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-11-02 16:39:23 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-10-29 23:16:54 ----D---- C:\ProgramData\KONAMI
2010-10-29 23:15:09 ----D---- C:\Windows\system32\appmgmt
2010-10-29 22:32:12 ----D---- C:\Program Files\KONAMI
2010-10-27 23:13:15 ----D---- C:\Users\Mára\AppData\Roaming\Media Player Classic
2010-10-27 23:11:39 ----A---- C:\Windows\system32\unrar.dll
2010-10-27 19:42:06 ----D---- C:\Users\Mára\AppData\Roaming\IDM
2010-10-27 19:42:05 ----D---- C:\Users\Mára\AppData\Roaming\DMCache
2010-10-27 19:42:02 ----D---- C:\Program Files\Internet Download Manager
2010-10-27 19:34:00 ----D---- C:\Program Files\Stardock
2010-10-27 19:34:00 ----D---- C:\Program Files\Common Files\Stardock
2010-10-24 19:45:02 ----D---- C:\Users\Mára\AppData\Roaming\Ubisoft
2010-10-24 19:45:02 ----D---- C:\ProgramData\Ubisoft
2010-10-24 19:27:07 ----D---- C:\Users\Mára\AppData\Roaming\QipGuard
2010-10-24 19:26:59 ----D---- C:\Program Files\QIP
2010-10-24 19:23:07 ----D---- C:\Users\Mára\AppData\Roaming\QIP
2010-10-24 19:22:39 ----D---- C:\Program Files\QIP 2010
2010-10-24 18:33:52 ----D---- C:\Program Files\Ubisoft

======List of files/folders modified in the last 1 months======

2010-11-22 13:31:19 ----D---- C:\Windows\Temp
2010-11-22 13:25:52 ----RD---- C:\Program Files
2010-11-22 12:17:13 ----D---- C:\Windows\system32\config
2010-11-22 12:15:03 ----D---- C:\Windows\system32\Tasks
2010-11-22 12:14:50 ----A---- C:\Windows\system32\AutoRunFilter.ini
2010-11-21 17:56:20 ----SD---- C:\Users\Mára\AppData\Roaming\Microsoft
2010-11-21 13:50:51 ----SHD---- C:\System Volume Information
2010-11-20 23:54:14 ----HD---- C:\ProgramData
2010-11-20 21:49:23 ----D---- C:\Windows\System32
2010-11-20 21:49:23 ----D---- C:\Windows\inf
2010-11-20 21:49:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-19 09:24:25 ----SHD---- C:\Windows\Installer
2010-11-19 09:24:23 ----RSD---- C:\Windows\assembly
2010-11-19 09:24:00 ----RSD---- C:\Windows\Fonts
2010-11-19 08:34:06 ----D---- C:\Windows\Prefetch
2010-11-18 17:29:14 ----D---- C:\Program Files\Common Files
2010-11-18 16:45:25 ----D---- C:\Windows\system32\drivers
2010-11-16 11:45:59 ----D---- C:\Windows\system32\NDF
2010-11-15 15:43:58 ----A---- C:\Windows\system32\ServiceFilter.ini
2010-11-09 17:07:40 ----D---- C:\Windows\system32\DriverStore
2010-11-09 17:07:40 ----D---- C:\Windows\system32\catroot
2010-11-09 17:03:59 ----D---- C:\Windows\system32\catroot2
2010-11-08 17:25:43 ----HD---- C:\Program Files\Temp
2010-11-08 17:24:46 ----HD---- C:\Program Files\InstallShield Installation Information
2010-11-08 17:24:44 ----D---- C:\Windows
2010-11-05 21:27:01 ----D---- C:\Windows\ModemLogs
2010-11-03 13:11:23 ----D---- C:\Windows\winsxs
2010-11-02 16:43:49 ----D---- C:\Program Files\Common Files\InstallShield
2010-11-02 16:40:59 ----D---- C:\Program Files\AMD
2010-11-02 16:11:34 ----D---- C:\Program Files\2K Games
2010-11-01 18:04:26 ----D---- C:\Windows\system32\drivers\etc
2010-10-30 16:51:49 ----D---- C:\Windows\system32\wdi
2010-10-29 10:27:25 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AsDsm;AsDsm; C:\Windows\system32\drivers\AsDsm.sys [2010-10-09 30264]
R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 14392]
R0 lullaby;lullaby; C:\Windows\system32\DRIVERS\lullaby.sys [2009-06-18 15416]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-10 691696]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2007-12-21 53768]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [2009-07-02 13880]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2007-12-21 71176]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-03-30 5429248]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-30 157184]
R3 AmdLLD;AMD Low Level Device Driver; C:\Windows\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2010-03-02 1263104]
R3 AtiHdmiService;ATI Service for HD Audio Codec; C:\Windows\system32\drivers\AtiHdmi.sys [2009-07-23 103440]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 btusbflt;Bluetooth USB Filter; C:\Windows\system32\drivers\btusbflt.sys [2009-07-01 43944]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2009-07-01 86056]
R3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2009-07-01 108072]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2009-07-01 18344]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2007-12-21 30728]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2010-01-18 102400]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-11-02 3228712]
R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2009-08-18 119408]
R3 JME;JMicron Ethernet Adapter NDIS6.20 Driver; C:\Windows\system32\DRIVERS\JME.sys [2010-02-25 98928]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2009-07-20 13880]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2009-05-13 14392]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-08-20 1760384]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 a23nmvnj;a23nmvnj; C:\Windows\system32\drivers\a23nmvnj.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
S3 ipswuio;ipswuio; C:\Windows\System32\DRIVERS\ipswuio.sys []
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-14 84992]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2008-05-23 131000]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AFBAgent;AFBAgent; C:\Windows\system32\FBAgent.exe [2009-12-07 303744]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-30 172032]
R2 ASLDRService;ASLDR Service; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-07-01 582944]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R3 ADSMService;ADSM Service; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [2008-03-31 225280]
R3 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-09 272024]
R3 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2007-12-21 19200]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Poprosim i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

[Marek19]

Tady je:

info.txt logfile of random's system information tool 1.08 2010-11-22 13:31:28

======Uninstall list======

-->MsiExec /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
Acrobat.com-->MsiExec.exe /X{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10k_Plugin.exe -maintain plugin
Adobe Reader 9.0.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90100000001}
AMD USB Filter Driver-->MsiExec.exe /X{987B04C4-B5AC-4AD6-A7E9-8D681085B850}
Assassin's Creed II-->"C:\Program Files\InstallShield Installation Information\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}\setup.exe" -runfromtemp -l0x0005 -removeonly
ASUS AI Recovery-->MsiExec.exe /I{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}
ASUS CopyProtect-->MsiExec.exe /I{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}
ASUS Data Security Manager-->MsiExec.exe /X{FA2092C5-7979-412D-A962-6485274AE1EE}
ASUS FancyStart-->MsiExec.exe /I{2B81872B-A054-48DA-BE3B-FA5C164C303A}
ASUS LifeFrame3-->MsiExec.exe /I{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}
ASUS Live Update-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}\Setup.exe" -l0x9
ASUS MultiFrame-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9D48531D-2135-49FC-BC29-ACCDA5396A76}\setup.exe" -l0x9
ASUS Power4Gear Hybrid-->MsiExec.exe /I{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}
ASUS SmartLogon-->MsiExec.exe /I{64452561-169F-4A36-A2FF-B5E118EC65F5}
ASUS Splendid Video Enhancement Technology-->MsiExec.exe /I{0969AF05-4FF6-4C00-9406-43599238DE0D}
ASUS Virtual Camera-->MsiExec.exe /I{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}
ATI Catalyst Install Manager-->msiexec /q/x{0E6A2BDA-C881-BF07-FCAB-0C594EAB3B73} REBOOT=ReallySuppress
ATK Package-->MsiExec.exe /I{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}
ControlDeck-->MsiExec.exe /I{5B65EF64-1DFA-414A-8C94-7BB726158E21}
CyberLink DVD Suite-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
CyberLink DVD Suite-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
CyberLink LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" -uninstall
CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall
CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall
CyberLink Power2Go-->"C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" /z-uninstall
CyberLink Power2Go-->"C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" /z-uninstall
CyberLink PowerDVD-->"C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
Čeština pro Solid Edge V20-->"C:\Program Files\Solid Edge V20\unins000.exe"
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Dual-Core Optimizer-->MsiExec.exe /X{9FD6F1A8-5550-46AF-8509-271DF0E768B5}
ESET Smart Security-->MsiExec.exe /I{A1350B64-1AF8-497B-AC07-307DF67FB8D4}
ETDWare PS/2-x86 7.0.5.10_WHQL-->%ProgramFiles%\Elantech\ETDUn_inst.exe
Fast Boot-->MsiExec.exe /X{13F4A7F3-EABC-4261-AF6B-1317777F0755}
FIFA 11-->MsiExec.exe /X{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}
Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe
JMicron Ethernet Adapter NDIS Driver-->"C:\Program Files\JMicron\JME_DIR\setup.exe" delpkg
JMicron Flash Media Controller Driver-->"C:\Program Files\JMicron\JMCR_DIR\setup.exe" delpkg
K_Series_ScreenSaver_EN-->C:\Windows\system32\K_Series_ScreenSaver_EN.scr /u
K-Lite Mega Codec Pack 3.5.7-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
MediaShow-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5A9B7C0-8751-11D8-9D75-000129760D75}\Setup.exe" -uninstall
Metin2-->"C:\Program Files\Metinn2\unins000.exe"
Metro 2033-->"C:\Program Files\THQ\Metro 2033\unins000.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.12)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NB Probe-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}\Setup.exe" -l0x9
Need for Speed™ Carbon-->C:\Program Files\Electronic Arts\Need for Speed Carbon\EAUninstall.exe
Need for Speed™ SHIFT-->MsiExec.exe /X{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}
Net4Switch-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9D6D7811-43B3-463C-BC79-5D1755269989}\setup.exe" -l0x9
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)-->"C:\Program Files\ESET\ESET Smart Security\unins000.exe"
NVIDIA PhysX-->MsiExec.exe /X{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}
ObjectDock-->C:\PROGRA~1\Stardock\OBJECT~1\UNWISE.EXE C:\PROGRA~1\Stardock\OBJECT~1\INSTALL.LOG
OpenOffice.org 2.3-->MsiExec.exe /I{39CDC80C-4330-4556-990D-1975211E2370}
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" -l0x000409 /z-uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall
Pro Evolution Soccer 2011-->MsiExec.exe /X{9773450C-E2F3-46C3-9464-1D7EDE5EFB63}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Skype Toolbars-->MsiExec.exe /I{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Skype™ 5.0-->MsiExec.exe /X{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}
Software Bluetooth WIDCOMM-->MsiExec.exe /X{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}
Solid Edge V20-->MsiExec.exe /X{886F91D5-4B45-45DC-938E-6B0276C6B015}
Sothink FLV Player-->"C:\Program Files\Common Files\SourceTec\Sothink FLV Player\unins000.exe"
SRS Premium Sound Control Panel-->MsiExec.exe /I{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}
Ubisoft Game Launcher-->"C:\Program Files\InstallShield Installation Information\{888F1505-C2B3-4FDE-835D-36353EBD4754}\setup.exe" -runfromtemp -l0x0409 -removeonly
USB2.0 UVC VGA WebCam-->C:\Windows\snuninst.exe /name='USB2.0 UVC VGA WebCam'
Vietcong-->C:\Program Files\Vietcong\Uninstall.exe
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinFlash-->MsiExec.exe /X{8F21291E-0444-4B1D-B9F9-4370A73E346D}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Wireless Console 3-->MsiExec.exe /I{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}

======System event log======

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Distributed Link Tracking Client byl změněn na: stopped
Record Number: 5
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Security Center byl změněn na: stopped
Record Number: 4
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Desktop Window Manager Session Manager byl změněn na: stopped
Record Number: 3
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Diagnostic Policy Service byl změněn na: stopped
Record Number: 2
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 7036
Message: Stav služby Microsoft Software Shadow Copy Provider byl změněn na: stopped
Record Number: 1
Source Name: Service Control Manager
Time Written: 20090714045645.074339-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: 37L4247D28-05
Event Code: 1001
Message: Chybný blok , typ 0
Název události: PnPGenericDriverFound
Reakce: Není k dispozici
ID souboru CAB: 0

Podpis problému:
P1: x86
P2: PCI\VEN_1002&DEV_68E0&SUBSYS_1BF21043&REV_00
P3:
P4:
P5:
P6:
P7:
P8:
P9:
P10:

Připojené soubory:

Tyto soubory mohou být k dispozici zde:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_e95cfdf9bc48b7439229936510413f924aacd724_cab_06551489

Symbol analýzy:
Opětovné hledání řešení: 0
ID hlášení: 2c5d7b3d-d3bb-11df-9ed1-c134583514ec
Stav hlášení: 6
Record Number: 5
Source Name: Windows Error Reporting
Time Written: 20101009153751.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20101009153743.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 3
Source Name: Microsoft-Windows-WMI
Time Written: 20101009153740.000000-000
Event Type: Informace
User:

Computer Name: 37L4247D28-05
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.


Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20101009153737.441697-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: 37L4247D28-05
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 1
Source Name: Microsoft-Windows-EventSystem
Time Written: 20101009153737.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: 37L4247D28-05
Event Code: 4735
Message: Byla změněna zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Změněné atributy:
Název účtu SAM: -
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101009153709.517648-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4731
Message: Byla vytvořena zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247D28-05$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Nová skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Atributy:
Název účtu SAM: Backup Operators
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101009153709.517648-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.

Počet prvků: 0
ID zásady: 0x24e46
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101009153709.174448-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4624
Message: Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 0

Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x4
Název procesu:

Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101009153708.004446-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247D28-05
Event Code: 4608
Message: Spouští se systém Windows.

Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101009153707.957646-000
Event Type: Úspěšný audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\Program Files\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\WIDCOMM\Bluetooth Software\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 6 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=0603
"P_SCHEMA"=C:\Program Files\Solid Edge V20\Schema

-----------------EOF-----------------

[vyosek]

Prectete si prosim soukromou zpravu a odpovezte mi na ni

[vyosek]

Nelegalni balicek ESS vyresen pres PMky

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• V zadnem pripade ted nerestartujte PC - prisli byste o ucinek RKillu

Spustte HJT a provedeme fixnuti polozek

• HJT najdete zde C:\Program Files\trend micro\Mára.exe
• Otevre se Vam okno, kliknete na Do a system scan only
• V dalsim okne najdete radky které jsem Vam vypsal nize, vedle nich je ctverecek, do ktereho udelate zatrzitko
• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (file missing)
  R3 - URLSearchHook: (no name) - - (no file)
• Kliknete na Fix checked (vlevo dole)
• HJT se Vas zepta zda opravdu ANO, s tim souhlasite a je hotovo

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"=-
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B5863A0-C43F-4C0A-982B-CC0E9125783F}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "UpdateLBPShortCut"=-
  "UpdateP2GoShortCut"=-
  "UpdatePPShortCut"=-
  "UpdatePSTShortCut"=-
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  "NVIDIA driver monitor"=-
  "QIP Internet Guardian"=-
  "tihud"=-
  "MSConfig"=-
  "zigy"=-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
  
  :files
  C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe
  C:\Users\Mára\AppData\Roaming\Microsoft\pujoo.exe
  C:\Users\Mára\svpivg.exe
  C:\Users\Public\nvsvc32.exe
  C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe
  C:\Program Files\DAEMON Tools Toolbar
  C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp /s
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[Marek19]

Po překopírování textu do otm kliknu na moveit a program neodpovídá...

[vyosek]

Provedte krok s OTM v nouzovem rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti)

[Marek19]

dělá to pořád to samé... v zeleném okně results se objeví All processed killed a pár registrů pod tím a pak to nic nedělá.

[vyosek]

Takze tu udelame na etapy

Otevrete si poznamkovy blok

• Start->spustit->notepad
• Vlozte text nize

• Kód: Vybrat vše

  Windows Registry Editor Version 5.00
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}"=-
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B5863A0-C43F-4C0A-982B-CC0E9125783F}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "UpdateLBPShortCut"=-
  "UpdateP2GoShortCut"=-
  "UpdatePPShortCut"=-
  "UpdatePSTShortCut"=-
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools Lite"=-
  "NVIDIA driver monitor"=-
  "QIP Internet Guardian"=-
  "tihud"=-
  "MSConfig"=-
  "zigy"=-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

• Soubor ulozte jako oprava.reg
• Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
• 
• Zavrit notepad a spustit dvojklikem oprava.reg
• Pripadny dotaz na zmenu registru potvrdte
• Okno jen problikne a opravi regsitry - soubor muzete smazat

Pro OTM pak pouzijte tento skript

Kód: Vybrat vše

:files
C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe
C:\Users\Mára\AppData\Roaming\Microsoft\pujoo.exe
C:\Users\Mára\svpivg.exe
C:\Users\Public\nvsvc32.exe
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe
C:\Program Files\DAEMON Tools Toolbar
C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

[Marek19]

All processes killed
========== FILES ==========
File/Folder C:\Users\Mára\AppData\Roaming\Microsoft\fuhouquou.exe not found.
C:\Users\Mára\AppData\Roaming\Microsoft\pujoo.exe moved successfully.
File/Folder C:\Users\Mára\svpivg.exe not found.
C:\Users\Public\nvsvc32.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0fpfapa.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2qkkf2a.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2vv0aav.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5v6f5a2.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5v6vqkk.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5vvqff2.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6oytytj.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7qq037a.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9shhcs6.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0vq0k0f.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aav32vqf.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\afq4aav5.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aq4kfv5q1fa.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\av1qqffv98q.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\avak37fk.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\avavvqvfaqq.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csh9ccxs0.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6qqf5af7.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\faakv1kkakk.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\faqq1v5a.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffaakv6v.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffkkkfaf.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fppvvp5kp.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fqlffa1q.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fqlffa1qaav.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kkaavk4fv.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kqk0faav1qk.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kv7fa6fpav.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kvakfaafvaa.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kvkk25p5fa.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nccx5cnxxn.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nhcchcscxs.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojy6tjotto5.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pfvpaavkf0k.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q5f5aqql5.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbbqqvqg6.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qk4fvvqf.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qk4fvvqffa.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qqfflaf6v.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qvf91qaavva.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qvgbvvll2.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qvvblgl93v.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ttytjotto.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v4vg9gvvq.exe moved successfully.
C:\Users\Mára\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v6k7kvffkk.exe moved successfully.
C:\Program Files\DAEMON Tools Toolbar\Resources folder moved successfully.
C:\Program Files\DAEMON Tools Toolbar folder moved successfully.
File/Folder C:\Users\Mára\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll not found.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
C:\Windows\msdownld.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5E64.tmp folder moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8545.tmp folder moved successfully.
C:\Windows\Temp\DMI5FDA.tmp moved successfully.
C:\Windows\Temp\DMI6D04.tmp moved successfully.
C:\Windows\Temp\DMI70AC.tmp moved successfully.
C:\Windows\Temp\DMI9CAB.tmp moved successfully.
C:\Windows\Temp\DMIF517.tmp moved successfully.
C:\Windows\Temp\expE032.tmp moved successfully.
C:\Windows\Temp\ijdpnn2BE78C34.tmp moved successfully.
C:\Windows\Temp\NODB873.tmp moved successfully.
C:\Windows\Temp\TS_2720.tmp moved successfully.
C:\Windows\Temp\TS_2D0A.tmp moved successfully.
C:\Windows\Temp\TS_2FD9.tmp moved successfully.
C:\Windows\Temp\TS_3E6A.tmp moved successfully.
C:\Windows\Temp\TS_4223.tmp moved successfully.
C:\Windows\Temp\TS_4A7D.tmp moved successfully.
C:\Windows\Temp\TS_4D6B.tmp moved successfully.
C:\Windows\Temp\TS_5B22.tmp moved successfully.
C:\Windows\Temp\TS_5E6D.tmp moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mára
->Temp folder emptied: 158282406 bytes
->Temporary Internet Files folder emptied: 128743653 bytes
->FireFox cache emptied: 49729352 bytes
->Flash cache emptied: 9847 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 42453006 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 17217402740 bytes

Total Files Cleaned = 16 781,00 mb


OTM by OldTimer - Version 3.1.17.2 log created on 11222010_184100

[vyosek]

Jak se chova PC, stale si samo povida po FB

[Marek19]

Pořád to stejný Píšu a místo textu přijde odkaz

[vyosek]

To vsak ale chodi od nekoho jineho...dulezite je, zda-li Vy nekomu tohle posilate...doporucte tomu od koho Vam to chodi, at si necha u nas zkontrolovat PC, jelikoz tam tu havet taktez ma...

[Marek19]

No ať si píšu s kymkoliv tak mi to blbne...něco přijde normálně a bčas přijde místo textu tento odkaz. Ode mě jemu. Já ho samozřejmě neposílám. Odešlu text, přijde odkaz

[vyosek]

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix