Prosím o kontrolu logu

Zpráva

Blein · #1 Příspěvek od **Blein** » 27 Led 2011 20:53

Zdravím, mám potíže s PC avast mi neustále vyhazuje jedno okénko za druhým že zde mám vir a já se ho nemůžu za pomocí avastu zbavit přikládám log z RSIT Docela by mě zajímalo jakto, že je jenom jeden?

Logfile of random's system information tool 1.08 (written by random/random)
Run by Helmic at 2011-01-27 20:50:58
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 32 GB (8%) free of 382 GB
Total RAM: 2047 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:51:08, on 27.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\FixCamera.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\cazyp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\nvsvc32.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Helmic\Dokumenty\Downloads\RSIT (2).exe
C:\Program Files\trend micro\Helmic.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
R3 - URLSearchHook: (no name) - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - (no file)
R3 - URLSearchHook: (no name) - {6c3a1de1-94ca-4ad6-acdf-c1324adc487b} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: (no name) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
O3 - Toolbar: (no name) - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - (no file)
O3 - Toolbar: (no name) - {6c3a1de1-94ca-4ad6-acdf-c1324adc487b} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NVIDIA driver monitor] C:\WINDOWS\nvsvc32.exe
O4 - HKLM\..\Run: [zoule] C:\WINDOWS\system32\cazyp.exe
O4 - HKLM\..\Run: [SessionInit] C:\Documents and Settings\Helmic\init.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Miranda IM] C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe
O4 - HKCU\..\Run: [NVIDIA driver monitor] C:\WINDOWS\nvsvc32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: 0uupggb.exe
O4 - Startup: a81xdnjef.exe
O4 - Startup: brrhn60pk.exe
O4 - Startup: jzzvllhx.exe
O4 - Startup: rr081yjkfl.exe
O4 - Startup: y3aavmmhyyt.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systemes SolidWorks Corp. - C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
O23 - Service: Backbone Service (eqtvoii1ieid) - Unknown owner - C:\WINDOWS\system32\dumoucoucoon.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

--
End of file - 9259 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-448539723-725345543-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-448539723-725345543-1005UA.job
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-448539723-725345543-1005.job
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-448539723-725345543-1005.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-06-19 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-10-30 1019336]
{7c5c0f58-e061-457d-9033-77307f5ed00c}
{a6e4a4eb-d169-4e99-8988-250fcbafe767}
{6c3a1de1-94ca-4ad6-acdf-c1324adc487b}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-09-27 13918208]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-09-27 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-07-20 18670592]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-24 98304]
"FixCamera"=C:\WINDOWS\FixCamera.exe [2007-02-12 20480]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-06-19 202256]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-10-25 86016]
"zoule"=C:\WINDOWS\system32\cazyp.exe [2010-11-12 201216]
"SessionInit"=C:\Documents and Settings\Helmic\init.exe [2010-11-16 35328]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Miranda IM"=C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe [2009-03-22 258048]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-10-25 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fsm]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-11-13 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\Documents and Settings\Helmic\mns.exe [2010-11-12 19456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SessionInit]
C:\Documents and Settings\Helmic\init.exe [2010-11-16 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
C:\WINDOWS\vsnp325.exe [2006-10-10 827392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Software Informer]
C:\Program Files\Software Informer\softinfo.exe [2009-11-25 2011205]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SolidWorks_CheckForUpdates]
C:\Program Files\Common Files\Manažer instalací SolidWorks\Scheduler\sldIMScheduler.exe [2009-03-20 7308584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-30 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-06-19 202256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
C:\WINDOWS\tsnp325.exe [2006-10-10 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Firewall]
C:\DOCUME~1\Helmic\LOCALS~1\Temp\lsass.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Místní vyhledávání.lnk]
C:\PROGRA~1\WINDOW~4\WINDOW~1.EXE [2007-02-05 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^0uupggb.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\0uupggb.exe [2010-11-16 60416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^a81xdnjef.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\a81xdnjef.exe [2010-11-13 60416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^brrhn60pk.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\brrhn60pk.exe [2010-11-13 60416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^dttpffbr.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\dttpffbr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^jzzvllhx.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\jzzvllhx.exe [2010-11-14 60416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2009-01-15 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^rr081yjkfl.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\rr081yjkfl.exe [2010-11-13 60416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^y3aavmmhyyt.exe]
C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění\y3aavmmhyyt.exe [2010-11-14 60416]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE

C:\Documents and Settings\Helmic\Nabídka Start\Programy\Po spuštění
0uupggb.exe
a81xdnjef.exe
brrhn60pk.exe
jzzvllhx.exe
rr081yjkfl.exe
y3aavmmhyyt.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-11-25 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe"="C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Pidgin\pidgin.exe"="C:\Program Files\Pidgin\pidgin.exe:*:Enabled:Pidgin"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\BitLord2\BitLord.exe"="C:\Program Files\BitLord2\BitLord.exe:*:Enabled:Bitlord2"
"C:\BitLord\BitLord.exe"="C:\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Helmic\Plocha\Hry\Half2\hl2.exe"="C:\Documents and Settings\Helmic\Plocha\Hry\Half2\hl2.exe:*:Disabled:hl2"
"C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe"="C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth"
"C:\Documents and Settings\Helmic\Dokumenty\Downloads\P17535732.JPG-www.facebook.exe"="C:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Documents and Settings\Helmic\init.exe"="C:\Documents and Settings\Helmic\init.exe:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2011-01-22 18:20:13 ----A---- C:\WINDOWS\system32\cazyp.exe
2011-01-12 19:00:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\WinZip
2011-01-12 19:00:23 ----D---- C:\Program Files\WinZip
2011-01-05 00:11:20 ----D---- C:\Program Files\CCleaner
2011-01-04 23:48:36 ----D---- C:\rsit
2010-12-30 19:06:48 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Ahead
2010-12-30 19:03:07 ----RA---- C:\WINDOWS\system32\picn20.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\ImagXpr5.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\imagx5.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\imagr5.dll
2010-12-30 19:03:00 ----RA---- C:\WINDOWS\system32\NeroCheck.exe
2010-12-30 19:03:00 ----D---- C:\Program Files\Common Files\Ahead
2010-12-30 19:02:55 ----D---- C:\Program Files\Ahead
2010-12-30 14:17:52 ----D---- C:\Documents and Settings\Helmic\Data aplikací\VSO
2010-12-30 14:17:40 ----D---- C:\Program Files\VSO
2010-12-26 03:19:56 ----D---- C:\WINDOWS\Minidump
2010-12-23 23:02:42 ----A---- C:\FaceIM.exe
2010-12-20 11:58:59 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Help
2010-11-27 10:12:08 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Ashampoo
2010-11-27 10:11:58 ----D---- C:\Documents and Settings\All Users\Data aplikací\ashampoo
2010-11-27 10:11:30 ----D---- C:\Program Files\Ashampoo
2010-11-21 19:09:47 ----A---- C:\wifi32.exe
2010-11-17 00:09:43 ----A---- C:\wlksk.exe
2010-11-16 10:44:19 ----A---- C:\winn27.exe
2010-11-15 03:14:53 ----A---- C:\winnt7.exe
2010-11-13 06:27:36 ----A---- C:\t6.exe
2010-11-13 03:46:45 ----A---- C:\176.exe
2010-11-12 23:36:32 ----A---- C:\ws7.exe
2010-11-12 21:37:34 ----A---- C:\WINDOWS\system32\dumoucoucoon.exe
2010-11-12 21:36:24 ----RSH---- C:\Documents and Settings\Helmic\Data aplikací\juzjf.exe
2010-11-12 05:24:30 ----A---- C:\QuickTime1.exe
2010-11-11 23:56:19 ----A---- C:\winskd.exe
2010-11-11 20:01:24 ----A---- C:\winscxs.exe
2010-11-11 18:07:03 ----A---- C:\6164.exe
2010-11-11 03:21:01 ----A---- C:\21.exe
2010-11-11 00:21:43 ----A---- C:\supe.exe
2010-11-11 00:06:21 ----A---- C:\wscnnt.exe
2010-11-10 23:37:10 ----A---- C:\je32.exe
2010-11-10 23:35:57 ----A---- C:\h32.exe
2010-11-10 16:26:15 ----A---- C:\27.exe
2010-11-08 02:14:16 ----A---- C:\ng.exe

======List of files/folders modified in the last 3 months======

2011-01-27 20:51:06 ----D---- C:\WINDOWS\Prefetch
2011-01-27 20:51:06 ----D---- C:\Program Files\trend micro
2011-01-27 20:48:06 ----AD---- C:\WINDOWS\Temp
2011-01-27 10:30:26 ----D---- C:\Program Files\Full Tilt Poker
2011-01-27 10:03:08 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-27 05:11:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-25 14:00:03 ----D---- C:\WINDOWS\system32\config
2011-01-24 18:18:58 ----SD---- C:\WINDOWS\Tasks
2011-01-23 03:38:39 ----D---- C:\WINDOWS\system32
2011-01-19 14:50:31 ----HD---- C:\WINDOWS\inf
2011-01-12 19:00:47 ----SHD---- C:\WINDOWS\Installer
2011-01-12 19:00:47 ----D---- C:\WINDOWS
2011-01-12 19:00:23 ----RD---- C:\Program Files
2011-01-10 16:30:04 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Skype
2011-01-10 16:00:07 ----D---- C:\Documents and Settings\Helmic\Data aplikací\skypePM
2011-01-05 00:12:18 ----D---- C:\WINDOWS\Debug
2011-01-04 21:59:04 ----D---- C:\Documents and Settings\Helmic\Data aplikací\.purple
2011-01-04 12:42:43 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-12-31 16:09:31 ----D---- C:\Documents and Settings\Helmic\Data aplikací\SMS posílač Treca
2010-12-30 19:03:00 ----D---- C:\Program Files\Common Files
2010-12-18 19:03:16 ----D---- C:\Filmy
2010-12-15 17:06:03 ----D---- C:\Koncerty
2010-11-29 17:55:23 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-26 17:11:46 ----A---- C:\WINDOWS\cdplayer.ini
2010-11-23 20:12:29 ----D---- C:\WINDOWS\Network Diagnostic
2010-11-17 18:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-11-17 18:30:03 ----D---- C:\WINDOWS\system32\drivers
2010-11-16 17:33:24 ----RSH---- C:\boot.ini
2010-11-16 17:33:24 ----A---- C:\WINDOWS\win.ini
2010-11-16 17:33:24 ----A---- C:\WINDOWS\system.ini
2010-11-16 17:33:22 ----D---- C:\WINDOWS\pss
2010-11-16 15:27:39 ----SHD---- C:\RECYCLER
2010-11-16 00:31:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Real
2010-11-16 00:31:05 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Real
2010-11-12 21:53:49 ----D---- C:\Program Files\TorrentMan
2010-11-12 21:53:49 ----D---- C:\Program Files\Isohunt-vuze
2010-11-12 21:53:49 ----D---- C:\Program Files\isoHunt
2010-11-10 16:17:46 ----RSD---- C:\WINDOWS\assembly
2010-10-28 11:10:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdide;amdide; C:\WINDOWS\system32\DRIVERS\amdide.sys [2007-10-11 9096]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-07-21 691696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-11-25 4463104]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-07-20 5795328]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-05-25 142336]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbfilter;AMD USB Filter Driver; C:\WINDOWS\system32\DRIVERS\usbfilter.sys [2009-02-09 22328]
S3 a3oq92xr;a3oq92xr; C:\WINDOWS\system32\drivers\a3oq92xr.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 hgfreuaf;hgfreuaf; \??\C:\WINDOWS\System32\Drivers\hgfreuaf.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-09-27 7655872]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 pvudcdwq;pvudcdwq; \??\C:\WINDOWS\System32\Drivers\pvudcdwq.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SNP325;USB PC Camera (SNPSTD325); C:\WINDOWS\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 yvhgsnwd;yvhgsnwd; \??\C:\WINDOWS\System32\Drivers\yvhgsnwd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-11-25 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-30 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-07-21 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2011-01-04 214520]
R2 WSearch;Vyhledávání systému Windows; C:\WINDOWS\system32\SearchIndexer.exe [2007-02-05 300032]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 eqtvoii1ieid;Backbone Service; C:\WINDOWS\system32\dumoucoucoon.exe [2010-11-12 201216]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
S2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-09-27 172100]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service; C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2009-03-19 83240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [2010-03-20 79360]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-09-23 2799808]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **motji** » 27 Led 2011 21:41

Dobrý večer

No jo, máte tak taky celé zoo

.

Stahněte Rkill z jednoho z odkazů, pokud by ho vir blokoval, zkuste stahnout jiný

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr

Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

-spusťte ho a nechejte pracovat. Sám se ukončí.

-

Ted nerestartujte počítač!

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix
-přejmenujte combofix na cokoliv.com

Blein · #3 Příspěvek od **Blein** » 27 Led 2011 21:44

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 27.01.2011 at 21:43:10.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe

Rkill completed on 27.01.2011 at 21:43:14.

a jedeme dál......

#4 Příspěvek od **motji** » 27 Led 2011 22:05

Blein · #5 Příspěvek od **Blein** » 27 Led 2011 22:05

ComboFix 11-01-27.01 - Helmic 27.01.2011 21:54:51.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1252 [GMT 1:00]
Spuštěný z: c:\documents and settings\Helmic\Plocha\cokoliv.com.exe
AV: avast! antivirus 4.8.1368 [VPS 100722-0] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\176.exe
C:\21.exe
C:\27.exe
C:\6164.exe
c:\documents and settings\Helmic\init.exe
c:\documents and settings\Helmic\mns.exe
c:\documents and settings\LocalService\Data aplikací\Microsoft\cazyp.exe
c:\windows\nvsvc32.exe
c:\windows\system32\cazyp.exe
c:\windows\system32\dumoucoucoon.exe
c:\windows\system32\winlogon.bak

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_eqtvoii1ieid
-------\Service_eqtvoii1ieid

((((((((((((((((((((((((( Soubory vytvořené od 2010-12-27 do 2011-01-27 )))))))))))))))))))))))))))))))
.

2011-01-12 18:00 . 2011-01-12 18:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\WinZip
2011-01-04 23:11 . 2011-01-26 17:26 -------- d-----w- c:\program files\CCleaner
2011-01-04 22:48 . 2011-01-04 22:48 -------- d-----w- C:\rsit
2010-12-30 18:06 . 2010-12-30 18:06 -------- d-----w- c:\documents and settings\Helmic\Data aplikací\Ahead
2010-12-30 18:03 . 2001-06-26 06:15 38912 ----a-r- c:\windows\system32\picn20.dll
2010-12-30 18:03 . 2001-07-06 16:24 283920 ----a-r- c:\windows\system32\ImagXpr5.dll
2010-12-30 18:03 . 2001-07-06 12:41 569344 ----a-r- c:\windows\system32\imagr5.dll
2010-12-30 18:03 . 2001-07-06 10:44 544768 ----a-r- c:\windows\system32\imagx5.dll
2010-12-30 18:03 . 2010-12-30 18:03 -------- d-----w- c:\program files\Common Files\Ahead
2010-12-30 18:03 . 2001-07-09 09:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe
2010-12-30 18:02 . 2010-12-30 18:03 -------- d-----w- c:\program files\Ahead
2010-12-30 13:17 . 2010-12-30 13:18 -------- d-----w- c:\documents and settings\Helmic\Data aplikací\VSO
2010-12-30 13:17 . 2010-12-30 13:17 -------- d-----w- c:\program files\VSO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-04 11:42 . 2009-07-21 10:36 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-04 11:42 . 2009-07-21 10:36 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-04 11:42 . 2009-07-21 10:36 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-23 22:03 . 2010-12-23 22:02 458816 ----a-w- C:\FaceIM.exe
2010-11-17 15:51 . 2010-11-16 09:44 193024 ----a-w- C:\winn27.exe
2010-11-16 23:09 . 2010-11-16 23:09 204800 ----a-w- C:\wlksk.exe
2010-11-16 05:11 . 2010-11-15 02:14 91136 ----a-w- C:\winnt7.exe
2010-11-12 22:36 . 2010-11-12 22:36 91136 ----a-w- C:\ws7.exe
2010-11-12 20:36 . 2010-11-12 20:36 91136 --sh--r- c:\documents and settings\Helmic\Data aplikací\juzjf.exe
2010-11-12 04:24 . 2010-11-12 04:24 180224 ----a-w- C:\QuickTime1.exe
2010-11-11 22:56 . 2010-11-11 22:56 180224 ----a-w- C:\winskd.exe
2010-11-10 22:36 . 2010-11-10 22:35 180224 ----a-w- C:\h32.exe
.

------- Sigcheck -------

[-] 2009-11-13 . B1C66D7B244FC4E2B034D50E86E4E991 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-11-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"="c:\program files\Miranda IM KP v5.0.8.5\launcher.exe" [2009-03-22 258048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-07-20 18670592]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-24 98304]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-19 202256]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-04-14 100352]

c:\documents and settings\Helmic\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0uupggb.exe [2010-11-16 60416]
a81xdnjef.exe [2010-11-13 60416]
brrhn60pk.exe [2010-11-13 60416]
jzzvllhx.exe [2010-11-14 60416]
rr081yjkfl.exe [2010-11-13 60416]
y3aavmmhyyt.exe [2010-11-14 60416]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-11-30 608584]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Místní vyhledávání.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Místní vyhledávání.lnk
backup=c:\windows\pss\Místní vyhledávání.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^0uupggb.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\0uupggb.exe
backup=c:\windows\pss\0uupggb.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^a81xdnjef.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\a81xdnjef.exe
backup=c:\windows\pss\a81xdnjef.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^brrhn60pk.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\brrhn60pk.exe
backup=c:\windows\pss\brrhn60pk.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^dttpffbr.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\dttpffbr.exe
backup=c:\windows\pss\dttpffbr.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^jzzvllhx.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\jzzvllhx.exe
backup=c:\windows\pss\jzzvllhx.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^rr081yjkfl.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\rr081yjkfl.exe
backup=c:\windows\pss\rr081yjkfl.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^y3aavmmhyyt.exe]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\y3aavmmhyyt.exe
backup=c:\windows\pss\y3aavmmhyyt.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
c:\documents and settings\Helmic\mns.exe \u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-13 07:45 135664 ----atw- c:\documents and settings\Helmic\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 08:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
2006-10-10 12:11 827392 ----a-w- c:\windows\vsnp325.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Software Informer]
2009-11-25 17:50 2011205 ----a-w- c:\program files\Software Informer\softinfo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SolidWorks_CheckForUpdates]
2009-03-19 23:30 7308584 ----a-w- c:\program files\Common Files\Manažer instalací SolidWorks\Scheduler\sldIMScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-30 15:29 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-06-19 13:21 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
2006-10-10 13:49 270336 ----a-w- c:\windows\tsnp325.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Miranda IM KP v5.0.8.5\\miranda32.exe"=
"c:\\Program Files\\Pidgin\\pidgin.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\BitLord2\\BitLord.exe"=
"c:\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\Helmic\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Documents and Settings\\Helmic\\Dokumenty\\Downloads\\P17535732.JPG-www.facebook.exe"= c:\\WINDOWS\\nvsvc32.exe
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1842:UDP"= 1842:UDP:Windows Media Format SDK (chrome.exe)
"1843:UDP"= 1843:UDP:Windows Media Format SDK (chrome.exe)
"1848:UDP"= 1848:UDP:Windows Media Format SDK (chrome.exe)
"1849:UDP"= 1849:UDP:Windows Media Format SDK (chrome.exe)

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.7.2009 11:14 691696]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [13.11.2009 8:53 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [13.11.2009 8:53 20560]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [13.11.2009 8:29 22328]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.5.2010 17:19 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [13.11.2009 8:38 1684736]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [19.3.2009 11:31 83240]
S3 hgfreuaf;hgfreuaf;\??\c:\windows\System32\Drivers\hgfreuaf.sys --> c:\windows\System32\Drivers\hgfreuaf.sys [?]
S3 pvudcdwq;pvudcdwq;\??\c:\windows\System32\Drivers\pvudcdwq.sys --> c:\windows\System32\Drivers\pvudcdwq.sys [?]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [7.2.2010 10:59 10251904]
S3 yvhgsnwd;yvhgsnwd;\??\c:\windows\System32\Drivers\yvhgsnwd.sys --> c:\windows\System32\Drivers\yvhgsnwd.sys [?]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 7:01 2799808]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - cpuz132
.
Obsah adresáře 'Naplánované úlohy'

2011-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-19 08:56]

2011-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-19 08:56]

2011-01-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-448539723-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

2011-01-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-448539723-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://fullarticles.net
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
URLSearchHooks-{a6e4a4eb-d169-4e99-8988-250fcbafe767} - (no file)
URLSearchHooks-{6c3a1de1-94ca-4ad6-acdf-c1324adc487b} - (no file)
Toolbar-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
Toolbar-{a6e4a4eb-d169-4e99-8988-250fcbafe767} - (no file)
Toolbar-{6c3a1de1-94ca-4ad6-acdf-c1324adc487b} - (no file)
WebBrowser-{7C5C0F58-E061-457D-9033-77307F5ED00C} - (no file)
WebBrowser-{A6E4A4EB-D169-4E99-8988-250FCBAFE767} - (no file)
WebBrowser-{6C3A1DE1-94CA-4AD6-ACDF-C1324ADC487B} - (no file)
HKLM-Run-zoule - c:\windows\system32\cazyp.exe
HKLM-Run-SessionInit - c:\documents and settings\Helmic\init.exe
MSConfigStartUp-SessionInit - c:\documents and settings\Helmic\init.exe
MSConfigStartUp-Windows Firewall - c:\docume~1\Helmic\LOCALS~1\Temp\lsass.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-27 22:00
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\windows\system32\SearchIndexer.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2011-01-27 22:04:15 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-27 21:04

Před spuštěním: Volných bajtů: 32 995 643 392
Po spuštění: Volných bajtů: 35 255 492 608

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 755F88B72EDBC9B8CA78360041266BE4

#6 Příspěvek od **motji** » 27 Led 2011 22:19

Nádhera, kde jste k tomu přišel?

Otestujte na www.virustotal.com
c:\windows\system32\winlogon.exe
C:\FaceIM.exe
C:\winn27.exe
C:\wlksk.exe
C:\winnt7.exe
C:\ws7.exe
C:\QuickTime1.exe
C:\winskd.exe
C:\h32.exe
-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT

-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

Blein · #7 Příspěvek od **Blein** » 27 Led 2011 23:08

#8 Příspěvek od **motji** » 28 Led 2011 10:43

Vy tu máte chovnou stanici breberek

. KOukám asi nějaká fotka z FCB,že?

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Collect::
C:\FaceIM.exe
C:\winn27.exe
C:\wlksk.exe
C:\winnt7.exe
C:\ws7.exe
C:\QuickTime1.exe
C:\winskd.exe
C:\h32.exe
 c:\WINDOWS\\nvsvc32.exe
c:\windows\System32\Drivers\hgfreuaf.sys 
c:\windows\System32\Drivers\pvudcdwq.sys
c:\windows\System32\Drivers\yvhgsnwd.sys
c:\documents and settings\Helmic\mns.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\y3aavmmhyyt.exe
c:\windows\pss\y3aavmmhyyt.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\rr081yjkfl.exe
c:\windows\pss\rr081yjkfl.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\jzzvllhx.exe
c:\windows\pss\jzzvllhx.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\dttpffbr.exe
c:\windows\pss\dttpffbr.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\brrhn60pk.exe
c:\windows\pss\brrhn60pk.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\a81xdnjef.exe
c:\windows\pss\a81xdnjef.exe
c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\0uupggb.exe
c:\windows\pss\0uupggb.exe
c:\documents and settings\Helmic\Data aplikací\juzjf.exe

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^0uupggb.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^a81xdnjef.exe]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Helmic\\Dokumenty\\Downloads\\P17535732.JPG-www.facebook.exe"=-
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^y3aavmmhyyt.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^rr081yjkfl.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^jzzvllhx.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^dttpffbr.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^brrhn60pk.exe]

Driver::
yvhgsnwd
pvudcdwq
hgfreuaf

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Tuto stránku znáte?
uStart Page = hxxp://fullarticles.net

Blein · #9 Příspěvek od **Blein** » 29 Led 2011 13:17

Jdu na ten CF

Tady je ten MBAM ten říká že je to cajk.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

28.1.2011 15:40:20
mbam-log-2011-01-28 (15-40-20).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 339868
Uplynulý čas: 1 hodina(y), 11 minuta(y), 7 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Blein · #10 Příspěvek od **Blein** » 29 Led 2011 13:38

ComboFix 11-01-27.01 - Helmic 29.01.2011 13:30:52.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1002 [GMT 1:00]
Spuštěný z: c:\documents and settings\Helmic\Plocha\cokoliv.com.exe
Použité ovládací přepínače :: c:\documents and settings\Helmic\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100722-0] *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

file zipped: c:\documents and settings\Helmic\Data aplikací\juzjf.exe
file zipped: C:\FaceIM.exe
file zipped: C:\h32.exe
file zipped: C:\QuickTime1.exe
file zipped: C:\winn27.exe
file zipped: C:\winnt7.exe
file zipped: C:\winskd.exe
file zipped: C:\wlksk.exe
file zipped: C:\ws7.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\FaceIM.exe
C:\h32.exe
C:\QuickTime1.exe
C:\winn27.exe
C:\winnt7.exe
C:\winskd.exe
C:\wlksk.exe
C:\ws7.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hgfreuaf
-------\Service_pvudcdwq
-------\Service_yvhgsnwd

((((((((((((((((((((((((( Soubory vytvořené od 2010-12-28 do 2011-01-29 )))))))))))))))))))))))))))))))
.

2011-01-12 18:00 . 2011-01-12 18:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\WinZip
2011-01-04 23:11 . 2011-01-26 17:26 -------- d-----w- c:\program files\CCleaner
2011-01-04 22:48 . 2011-01-04 22:48 -------- d-----w- C:\rsit
2010-12-30 18:06 . 2010-12-30 18:06 -------- d-----w- c:\documents and settings\Helmic\Data aplikací\Ahead
2010-12-30 18:03 . 2001-06-26 06:15 38912 ----a-r- c:\windows\system32\picn20.dll
2010-12-30 18:03 . 2001-07-06 16:24 283920 ----a-r- c:\windows\system32\ImagXpr5.dll
2010-12-30 18:03 . 2001-07-06 12:41 569344 ----a-r- c:\windows\system32\imagr5.dll
2010-12-30 18:03 . 2001-07-06 10:44 544768 ----a-r- c:\windows\system32\imagx5.dll
2010-12-30 18:03 . 2010-12-30 18:03 -------- d-----w- c:\program files\Common Files\Ahead
2010-12-30 18:03 . 2001-07-09 09:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe
2010-12-30 18:02 . 2010-12-30 18:03 -------- d-----w- c:\program files\Ahead
2010-12-30 13:17 . 2010-12-30 13:18 -------- d-----w- c:\documents and settings\Helmic\Data aplikací\VSO
2010-12-30 13:17 . 2010-12-30 13:17 -------- d-----w- c:\program files\VSO

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-29 11:05 . 2009-07-21 10:36 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-29 11:04 . 2009-07-21 10:36 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-29 11:04 . 2009-07-21 10:36 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-11-18 18:15 . 2009-11-13 07:19 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 20:36 . 2010-11-12 20:36 91136 --sha-r- c:\documents and settings\Helmic\Data aplikací\juzjf.exe
2010-11-09 14:52 . 2008-04-14 05:51 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-05 05:02 . 2008-04-14 05:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-11-05 05:02 . 2008-04-14 05:51 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-11-05 05:02 . 2008-04-14 05:50 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-11-05 04:59 . 2008-04-14 04:50 370176 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-04-13 21:27 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
.

------- Sigcheck -------

[-] 2009-11-13 . B1C66D7B244FC4E2B034D50E86E4E991 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-11-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-01-27_20.59.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-29 12:35 . 2011-01-29 12:35 16384 c:\windows\Temp\Perflib_Perfdata_604.dat
+ 2011-01-29 12:35 . 2011-01-29 12:35 16384 c:\windows\Temp\Perflib_Perfdata_1e0.dat
+ 2008-04-14 05:52 . 2010-11-03 13:12 46080 c:\windows\system32\tzchange.exe
- 2008-04-14 05:52 . 2010-06-21 14:46 46080 c:\windows\system32\tzchange.exe
+ 2009-11-13 07:43 . 2009-05-26 11:40 18296 c:\windows\system32\spmsg.dll
- 2009-11-13 07:43 . 2010-02-22 14:20 18296 c:\windows\system32\spmsg.dll
+ 2009-11-13 07:19 . 2010-10-11 14:59 45568 c:\windows\system32\dllcache\wab.exe
+ 2008-04-13 21:27 . 2010-11-02 15:17 40960 c:\windows\system32\dllcache\ndproxy.sys
+ 2009-11-13 07:19 . 2010-11-18 18:15 81920 c:\windows\system32\dllcache\isign32.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 81920 c:\windows\system32\dllcache\isign32.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 81920 c:\windows\system32\dllcache\ieencode.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 81920 c:\windows\system32\dllcache\ieencode.dll
- 2010-06-10 01:11 . 2010-06-10 01:11 49936 c:\windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe
+ 2011-01-28 02:03 . 2011-01-28 02:03 49936 c:\windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 23040 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 61440 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 27136 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 11264 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 86016 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 12288 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 4096 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-04-14 05:52 . 2010-11-05 05:02 627200 c:\windows\system32\urlmon.dll
- 2008-04-14 05:52 . 2010-09-09 14:23 627200 c:\windows\system32\urlmon.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 532480 c:\windows\system32\mstime.dll
- 2008-04-14 05:51 . 2008-04-14 05:51 532480 c:\windows\system32\mstime.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 449024 c:\windows\system32\mshtmled.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 449024 c:\windows\system32\mshtmled.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 251904 c:\windows\system32\iepeers.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 251904 c:\windows\system32\iepeers.dll
- 2009-11-13 08:10 . 2010-10-14 01:20 311584 c:\windows\system32\FNTCACHE.DAT
+ 2009-11-13 08:10 . 2011-01-28 02:22 311584 c:\windows\system32\FNTCACHE.DAT
+ 2008-04-14 05:52 . 2010-11-05 05:02 668160 c:\windows\system32\dllcache\wininet.dll
- 2008-04-14 05:52 . 2010-09-09 14:23 668160 c:\windows\system32\dllcache\wininet.dll
- 2008-04-14 05:52 . 2010-09-09 14:23 627200 c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-14 05:52 . 2010-11-05 05:02 627200 c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-14 05:51 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
- 2008-04-14 05:51 . 2008-04-14 05:51 249856 c:\windows\system32\dllcache\odbc32.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 532480 c:\windows\system32\dllcache\mstime.dll
- 2008-04-14 05:51 . 2008-04-14 05:51 532480 c:\windows\system32\dllcache\mstime.dll
+ 2009-11-13 07:19 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 102400 c:\windows\system32\dllcache\msjro.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 449024 c:\windows\system32\dllcache\mshtmled.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 449024 c:\windows\system32\dllcache\mshtmled.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 200704 c:\windows\system32\dllcache\msadox.dll
+ 2009-11-13 07:19 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 180224 c:\windows\system32\dllcache\msadomd.dll
+ 2009-11-13 07:19 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
+ 2009-11-13 07:19 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 536576 c:\windows\system32\dllcache\msado15.dll
+ 2009-11-13 07:19 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
- 2009-11-13 07:19 . 2008-04-14 05:51 143360 c:\windows\system32\dllcache\msadco.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 251904 c:\windows\system32\dllcache\iepeers.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 251904 c:\windows\system32\dllcache\iepeers.dll
+ 2008-04-14 05:37 . 2010-10-28 13:09 290048 c:\windows\system32\dllcache\atmfd.dll
+ 2008-04-14 05:37 . 2010-10-28 13:09 290048 c:\windows\system32\atmfd.dll
+ 2010-11-12 10:24 . 2010-11-12 10:24 884224 c:\windows\Installer\114bec2.msp
+ 2009-12-16 21:21 . 2011-01-28 02:03 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 409600 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 286720 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 249856 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 794624 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 135168 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-12-16 21:21 . 2010-10-14 01:03 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2009-12-16 21:21 . 2011-01-28 02:03 593920 c:\windows\Installer\{90110405-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-04-14 04:45 . 2010-10-26 13:58 1853312 c:\windows\system32\win32k.sys
- 2008-04-14 05:51 . 2010-09-09 14:23 1510912 c:\windows\system32\shdocvw.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 1510912 c:\windows\system32\shdocvw.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 3097088 c:\windows\system32\mshtml.dll
+ 2008-04-14 04:45 . 2010-10-26 13:58 1853312 c:\windows\system32\dllcache\win32k.sys
- 2008-04-14 05:51 . 2010-09-09 14:23 1510912 c:\windows\system32\dllcache\shdocvw.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 1510912 c:\windows\system32\dllcache\shdocvw.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 3097088 c:\windows\system32\dllcache\mshtml.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 1025024 c:\windows\system32\dllcache\browseui.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 1025024 c:\windows\system32\dllcache\browseui.dll
- 2008-04-14 05:51 . 2010-09-09 14:23 1025024 c:\windows\system32\browseui.dll
+ 2008-04-14 05:51 . 2010-11-05 05:02 1025024 c:\windows\system32\browseui.dll
+ 2010-09-17 05:04 . 2010-09-17 05:04 9401856 c:\windows\Installer\114bf11.msp
+ 2010-10-22 14:45 . 2010-10-22 14:45 8444928 c:\windows\Installer\114bef4.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43 1980416 c:\windows\Installer\114bede.msp
+ 2010-10-01 16:42 . 2010-10-01 16:42 5054464 c:\windows\Installer\114bed7.msp
+ 2010-12-06 14:02 . 2010-12-06 14:02 5518848 c:\windows\Installer\114bea9.msp
+ 2010-10-01 20:53 . 2010-10-01 20:53 4147712 c:\windows\Installer\114be94.msp
+ 2010-01-25 16:34 . 2011-01-04 16:20 37403080 c:\windows\system32\MRT.exe
+ 2010-10-14 15:57 . 2010-10-14 15:57 11189248 c:\windows\Installer\114bf09.msp
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"="c:\program files\Miranda IM KP v5.0.8.5\launcher.exe" [2009-03-22 258048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-07-20 18670592]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-24 98304]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-19 202256]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-04-14 100352]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-11-30 608584]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Místní vyhledávání.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Místní vyhledávání.lnk
backup=c:\windows\pss\Místní vyhledávání.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Helmic\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
c:\documents and settings\Helmic\mns.exe \u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-13 07:45 135664 ----atw- c:\documents and settings\Helmic\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 08:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
2006-10-10 12:11 827392 ----a-w- c:\windows\vsnp325.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Software Informer]
2009-11-25 17:50 2011205 ----a-w- c:\program files\Software Informer\softinfo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SolidWorks_CheckForUpdates]
2009-03-19 23:30 7308584 ----a-w- c:\program files\Common Files\Manažer instalací SolidWorks\Scheduler\sldIMScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-30 15:29 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-06-19 13:21 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
2006-10-10 13:49 270336 ----a-w- c:\windows\tsnp325.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Miranda IM KP v5.0.8.5\\miranda32.exe"=
"c:\\Program Files\\Pidgin\\pidgin.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\BitLord2\\BitLord.exe"=
"c:\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\Helmic\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1842:UDP"= 1842:UDP:Windows Media Format SDK (chrome.exe)
"1843:UDP"= 1843:UDP:Windows Media Format SDK (chrome.exe)
"1848:UDP"= 1848:UDP:Windows Media Format SDK (chrome.exe)
"1849:UDP"= 1849:UDP:Windows Media Format SDK (chrome.exe)

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.7.2009 11:14 691696]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [13.11.2009 8:53 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [13.11.2009 8:53 20560]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [13.11.2009 8:29 22328]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.5.2010 17:19 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [13.11.2009 8:38 1684736]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [19.3.2009 11:31 83240]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9.1.2010 15:14 38224]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [7.2.2010 10:59 10251904]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.9.2005 7:01 2799808]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - cpuz132
.
Obsah adresáře 'Naplánované úlohy'

2011-01-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-19 08:56]

2011-01-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-19 08:56]

2011-01-29 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-448539723-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

2011-01-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-448539723-725345543-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://fullarticles.net
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-29 13:35
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(716)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2011-01-29 13:38:05 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-01-29 12:38
ComboFix2.txt 2011-01-27 21:04

Před spuštěním: Volných bajtů: 34 755 473 408
Po spuštění: Volných bajtů: 34 759 069 696

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 1FFA25346BC295EA9A9EBCB632948DED

Blein · #11 Příspěvek od **Blein** » 29 Led 2011 13:43

Ad 1 Fotka z FCB, ano teď tam poslední dobou lítá vir, každej mě spamuje zprávama, ale ani na jeden odkaz jsem nekliknul havěť mám v PC delší dobu bohužel řeším až teď.
Ad 2 uStart Page = hxxp://fullarticles.net tohle neznám ani z doslechu.

#12 Příspěvek od **motji** » 29 Led 2011 15:22

Tu stránku Vám pak fixnu v HJT.
Tak to jsem si myslela, už to byl právě starší kousek, ted má zase FCB vir nové kamarády, ale není dobré to nechávat v počítači dlouho, sám jste viděl, kolik toho bylo

Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.

***********

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir

***********

Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázek

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázek

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy

ok

zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.

***********

Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech

***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?

Blein · #13 Příspěvek od **Blein** » 29 Led 2011 23:40

Logfile of random's system information tool 1.08 (written by random/random)
Run by Helmic at 2011-01-29 23:37:41
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 37 GB (10%) free of 382 GB
Total RAM: 2047 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:38:07, on 29.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\FixCamera.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Helmic\Dokumenty\Downloads\RSIT (2).exe
C:\Program Files\trend micro\Helmic.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Miranda IM] C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systemes SolidWorks Corp. - C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

--
End of file - 6613 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-448539723-725345543-1005.job
C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-448539723-725345543-1005.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\All Users\Data aplikací\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-06-19 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-10-30 1019336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-09-27 13918208]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-09-27 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-07-20 18670592]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-24 98304]
"FixCamera"=C:\WINDOWS\FixCamera.exe [2007-02-12 20480]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-06-19 202256]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"=C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe [2009-03-22 258048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-11-13 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\Documents and Settings\Helmic\mns.exe \u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
C:\WINDOWS\vsnp325.exe [2006-10-10 827392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Software Informer]
C:\Program Files\Software Informer\softinfo.exe [2009-11-25 2011205]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SolidWorks_CheckForUpdates]
C:\Program Files\Common Files\Manažer instalací SolidWorks\Scheduler\sldIMScheduler.exe [2009-03-20 7308584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-30 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-06-19 202256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
C:\WINDOWS\tsnp325.exe [2006-10-10 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Místní vyhledávání.lnk]
C:\PROGRA~1\WINDOW~4\WINDOW~1.EXE [2007-02-05 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Helmic^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.0.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2009-01-15 393216]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-11-25 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe"="C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Pidgin\pidgin.exe"="C:\Program Files\Pidgin\pidgin.exe:*:Enabled:Pidgin"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\BitLord2\BitLord.exe"="C:\Program Files\BitLord2\BitLord.exe:*:Enabled:Bitlord2"
"C:\BitLord\BitLord.exe"="C:\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe"="C:\Documents and Settings\Helmic\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe"="C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-01-29 23:37:41 ----D---- C:\rsit
2011-01-29 23:28:42 ----SHD---- C:\RECYCLER
2011-01-29 13:28:04 ----RASHD---- C:\cmdcons
2011-01-28 03:06:03 ----A---- C:\WINDOWS\system32\MRT.INI
2011-01-28 03:03:37 ----D---- C:\Config.Msi
2011-01-28 03:03:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2296199$
2011-01-28 03:03:00 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2011-01-28 03:02:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2011-01-28 03:02:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2443685$
2011-01-28 03:02:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2436673$
2011-01-28 03:02:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2011-01-28 03:02:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2011-01-28 03:02:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2416400$
2011-01-28 03:00:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$
2011-01-27 21:52:52 ----A---- C:\Boot.bak
2011-01-12 19:00:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\WinZip
2011-01-12 19:00:23 ----D---- C:\Program Files\WinZip
2011-01-05 00:11:20 ----D---- C:\Program Files\CCleaner
2010-12-30 19:06:48 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Ahead
2010-12-30 19:03:07 ----RA---- C:\WINDOWS\system32\picn20.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\ImagXpr5.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\imagx5.dll
2010-12-30 19:03:04 ----RA---- C:\WINDOWS\system32\imagr5.dll
2010-12-30 19:03:00 ----RA---- C:\WINDOWS\system32\NeroCheck.exe
2010-12-30 19:03:00 ----D---- C:\Program Files\Common Files\Ahead
2010-12-30 19:02:55 ----D---- C:\Program Files\Ahead
2010-12-30 14:17:52 ----D---- C:\Documents and Settings\Helmic\Data aplikací\VSO
2010-12-30 14:17:40 ----D---- C:\Program Files\VSO

======List of files/folders modified in the last 1 months======

2011-01-29 23:38:06 ----D---- C:\Program Files\trend micro
2011-01-29 23:37:52 ----D---- C:\WINDOWS\Prefetch
2011-01-29 23:36:59 ----AD---- C:\WINDOWS\Temp
2011-01-29 23:36:54 ----D---- C:\WINDOWS
2011-01-29 23:35:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-29 23:29:00 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Azureus
2011-01-29 23:28:42 ----D---- C:\WINDOWS\Debug
2011-01-29 15:25:32 ----SHD---- C:\System Volume Information
2011-01-29 15:25:32 ----D---- C:\WINDOWS\system32\Restore
2011-01-29 15:25:09 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-29 13:39:11 ----D---- C:\WINDOWS\system32\drivers
2011-01-29 13:35:28 ----A---- C:\WINDOWS\system.ini
2011-01-29 13:35:08 ----D---- C:\WINDOWS\system32\drivers\etc
2011-01-29 13:34:18 ----D---- C:\WINDOWS\system32\config
2011-01-29 13:32:27 ----D---- C:\WINDOWS\system32
2011-01-29 13:32:26 ----D---- C:\WINDOWS\AppPatch
2011-01-29 13:32:20 ----D---- C:\Program Files\Common Files
2011-01-29 13:28:11 ----RASH---- C:\boot.ini
2011-01-29 12:04:55 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2011-01-28 03:03:54 ----SHD---- C:\WINDOWS\Installer
2011-01-28 03:03:07 ----HD---- C:\WINDOWS\inf
2011-01-28 03:03:06 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-01-28 03:02:55 ----HD---- C:\WINDOWS\$hf_mig$
2011-01-28 03:00:59 ----D---- C:\Program Files\Outlook Express
2011-01-27 22:03:43 ----SD---- C:\WINDOWS\Tasks
2011-01-27 10:30:26 ----D---- C:\Program Files\Full Tilt Poker
2011-01-12 19:00:23 ----RD---- C:\Program Files
2011-01-10 16:30:04 ----D---- C:\Documents and Settings\Helmic\Data aplikací\Skype
2011-01-10 16:00:07 ----D---- C:\Documents and Settings\Helmic\Data aplikací\skypePM
2011-01-05 00:12:18 ----D---- C:\WINDOWS\Minidump
2011-01-04 21:59:04 ----D---- C:\Documents and Settings\Helmic\Data aplikací\.purple
2011-01-04 17:20:14 ----A---- C:\WINDOWS\system32\MRT.exe
2010-12-31 16:09:31 ----D---- C:\Documents and Settings\Helmic\Data aplikací\SMS posílač Treca

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdide;amdide; C:\WINDOWS\system32\DRIVERS\amdide.sys [2007-10-11 9096]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-07-21 691696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-11-25 4463104]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-07-20 5795328]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-05-25 142336]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbfilter;AMD USB Filter Driver; C:\WINDOWS\system32\DRIVERS\usbfilter.sys [2009-02-09 22328]
S3 aks4el2l;aks4el2l; C:\WINDOWS\system32\drivers\aks4el2l.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-09-27 7655872]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SNP325;USB PC Camera (SNPSTD325); C:\WINDOWS\system32\DRIVERS\snp325.sys [2007-04-03 10251904]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-11-25 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-30 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-07-21 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2011-01-29 214520]
R2 WSearch;Vyhledávání systému Windows; C:\WINDOWS\system32\SearchIndexer.exe [2007-02-05 300032]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
S2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-09-27 172100]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service; C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2009-03-19 83240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [2010-03-20 79360]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-09-23 2799808]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.08 2011-01-29 23:38:16

======Uninstall list======

-->MsiExec /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
325 USB PC Camera -->C:\Program Files\InstallShield Installation Information\{F9466082-90E9-4BE4-92F0-CF0AF195B0CF}\setup.exe -runfromtemp -l0x0009 -removeonly
ACE Mega CoDecS Pack-->"C:\Program Files\ACE Mega CoDecS Pack\unins000.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Aktualizace systému Windows XP (KB2141007)-->"C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB2345886)-->"C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB2467659)-->"C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB976749)-->"C:\WINDOWS\$NtUninstallKB976749$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB978207)-->"C:\WINDOWS\$NtUninstallKB978207$\spuninst\spuninst.exe"
Aktualizace systému Windows XP (KB980182)-->"C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB2378111)-->"C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB975558)-->"C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB978695)-->"C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení aplikace Windows Media Player (KB979402)-->"C:\WINDOWS\$NtUninstallKB979402_WM9$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2079403)-->"C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2115168)-->"C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2121546)-->"C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2160329)-->"C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2183461)-->"C:\WINDOWS\$NtUninstallKB2183461$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2229593)-->"C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2259922)-->"C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2279986)-->"C:\WINDOWS\$NtUninstallKB2279986$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2286198)-->"C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2296011)-->"C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2296199)-->"C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2347290)-->"C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2360131)-->"C:\WINDOWS\$NtUninstallKB2360131$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2360937)-->"C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2387149)-->"C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2416400)-->"C:\WINDOWS\$NtUninstallKB2416400$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2419632)-->"C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2423089)-->"C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2436673)-->"C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2440591)-->"C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB2443105)-->"C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aktualizace zabezpečení systému Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975562)-->"C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB976325)-->"C:\WINDOWS\$NtUninstallKB976325$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978542)-->"C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979482)-->"C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979559)-->"C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB979687)-->"C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB980195)-->"C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB980218)-->"C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB980436)-->"C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB981322)-->"C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB981349)-->"C:\WINDOWS\$NtUninstallKB981349$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB981852)-->"C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB981957)-->"C:\WINDOWS\$NtUninstallKB981957$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB981997)-->"C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB982132)-->"C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB982214)-->"C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB982381)-->"C:\WINDOWS\$NtUninstallKB982381$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB982665)-->"C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.exe"
Aktualizace zabezpečení systému Windows XP (KB982802)-->"C:\WINDOWS\$NtUninstallKB982802$\spuninst\spuninst.exe"
AMD Processor Driver-->C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x0005 -removeonly
AMD USB Filter Driver-->MsiExec.exe /X{DCB51FBC-68AD-42FF-8426-199F1FE2C4F5}
Any Video Converter 3.0.1-->"C:\Program Files\AnvSoft\Any Video Converter\unins000.exe"
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Ashampoo Burning Studio 10.0.4-->"C:\Program Files\Ashampoo\Ashampoo Burning Studio 10\unins000.exe"
ATI AVIVO Codecs-->MsiExec.exe /I{24A6F0B6-E6F3-46AE-BB7E-81D6AFA6E926}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
BitLord 1.1-->C:\Program Files\BitLord\uninst.exe
BitLord v2.0-->"C:\Program Files\BitLord2\unins000.exe"
Call of Duty Modern Warfare 2-->"C:\Hry\Modern Warfare 2\unins000.exe"
Call of Duty(R) 2-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D0A05794-48C2-4424-A15A-9F20FCFDD374} /l2057
Catalyst Control Center - Branding-->MsiExec.exe /I{8D7133DE-27D2-47E5-B248-4180278D32AA}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
DWGeditor-->MsiExec.exe /X{1B140425-1EA0-4AB8-BB31-1830C4A0A1F2}
edu-learning pro MS Office 2003 CZ-->MsiExec.exe /I{99032CFF-DBB0-4C9C-B03D-B922422F4A39}
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
Full Tilt Poker.Net-->C:\Program Files\Full Tilt Poker.Net\uninstall.exe
Full Tilt Poker-->C:\Program Files\Full Tilt Poker\uninstall.exe
GamePark-->"C:\Program Files\GamePark\unins000.exe"
Google Earth Plug-in-->MsiExec.exe /X{171E6C1E-B5FC-11DF-B115-005056C00008}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
GTK+ Runtime 2.14.7 rev a (odstranit)-->C:\Program Files\Common Files\GTK\2.0\uninst.exe
HD Tach version 3-->"C:\Program Files\Simpli Software\HD Tach\unins000.exe"
HD Tune 2.55-->"C:\Program Files\HD Tune\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP LaserJet P1000 series-->C:\Program Files\Avago-HP\{a2690156-091d-43f3-830c-29586015ba90}\uninstall.exe SYSTEMHORNET "C:\Program Files\Avago-HP\{a2690156-091d-43f3-830c-29586015ba90}"
HPSSupply-->MsiExec.exe /X{7902E313-FF0F-4493-ACB1-A8147B78DCD0}
HT Fireman CD/DVD Burner-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ADEBB98C-DCD0-4369-BC4A-71B342CF55B2}\Setup.exe" -l0x9
isoHunt Toolbar-->C:\PROGRA~1\isoHunt\UNWISE.EXE /U C:\PROGRA~1\isoHunt\INSTALL.LOG
Isohunt-vuze Toolbar-->C:\PROGRA~1\ISOHUN~1\UNWISE.EXE /U C:\PROGRA~1\ISOHUN~1\INSTALL.LOG
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}
jetAudio Basic-->C:\Program Files\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe -runfromtemp -l0x0005 -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB2416447)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M2416447\M2416447Uninstall.msp"
Microsoft .NET Framework 1.1 Security Update (KB979906)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M979906\M979906Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90120000-00A4-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110405-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual Studio 2005 Tools for Applications - ENU-->MsiExec.exe /X{D481EA96-2313-4A7C-98EE-710D1AF884AC}
Microsoft Visual Studio 2005 Tools for Applications - ENU-->MsiExec.exe /X{D481EA96-2313-4A7C-98EE-710D1AF884AC}
Miranda IM KenDASS Pack v5.0.8.5-->"C:\Program Files\Miranda IM KP v5.0.8.5\Uninstall\unins000.exe"
MITCalc 1.51-->"C:\Program Files\MITCalc\unins000.exe"
MrvlUsgTracking-->MsiExec.exe /I{02C85EC5-E864-4847-AF55-42730861004C}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
OpenOffice.org 3.0-->MsiExec.exe /I{564D0000-547B-4ED8-8070-85286CC8C9BF}
Oprava Hotfix systému Windows XP (KB2158563)-->"C:\WINDOWS\$NtUninstallKB2158563$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB2443685)-->"C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
Oprava Hotfix systému Windows XP (KB981793)-->"C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe"
oZone3D.Net FurMark v1.7.0-->"C:\Program Files\oZone3D\Benchmarks\FurMark_v1.7.0\unins000.exe"
PerformanceTest v7.0-->"C:\Program Files\PerformanceTest\unins000.exe"
Pidgin-->C:\Program Files\Pidgin\pidgin-uninst.exe
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|12.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x5 -removeonly
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\SETUP.EXE -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x5 -removeonly
RealUpgrade 1.0-->MsiExec.exe /I{F4F4F84E-804F-4E9A-84D7-C34283F0088F}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8894F19-59C8-38D2-8A75-36C0CCE56A5B} /qb+ REBOOTPROMPT=""
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SMS posílač Treca-->"C:\Program Files\SMS posílač Treca\unins000.exe"
Software Informer 1.0 BETA-->"C:\Program Files\Software Informer\unins000.exe"
SolidWorks 2009 SP03-->"C:\WINDOWS\SolidWorks\IM_20090-40300-1100-200\sldim\sldim.exe" /remove "C:\WINDOWS\SolidWorks\IM_20090-40300-1100-200\sldim\sldIM_installed.xml"
SolidWorks 2009 SP03-->MsiExec.exe /X{596A6DE0-EC3E-4A1F-81F1-6AE8648B645B}
SolidWorks eDrawings 2009-->MsiExec.exe /I{80BA07B3-537F-4189-92F7-26E2BA76095A}
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
TeamSpeak 3 Client-->"C:\Program Files\TeamSpeak 3 Client\uninstall.exe"
TorrentMan Toolbar-->C:\PROGRA~1\TORREN~1\UNWISE.EXE C:\PROGRA~1\TORREN~1\INSTALL.LOG
Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Ventrilo-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Video Converter-->MsiExec.exe /X{6DA3E438-338A-4568-0001-2F9BDBB695C5}
VSO Image Resizer 4.0.0.54-->"C:\Program Files\VSO\Image Resizer 4\unins000.exe"
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Desktop Search 3.01-->"C:\WINDOWS\$NtUninstallKB917013$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
WinZip 15.0-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}

======Security center information======

AV: avast! antivirus 4.8.1368 [VPS 100722-0] (outdated)

======System event log======

Computer Name: OV
Event Code: 62464
Message: UVD Information

Record Number: 31296
Source Name: ati2mtag
Time Written: 20110125014126.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 62464
Message: UVD Information

Record Number: 31295
Source Name: ati2mtag
Time Written: 20110125014126.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 62464
Message: UVD Information

Record Number: 31294
Source Name: ati2mtag
Time Written: 20110125014126.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 62464
Message: UVD Information

Record Number: 31293
Source Name: ati2mtag
Time Written: 20110125014126.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 62464
Message: UVD Information

Record Number: 31292
Source Name: ati2mtag
Time Written: 20110125014126.000000+060
Event Type: Informace
User:

=====Application event log=====

Computer Name: OV
Event Code: 0
Message:
Record Number: 5
Source Name: gupdate
Time Written: 20110125225227.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 0
Message:
Record Number: 4
Source Name: gupdate
Time Written: 20110125173423.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 1003
Message: Vyhledávací služba systému Windows byla spuštěna.

Record Number: 3
Source Name: Windows Search Service
Time Written: 20110125173357.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 1800
Message: Služba Centrum zabezpečení systému Windows byla spuštěna.

Record Number: 2
Source Name: SecurityCenter
Time Written: 20110125173350.000000+060
Event Type: Informace
User:

Computer Name: OV
Event Code: 0
Message:
Record Number: 1
Source Name: gupdate
Time Written: 20110125173347.000000+060
Event Type: Informace
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Co se týče běhu počítače, rozdíl nepoznám, je docela nabouchanej a rychlej, než starej, na jakej jsem byl zvyklej, ale avast mi už nic nehlásí, pravděpodobně je vše vyčištěno.

#14 Příspěvek od **motji** » 30 Led 2011 09:23

Odinstalujte Daemon tols toolbar

spusťte přejmenované HJT C:\Program Files\trend micro\Helmic.exe , má tuto ikonku

- Klikněte na "Do a system scan only"
- U řádku
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

- Dejte fajfku do čtverečku a zmáčkněte Fix checked

Otevřete si Poznámkový blok a zkopírujte do něj text

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]

-uložte jako (typ: všechny soubory) kde za název souboru zadáte "smazani.reg" bez uvozovek,
klikněte na uložit, pak na soubor standardně 2X klikněte a potvrďte dialogové okno.

doporučuji doinstalovat firewall, ten ve windows není nic moc.
http://www.viry.cz/forum/viewforum.php?f=41

Pokud nejsou problémy, je to vše

VIRY.CZ

Prosím o kontrolu logu

Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu