Lsass.exe mi bere polovinu procesoru

[matousik]

Dobrý den,
na obrazovce se mi asi před třemi týdny začal objevovat po zapnutí PC příkazový řádek a nadpis měl lsass.exe.
Mám zato, že tento proces mi bere snad více než 50% procesoru, protože ještě když se hláška neobjevovala, počítač běžel normalně.
Použil jsem program trojan remover a ten mi ho našel a podle jeho hlášení odstranil. Hláška se sice přestala objevovat, ale v procesech stále běží a výkon ukazuje stále na využití procesoru nad 50%, i když s počítačem nic nedělám.

Prosím o pomoc.

[Rudy]

Dejte log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

[matousik]

Zde je log (rozdělil jsem ho, protože dohromady přesahuje 60000 znaků):
Logfile of random's system information tool 1.08 (written by random/random)
Run by Admin at 2011-02-10 20:37:51
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (3%) free of 238 GB
Total RAM: 2046 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:38:03, on 10.2.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.exe
C:\dev\prog\bin\httpd.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\dev\prog\bin\httpd.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\PnkBstrA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Opera\opera.exe
C:\windows\SoftwareDistribution\Download\Install\windows-kb890830-v3.16-delta.exe
f:\5339ee8dbfecc002c9c24b49\mrtstub.exe
C:\windows\system32\MRT.exe
C:\Documents and Settings\Admin\Local Settings\Data aplikací\Opera\Opera\temporary_downloads\RSIT (4).exe
C:\Program Files\trend micro\Admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2626277
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66022
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=66022
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66022
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=66022
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
R3 - URLSearchHook: Media Star Toolbar - {dfabc5b5-039b-4865-979a-de31cdf3e351} - C:\Program Files\Media_Star\tbMedi.dll
F2 - REG:system.ini: Shell=Explorer.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\Program Files\Steam\UnDead.Injector.exe
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O2 - BHO: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof0.dll
O2 - BHO: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O2 - BHO: RadioBar Toolbar - {5B291E6C-9A74-4034-971B-A4B007A0B315} - C:\Program Files\RadioBar\toolbar.ni.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Bitlord Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor1.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Media Star Toolbar - {dfabc5b5-039b-4865-979a-de31cdf3e351} - C:\Program Files\Media_Star\tbMedi.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - (no file)
O3 - Toolbar: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: RadioBar Toolbar - {5B291E6C-9A74-4034-971B-A4B007A0B315} - C:\Program Files\RadioBar\toolbar.ni.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: Softonic-Eng7 Toolbar - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof0.dll
O3 - Toolbar: Bitlord Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor1.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll
O3 - Toolbar: Media Star Toolbar - {dfabc5b5-039b-4865-979a-de31cdf3e351} - C:\Program Files\Media_Star\tbMedi.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bandwidth Meter.lnk = ?
O4 - Global Startup: Monitor Apache Servers.lnk = C:\dev\prog\bin\ApacheMonitor.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Strike%20Ball%203/Images/stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Magic%20Ball%202%20New%20Worlds/Images/armhelper.ocx
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.co ... 4.16.0.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O18 - Protocol: toolbarchrome - {718733BC-AD64-4E5F-AC18-A85FBD75D54D} - C:\Program Files\RadioBar\toolbar.ni.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\dev\prog\bin\httpd.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - (no file)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Zwunzi Service - Unknown owner - C:\Documents and Settings\All Users\Data aplikací\Zwunzi\zwunzi141.exe

--
End of file - 13713 bytes

======Scheduled tasks folder======

C:\windows\tasks\AppleSoftwareUpdate.job
C:\windows\tasks\RegistryBooster.job
C:\windows\tasks\Scheduled Update for Ask Toolbar.job
C:\windows\tasks\User_Feed_Synchronization-{127575F9-27B8-448F-A31B-9E5890722031}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]
Dealio Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngin0.dll [2011-01-27 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
Softonic-Eng7 Toolbar - C:\Program Files\Softonic-Eng7\tbSof0.dll [2010-10-18 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]
Sigma Team Toolbar - C:\Program Files\Sigma_Team\tbSig0.dll [2007-12-10 1510424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B291E6C-9A74-4034-971B-A4B007A0B315}]
RadioBar Toolbar - C:\Program Files\RadioBar\toolbar.ni.dll [2010-01-11 451808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
Bitlord Toolbar - C:\Program Files\TorrentMan\tbTor1.dll [2011-01-27 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
uTorrentBar Toolbar - C:\Program Files\uTorrentBar\tbuTo1.dll [2010-12-25 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar BHO - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll [2010-03-24 549208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dfabc5b5-039b-4865-979a-de31cdf3e351}]
Media Star Toolbar - C:\Program Files\Media_Star\tbMedi.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} -
{5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - Sigma Team Toolbar - C:\Program Files\Sigma_Team\tbSig0.dll [2007-12-10 1510424]
{855F3B16-6D32-4fe6-8A56-BBB695989046} -
{5B291E6C-9A74-4034-971B-A4B007A0B315} - RadioBar Toolbar - C:\Program Files\RadioBar\toolbar.ni.dll [2010-01-11 451808]
{D4027C7F-154A-4066-A1AD-4243D8127440} -
{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - Softonic-Eng7 Toolbar - C:\Program Files\Softonic-Eng7\tbSof0.dll [2010-10-18 3908192]
{7c5c0f58-e061-457d-9033-77307f5ed00c} - Bitlord Toolbar - C:\Program Files\TorrentMan\tbTor1.dll [2011-01-27 3911776]
{32099AAC-C132-4136-9E9A-4E364A424E17} -
{8dcb7100-df86-4384-8842-8fa844297b3f} - @C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll [2010-03-24 549208]
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - uTorrentBar Toolbar - C:\Program Files\uTorrentBar\tbuTo1.dll [2010-12-25 3911776]
{dfabc5b5-039b-4865-979a-de31cdf3e351} - Media Star Toolbar - C:\Program Files\Media_Star\tbMedi.dll [2010-12-09 3911776]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngin0.dll [2011-01-27 3911776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2011-01-13 3396624]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\crss.exe]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe [2005-07-25 1397760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe --auto-start []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSWUpdate]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe [2005-10-11 1961984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /installquiet []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\\Phone\Skype.exe [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
C:\PROGRA~1\PANASO~1\LUMIXS~1\PHLEAU~1.EXE [2006-09-29 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SamSs"=2
"PnkBstrA"=2
"Microsoft SharePoint Workspace Audit Service"=3
"InCDsrvR"=2
"InCDsrv"=2
"ICQ Service"=2
"Hamachi2Svc"=2

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Bandwidth Meter.lnk - C:\windows\Installer\{297849A8-EEC6-4ABA-AAE5-C66A093FEDE3}\_4AFD87D2B7DF2077867725.exe
Monitor Apache Servers.lnk - C:\dev\prog\bin\ApacheMonitor.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\windows\system32\WgaLogon.dll [2008-09-05 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1
"NoResolveTrack"=1
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Documents and Settings\Fanda\Plocha\Skype.exe"="C:\Documents and Settings\Fanda\Plocha\Skype.exe:*:Disabled:Skype. Take a deep breath "
"C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Disabled:Nero ShowTime"
"D:\Kulic\Kulic.exe"="D:\Kulic\Kulic.exe:*:Enabled:Kulic - Win32 Allegro game"
"C:\Program Files\Warcraft III\Warcraft III.exe"="C:\Program Files\Warcraft III\Warcraft III.exe:*:Disabled:Warcraft III"
"C:\Program Files\Ubisoft\Gearbox Software\BrothersInArmsEiB\System\EiB.exe"="C:\Program Files\Ubisoft\Gearbox Software\BrothersInArmsEiB\System\EiB.exe:*:Enabled:Brothers In Arms Earned In Blood"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\Resonation\Resonation.exe"="C:\Program Files\Resonation\Resonation.exe:*:Enabled:Resonation"
"C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\THQ\Company of Heroes\BugReport\BugReport.exe"="C:\Program Files\THQ\Company of Heroes\BugReport\BugReport.exe:*:Disabled:BugReport"
"C:\Program Files\THQ\Pandemic Studios\Full Spectrum Warrior\Launcher.locked"="C:\Program Files\THQ\Pandemic Studios\Full Spectrum Warrior\Launcher.locked:*:Enabled:Launcher"
"C:\Program Files\Netdevil\Warmonger\Binaries\WMGame.exe"="C:\Program Files\Netdevil\Warmonger\Binaries\WMGame.exe:*:Enabled:WMGame"
"D:\RUNES OF MAGIC\FOGDL-RUNES_OF_MAGIC_2_0_6_1834.EXE"="D:\RUNES OF MAGIC\FOGDL-RUNES_OF_MAGIC_2_0_6_1834.EXE:*:Enabled:FOGDL-RUNES_OF_MAGIC_2_0_6_1834"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\EA Games\Battlefield 2\BF2.exe"="C:\Program Files\EA Games\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\Program Files\EA Games\Battlefield 2\bf2_w32ded.exe"="C:\Program Files\EA Games\Battlefield 2\bf2_w32ded.exe:*:Enabled:bf2_w32ded"
"C:\Program Files\Activision\Prototype\prototypef.exe"="C:\Program Files\Activision\Prototype\prototypef.exe:*:Enabled:Prototype(TM)"
"C:\Program Files\CAPCOM\RESIDENT EVIL 5\RE5DX9.EXE"="C:\Program Files\CAPCOM\RESIDENT EVIL 5\RE5DX9.EXE:*:Enabled:RESIDENT EVIL 5 (DX9)"
"C:\Program Files\CAPCOM\RESIDENT EVIL 5\RE5DX10.EXE"="C:\Program Files\CAPCOM\RESIDENT EVIL 5\RE5DX10.EXE:*:Enabled:RESIDENT EVIL 5 (DX10)"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\HLSW\hlsw.exe"="C:\Program Files\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"C:\Program Files\Disney Interactive Studios\Split Second\SplitSecond.exe"="C:\Program Files\Disney Interactive Studios\Split Second\SplitSecond.exe:*:Enabled:Split/Second"
"C:\Program Files\Valve\Half-Life 2\hl2.exe"="C:\Program Files\Valve\Half-Life 2\hl2.exe:*:Enabled:HL2_1"
"C:\Program Files\Valve\Half-Life 2 Episode One\hl2.exe"="C:\Program Files\Valve\Half-Life 2 Episode One\hl2.exe:*:Enabled:HL2_2"
"C:\Program Files\Valve\Half-Life 2 Episode Two\hl2.exe"="C:\Program Files\Valve\Half-Life 2 Episode Two\hl2.exe:*:Enabled:HL2_3"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Gmod11\hl2.exe"="C:\Program Files\Gmod11\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Game.exe"="C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Game.exe:*:Enabled:Rainbow Six Vegas"
"C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Launcher.exe"="C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Launcher.exe:*:Enabled:Rainbow Six Vegas Updater"
"C:\Documents and Settings\Matous\Plocha\Killing Floor\System\KillingFloor.exe"="C:\Documents and Settings\Matous\Plocha\Killing Floor\System\KillingFloor.exe:*:Enabled:KillingFloor"
"C:\Program Files\TmUnitedForever\TmForever.exe"="C:\Program Files\TmUnitedForever\TmForever.exe:*:Enabled:TmForever"
"C:\Documents and Settings\Matous\Plocha\Multiwina\multiwinia.exe"="C:\Documents and Settings\Matous\Plocha\Multiwina\multiwinia.exe:*:Enabled:Multiwinia"
"C:\Documents and Settings\Matous\Plocha\KillingFloor_v1011_NoSteam\Killing Floor\System\KillingFloor.exe"="C:\Documents and Settings\Matous\Plocha\KillingFloor_v1011_NoSteam\Killing Floor\System\KillingFloor.exe:*:Enabled:KillingFloor"
"C:\Program Files\Microsoft Office\Office14\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace"
"C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote"
"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game"="C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game:*:Enabled:Command & Conquer™ 4"
"C:\Documents and Settings\Matous\Plocha\Mystiq.org Counter-Strike 1.6\hl.exe"="C:\Documents and Settings\Matous\Plocha\Mystiq.org Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\matousik4\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\matousik4\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steamapps\matousik4\team fortress 2\hl2.exe"="C:\Program Files\Steam\steamapps\matousik4\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steam.exe"="C:\Program Files\Steam\steam.exe:*:Enabled:Steam"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB.exe"
"C:\Program Files\Steam\steamapps\matousik4\half-life 2 deathmatch\hl2.exe"="C:\Program Files\Steam\steamapps\matousik4\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steamapps\matousik4\team fortress 2 meet the scout\smp.exe"="C:\Program Files\Steam\steamapps\matousik4\team fortress 2 meet the scout\smp.exe:*:Enabled:Team Fortress 2: Meet the Scout"
"C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\Program Files\Steam\steamapps\matousik4\zombie panic! source\hl2.exe"="C:\Program Files\Steam\steamapps\matousik4\zombie panic! source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steamapps\common\alien swarm\swarm.exe"="C:\Program Files\Steam\steamapps\common\alien swarm\swarm.exe:*:Enabled:Alien Swarm"
"C:\Program Files\Steam\steamapps\common\alien swarm\srcds.exe"="C:\Program Files\Steam\steamapps\common\alien swarm\srcds.exe:*:Enabled:Alien Swarm Dedicated Server"
"C:\Program Files\Steam\steamapps\common\the ball demo\Binaries\Win32\TheBall.exe"="C:\Program Files\Steam\steamapps\common\the ball demo\Binaries\Win32\TheBall.exe:*:Enabled:The Ball Demo"
"C:\Program Files\Steam\steamapps\matousik6\garrysmod\hl2.exe"="C:\Program Files\Steam\steamapps\matousik6\garrysmod\hl2.exe:*:Enabled:hl2"
"C:\Program Files\TorrentBitch\TorrentBitch.exe"="C:\Program Files\TorrentBitch\TorrentBitch.exe:*:Enabled:TorrentBitch"
"C:\Program Files\Steam\steamapps\matousik4\garrysmod\hl2.exe"="C:\Program Files\Steam\steamapps\matousik4\garrysmod\hl2.exe:*:Enabled:Garry's Mod"
"C:\Program Files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboardingGame.exe"="C:\Program Files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboardingGame.exe:*:Enabled:Shaun White Snowboarding Game"
"C:\Program Files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboarding.exe"="C:\Program Files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboarding.exe:*:Enabled:Shaun White Snowboarding Update"
"C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe"="C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe:*:Enabled:Battlefield 2142"
"C:\Program Files\Steam\steamapps\matousik\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\matousik\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source"
"C:\Program Files\Steam\steamapps\matousik\team fortress 2\hl2.exe"="C:\Program Files\Steam\steamapps\matousik\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Steam\steamapps\matousik6\synergy\hl2.exe"="C:\Program Files\Steam\steamapps\matousik6\synergy\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"
"C:\Riot Games\League of Legends\air\LolClient.exe"="C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Riot Games\League of Legends\game\League of Legends.exe"="C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\Program Files\Steam\steamapps\common\left 4 dead\srcds.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead\srcds.exe:*:Enabled:Left 4 Dead Dedicated Server"
"C:\Documents and Settings\Vera\Plocha\Skype.exe"="C:\Documents and Settings\Vera\Plocha\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\Steam\steamapps\matousik\zombie panic! source\hl2.exe"="C:\Program Files\Steam\steamapps\matousik\zombie panic! source\hl2.exe:*:Enabled:Zombie Panic Source"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[matousik]

2. část logu:

======List of files/folders created in the last 3 months======

2011-02-10 20:36:20 ----HDC---- C:\windows\$NtUninstallKB2476687$
2011-02-10 20:36:07 ----HDC---- C:\windows\$NtUninstallKB2478960$
2011-02-10 20:35:49 ----D---- C:\windows\LastGood
2011-02-10 19:53:20 ----D---- C:\Program Files\trend micro
2011-02-10 19:53:19 ----DC---- C:\rsit
2011-02-10 15:23:52 ----A---- C:\windows\system32\SETDC.tmp
2011-02-10 15:23:51 ----A---- C:\windows\system32\SETDB.tmp
2011-02-10 15:23:50 ----A---- C:\windows\system32\SETE0.tmp
2011-02-10 15:23:50 ----A---- C:\windows\system32\SETDA.tmp
2011-02-10 15:23:50 ----A---- C:\windows\system32\SETD6.tmp
2011-02-10 15:23:50 ----A---- C:\windows\system32\SETD5.tmp
2011-02-07 16:11:58 ----DC---- C:\PHP
2011-02-07 15:55:09 ----DC---- C:\dev
2011-02-02 18:02:47 ----D---- C:\Documents and Settings\Admin\Data aplikací\Ubisoft
2011-02-02 16:44:41 ----D---- C:\Documents and Settings\Admin\Data aplikací\LolClient
2011-02-02 16:27:21 ----DC---- C:\Riot Games
2011-02-02 15:08:26 ----D---- C:\Program Files\League of legends
2011-02-02 15:08:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2011-02-02 15:07:38 ----D---- C:\Program Files\Pando Networks
2011-01-30 14:00:55 ----A---- C:\windows\system32\drivers\AmdLLD.sys
2011-01-30 14:00:54 ----D---- C:\Program Files\AMD
2011-01-30 13:58:07 ----A---- C:\windows\system32\XAudio2_7.dll
2011-01-30 13:58:07 ----A---- C:\windows\system32\XAPOFX1_5.dll
2011-01-30 13:58:07 ----A---- C:\windows\system32\xactengine3_7.dll
2011-01-30 13:58:06 ----A---- C:\windows\system32\d3dcsx_43.dll
2011-01-30 13:58:06 ----A---- C:\windows\system32\D3DCompiler_43.dll
2011-01-30 13:58:05 ----A---- C:\windows\system32\d3dx11_43.dll
2011-01-30 13:58:05 ----A---- C:\windows\system32\d3dx10_43.dll
2011-01-30 13:58:03 ----A---- C:\windows\system32\D3DX9_43.dll
2011-01-30 13:03:18 ----D---- C:\Program Files\Aliens vs Predator 2010
2011-01-28 15:43:56 ----A---- C:\windows\UC.PIF
2011-01-28 15:43:56 ----A---- C:\windows\RAR.PIF
2011-01-28 15:43:56 ----A---- C:\windows\PKZIP.PIF
2011-01-28 15:43:56 ----A---- C:\windows\PKUNZIP.PIF
2011-01-28 15:43:56 ----A---- C:\windows\NOCLOSE.PIF
2011-01-28 15:43:56 ----A---- C:\windows\LHA.PIF
2011-01-28 15:43:56 ----A---- C:\windows\ARJ.PIF
2011-01-28 15:43:55 ----DC---- C:\totalcmd
2011-01-28 15:43:55 ----D---- C:\Documents and Settings\Admin\Data aplikací\GHISLER
2011-01-28 14:28:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\POPWWPROFILES
2011-01-16 18:02:46 ----D---- C:\Program Files\Electronic Arts
2011-01-16 10:48:17 ----AC---- C:\DARE.INI
2011-01-16 10:26:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Ubisoft
2011-01-12 17:53:38 ----HDC---- C:\windows\$NtUninstallKB2419632$
2011-01-02 16:54:54 ----D---- C:\Program Files\Media_Star
2011-01-02 16:53:54 ----D---- C:\Program Files\TorrentBitch
2011-01-02 16:53:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\TorrentBitch
2011-01-02 16:53:54 ----D---- C:\Documents and Settings\Admin\Data aplikací\TorrentBitch
2011-01-02 16:44:22 ----D---- C:\Program Files\Anywhere PE Viewer 0.1.7
2010-12-25 20:45:32 ----D---- C:\Program Files\MSPress
2010-12-25 20:42:28 ----A---- C:\windows\autorun.INI
2010-12-25 20:39:19 ----DC---- C:\Programming Microsoft .NET
2010-12-25 18:31:54 ----D---- C:\Documents and Settings\Admin\Data aplikací\Get from YouTube
2010-12-25 18:31:45 ----D---- C:\Documents and Settings\Admin\Data aplikací\Free Audio Editor
2010-12-22 18:21:12 ----D---- C:\Program Files\The KMPlayer
2010-12-22 17:34:44 ----D---- C:\Documents and Settings\Admin\Data aplikací\YouTube Downloader
2010-12-21 21:26:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Solidshield
2010-12-20 11:52:38 ----A---- C:\windows\system32\SETE3.tmp
2010-12-19 20:56:22 ----D---- C:\Documents and Settings\Admin\Data aplikací\Systweak
2010-12-18 20:14:23 ----D---- C:\Program Files\GameSpy
2010-12-18 18:12:07 ----N---- C:\windows\system32\spmsg2.dll
2010-12-18 18:12:01 ----HDC---- C:\windows\$NtUninstallXPSEPSCLP$
2010-12-18 17:38:31 ----D---- C:\Program Files\GCF.NCF storage
2010-12-18 12:49:29 ----D---- C:\Documents and Settings\Admin\Data aplikací\Simply Super Software
2010-12-17 22:35:11 ----D---- C:\Documents and Settings\Admin\Data aplikací\NVIDIA
2010-12-17 22:35:03 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\DSS
2010-12-17 22:31:36 ----A---- C:\Documents and Settings\Admin\Data aplikací\PnkBstrK.sys
2010-12-17 22:31:09 ----A---- C:\windows\system32\pbsvc_moh.exe
2010-12-17 21:50:31 ----D---- C:\Program Files\Astroburn Lite
2010-12-17 21:49:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\Astroburn Lite
2010-12-17 21:49:56 ----D---- C:\Documents and Settings\Admin\Data aplikací\Astroburn Lite
2010-12-17 21:41:38 ----D---- C:\Documents and Settings\Admin\Data aplikací\DAEMON Tools Lite
2010-12-17 15:51:51 ----D---- C:\Documents and Settings\Admin\Data aplikací\Media Player Classic
2010-12-17 15:04:27 ----D---- C:\Program Files\uTorrentBar
2010-12-17 15:04:24 ----DC---- C:\extensions
2010-12-16 21:50:51 ----D---- C:\Program Files\SystemRequirementsLab
2010-12-16 16:09:58 ----HDC---- C:\windows\$NtUninstallKB2296199$
2010-12-16 16:09:51 ----HDC---- C:\windows\$NtUninstallKB2443105$
2010-12-16 16:09:29 ----HDC---- C:\windows\$NtUninstallKB2440591$
2010-12-16 16:09:24 ----HDC---- C:\windows\$NtUninstallKB2443685$
2010-12-16 16:09:20 ----HDC---- C:\windows\$NtUninstallKB2436673$
2010-12-16 16:09:12 ----HDC---- C:\windows\$NtUninstallKB2423089$
2010-12-15 22:08:04 ----HDC---- C:\windows\$NtUninstallKB2467659$
2010-12-14 16:51:10 ----D---- C:\Documents and Settings\Admin\Data aplikací\Uniblue
2010-12-12 21:16:11 ----D---- C:\Documents and Settings\Admin\Data aplikací\WinRAR
2010-12-12 18:56:48 ----D---- C:\Documents and Settings\Admin\Data aplikací\PriceGong
2010-12-12 18:45:50 ----D---- C:\Documents and Settings\Admin\Data aplikací\skypePM
2010-12-12 18:33:09 ----D---- C:\Documents and Settings\Admin\Data aplikací\Telefónica Móviles
2010-12-12 18:17:16 ----D---- C:\Documents and Settings\Admin\Data aplikací\Motive
2010-12-10 17:45:42 ----D---- C:\windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP
2010-12-10 17:22:35 ----D---- C:\Program Files\Common Files\BioWare
2010-12-08 17:48:08 ----A---- C:\windows\system32\ztvunrar36.dll
2010-12-08 17:48:08 ----A---- C:\windows\system32\ztvunace26.dll
2010-12-08 17:48:08 ----A---- C:\windows\system32\ztvcabinet.dll
2010-12-08 17:48:08 ----A---- C:\windows\system32\UNRAR3.dll
2010-12-08 17:48:08 ----A---- C:\windows\system32\unacev2.dll
2010-12-08 17:48:05 ----D---- C:\Program Files\Trojan Remover
2010-12-08 17:48:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Simply Super Software
2010-12-08 17:16:54 ----A---- C:\windows\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt
2010-12-08 16:19:37 ----A---- C:\windows\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt
2010-12-08 16:18:24 ----A---- C:\windows\system32\drivers\ewusbnet.sys
2010-12-08 16:18:24 ----A---- C:\windows\system32\drivers\ewusbmdm.sys
2010-12-08 16:18:24 ----A---- C:\windows\system32\drivers\ewusbdev.sys
2010-12-08 16:18:24 ----A---- C:\windows\system32\drivers\ewdcsc.sys
2010-12-08 16:18:11 ----D---- C:\Program Files\O2
2010-12-07 18:05:05 ----A---- C:\windows\system32\drivers\point32.sys
2010-12-07 11:18:44 ----A---- C:\windows\disneysy.ini
2010-12-06 07:08:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2010-12-05 17:29:20 ----DC---- C:\N360_BACKUP
2010-12-05 16:37:04 ----D---- C:\Program Files\Symantec
2010-12-02 17:37:44 ----D---- C:\Program Files\WinPcap
2010-12-02 17:37:41 ----DC---- C:\BandwidthMeter
2010-12-01 16:01:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sony
2010-12-01 16:01:44 ----D---- C:\Program Files\Sony
2010-11-25 21:33:22 ----HDC---- C:\windows\$NtUninstallKB2387149$
2010-11-25 21:33:16 ----HDC---- C:\windows\$NtUninstallKB2279986$
2010-11-25 21:33:11 ----HDC---- C:\windows\$NtUninstallKB982214$
2010-11-25 21:33:05 ----HDC---- C:\windows\$NtUninstallKB2345886$
2010-11-25 21:32:59 ----HDC---- C:\windows\$NtUninstallKB2259922$
2010-11-25 21:32:55 ----HDC---- C:\windows\$NtUninstallKB2296011$
2010-11-25 21:32:50 ----HDC---- C:\windows\$NtUninstallKB2115168$
2010-11-25 21:32:27 ----HDC---- C:\windows\$NtUninstallKB975558_WM8$
2010-11-25 21:32:18 ----HDC---- C:\windows\$NtUninstallKB2378111_WM9$
2010-11-25 21:32:11 ----HDC---- C:\windows\$NtUninstallKB2229593$
2010-11-25 21:32:04 ----HDC---- C:\windows\$NtUninstallKB982132$
2010-11-25 21:31:58 ----HDC---- C:\windows\$NtUninstallKB2347290$
2010-11-25 21:31:45 ----HDC---- C:\windows\$NtUninstallKB981852$
2010-11-25 21:31:35 ----HDC---- C:\windows\$NtUninstallKB2079403$
2010-11-25 21:26:46 ----HDC---- C:\windows\$NtUninstallKB979687$
2010-11-25 21:26:40 ----HDC---- C:\windows\$NtUninstallKB2121546$
2010-11-25 21:20:09 ----HDC---- C:\windows\$NtUninstallKB980436$
2010-11-25 21:20:04 ----HDC---- C:\windows\$NtUninstallKB981322$
2010-11-25 21:19:42 ----HDC---- C:\windows\$NtUninstallKB2286198$
2010-11-25 21:19:27 ----HDC---- C:\windows\$NtUninstallKB981957$
2010-11-25 21:19:11 ----HDC---- C:\windows\$NtUninstallKB981997$
2010-11-25 21:18:11 ----HDC---- C:\windows\$NtUninstallKB2141007$
2010-11-25 21:18:07 ----HDC---- C:\windows\$NtUninstallKB2158563$
2010-11-25 21:17:29 ----HDC---- C:\windows\$NtUninstallKB982665$
2010-11-25 21:17:17 ----HDC---- C:\windows\$NtUninstallKB2360937$
2010-11-25 16:33:47 ----D---- C:\windows\system32\NtmsData

======List of files/folders modified in the last 3 months======

2011-02-10 20:37:58 ----D---- C:\windows\Prefetch
2011-02-10 20:36:56 ----D---- C:\windows\Temp
2011-02-10 20:36:49 ----A---- C:\windows\system32\MRT.exe
2011-02-10 20:36:45 ----HD---- C:\windows\inf
2011-02-10 20:36:44 ----D---- C:\WINDOWS
2011-02-10 20:36:41 ----RSHDC---- C:\windows\system32\dllcache
2011-02-10 20:36:40 ----D---- C:\windows\system32
2011-02-10 20:36:40 ----D---- C:\Program Files\Internet Explorer
2011-02-10 20:36:32 ----D---- C:\windows\ie8updates
2011-02-10 20:36:25 ----HD---- C:\windows\$hf_mig$
2011-02-10 20:36:23 ----A---- C:\windows\imsins.BAK
2011-02-10 20:33:22 ----D---- C:\Program Files\Steam
2011-02-10 19:53:20 ----RD---- C:\Program Files
2011-02-10 19:38:14 ----D---- C:\Documents and Settings\Admin\Data aplikací\Skype
2011-02-10 19:06:57 ----D---- C:\windows\system32\CatRoot2
2011-02-10 18:11:52 ----A---- C:\windows\system32\PnkBstrB.exe
2011-02-10 18:10:09 ----D---- C:\Program Files\Zrychleni Pocitace
2011-02-10 15:45:29 ----RSD---- C:\windows\assembly
2011-02-10 15:44:33 ----D---- C:\windows\system32\DirectX
2011-02-10 15:43:44 ----A---- C:\windows\system32\pbsvc.exe
2011-02-10 15:43:32 ----SHD---- C:\windows\Installer
2011-02-10 15:43:30 ----SHDC---- C:\Config.Msi
2011-02-10 15:28:11 ----D---- C:\Program Files\Activision
2011-02-09 21:19:04 ----A---- C:\windows\SchedLgU.Txt
2011-02-07 16:58:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-02-06 20:42:26 ----D---- C:\Program Files\Ubisoft
2011-02-02 17:42:18 ----HD---- C:\Program Files\InstallShield Installation Information
2011-02-01 14:58:33 ----D---- C:\Program Files\Opera
2011-01-30 14:00:57 ----D---- C:\windows\system32\drivers
2011-01-30 12:52:33 ----A---- C:\windows\NeroDigital.ini
2011-01-30 06:43:12 ----D---- C:\Documents and Settings\Admin\Data aplikací\uTorrent
2011-01-28 16:02:38 ----D---- C:\Program Files\Common Files
2011-01-28 16:02:37 ----SHD---- C:\System Volume Information
2011-01-28 16:01:35 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-01-28 15:47:04 ----D---- C:\windows\WinSxS
2011-01-28 14:34:57 ----A---- C:\windows\level.ini
2011-01-28 14:25:08 ----A---- C:\windows\tmp2Level.ini
2011-01-27 21:07:02 ----SD---- C:\windows\Downloaded Program Files
2011-01-27 21:06:25 ----D---- C:\Program Files\ConduitEngine
2011-01-27 16:35:46 ----RD---- C:\Program Files\Skype
2011-01-18 17:48:03 ----A---- C:\windows\system32\PnkBstrA.exe
2011-01-18 17:35:44 ----A---- C:\windows\system32\CmdLineExt.dll
2011-01-18 13:52:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\CanonIJPLM
2011-01-16 10:39:48 ----D---- C:\Documents and Settings\Admin\Data aplikací\InstallShield
2011-01-13 09:47:32 ----A---- C:\windows\system32\aswBoot.exe
2011-01-02 18:07:25 ----D---- C:\Documents and Settings\Admin\Data aplikací\Activision
2010-12-25 15:32:08 ----D---- C:\windows\system32\Restore
2010-12-25 15:13:18 ----D---- C:\windows\Registration
2010-12-25 14:51:41 ----D---- C:\Program Files\Microsoft Silverlight
2010-12-22 17:43:36 ----D---- C:\Program Files\youtube downloader
2010-12-21 00:52:36 ----N---- C:\windows\system32\occache.dll
2010-12-21 00:52:36 ----N---- C:\windows\system32\mstime.dll
2010-12-21 00:52:36 ----N---- C:\windows\system32\jsproxy.dll
2010-12-21 00:52:36 ----N---- C:\windows\system32\iepeers.dll
2010-12-21 00:52:36 ----A---- C:\windows\system32\mshtmled.dll
2010-12-21 00:52:36 ----A---- C:\windows\system32\licmgr10.dll
2010-12-21 00:52:35 ----N---- C:\windows\system32\iedkcs32.dll
2010-12-20 18:25:50 ----A---- C:\windows\system32\lsasrv.dll
2010-12-20 16:41:31 ----D---- C:\Documents and Settings\Admin\Data aplikací\Google
2010-12-20 15:25:09 ----D---- C:\windows\system32\config
2010-12-20 13:55:37 ----N---- C:\windows\system32\ie4uinit.exe
2010-12-18 18:32:40 ----D---- C:\windows\Microsoft.NET
2010-12-18 18:27:33 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-12-18 18:25:55 ----D---- C:\windows\system32\en-US
2010-12-18 18:11:47 ----D---- C:\windows\system32\XPSViewer
2010-12-18 18:11:46 ----D---- C:\windows\system32\cs-cz
2010-12-17 23:01:34 ----D---- C:\Program Files\uTorrent
2010-12-17 17:45:19 ----SD---- C:\Documents and Settings\Admin\Data aplikací\Microsoft
2010-12-16 16:09:14 ----D---- C:\Program Files\Outlook Express
2010-12-12 17:57:08 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-12-12 17:57:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Symantec
2010-12-10 21:17:20 ----D---- C:\Program Files\Google
2010-12-10 21:17:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2010-12-10 21:17:19 ----SD---- C:\windows\Tasks
2010-12-10 20:45:10 ----D---- C:\windows\system32\appmgmt
2010-12-10 17:45:38 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-12-09 15:30:13 ----A---- C:\windows\system32\csrsrv.dll
2010-12-07 19:01:08 ----D---- C:\windows\network diagnostic
2010-12-07 18:05:32 ----D---- C:\windows\system32\ReinstallBackups
2010-12-07 17:39:16 ----D---- C:\Program Files\Softonic-Eng7
2010-12-07 11:29:17 ----A---- C:\windows\disney.ini
2010-12-06 17:49:56 ----D---- C:\Program Files\Valve
2010-12-06 17:25:17 ----D---- C:\Program Files\Microsoft.NET
2010-12-06 07:13:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2010-12-06 07:08:59 ----DC---- C:\windows\system32\DRVSTORE
2010-12-06 06:21:29 ----RSHD---- C:\windows\system32\Microsoft
2010-12-05 20:59:45 ----A---- C:\windows\win.ini
2010-12-05 20:59:45 ----A---- C:\windows\system.ini
2010-11-28 19:50:17 ----D---- C:\windows\pss
2010-11-25 21:23:34 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-11-25 21:19:15 ----D---- C:\Program Files\Movie Maker
2010-11-18 19:15:47 ----A---- C:\windows\system32\isign32.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvata;nvata; C:\windows\system32\DRIVERS\nvata.sys [2006-08-21 105344]
R0 prohlp02;StarForce Protection Helper Driver v2; C:\windows\System32\drivers\prohlp02.sys [2004-08-09 114016]
R0 prosync1;StarForce Protection Synchronization Driver v1; C:\windows\System32\drivers\prosync1.sys [2004-07-19 7040]
R0 PxHelp20;PxHelp20; C:\windows\System32\Drivers\PxHelp20.sys [2009-05-01 43528]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\windows\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\windows\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp01;StarForce Protection Helper Driver; C:\windows\System32\drivers\sfhlp01.sys [2003-12-01 4832]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\windows\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\windows\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\windows\System32\drivers\sfvfs02.sys [2007-01-12 82296]
R0 sptd;sptd; C:\windows\System32\Drivers\sptd.sys [2009-11-30 691696]
R0x01000000 papycpu;papycpu; C:\windows\system32\drivers\papycpu.sys [1998-10-06 1984]
R0x01000000 papyjoy;papyjoy; C:\windows\system32\drivers\papyjoy.sys [1998-10-06 1888]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\windows\system32\drivers\Aavmker4.sys [2011-01-13 29392]
R1 AmdK8;Ovladač procesoru AMD; C:\windows\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 AsIO;AsIO; C:\windows\system32\drivers\AsIO.sys [2006-10-18 12664]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr.sys [2011-01-13 23632]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2011-01-13 294608]
R1 aswTdi;avast! Network Shield Support; C:\windows\system32\drivers\aswTdi.sys [2011-01-13 47440]
R1 InCDPass;InCDPass; C:\windows\System32\DRIVERS\InCDPass.sys [2005-07-25 29696]
R1 incdrm;InCD Reader; C:\windows\system32\drivers\incdrm.sys [2005-07-25 28672]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\windows\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:\windows\System32\DRIVERS\NVTcp.sys [2006-09-11 110592]
R1 oreans32;oreans32; \??\C:\WINDOWS\system32\drivers\oreans32.sys []
R1 prodrv06;StarForce Protection Environment Driver v6; C:\windows\System32\drivers\prodrv06.sys [2004-08-09 53920]
R1 tidnet;TID NDIS Protocol Driver; C:\windows\system32\DRIVERS\tidnet.sys [2009-09-15 19200]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\windows\System32\drivers\ws2ifsl.sys [2004-08-18 12032]
R2 acedrv11;acedrv11; \??\C:\WINDOWS\system32\drivers\acedrv11.sys []
R2 Aspi32;Aspi32; C:\windows\System32\drivers\aspi32.sys [2005-11-21 16512]
R2 aswFsBlk;aswFsBlk; C:\windows\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
R2 aswMon2;avast! Standard Shield Support; C:\windows\system32\drivers\aswMon2.sys [2011-01-13 100176]
R2 atksgt;atksgt; C:\windows\system32\DRIVERS\atksgt.sys [2009-06-18 278728]
R2 lirsgt;lirsgt; C:\windows\system32\DRIVERS\lirsgt.sys [2007-08-31 18048]
R2 npf;NetGroup Packet Filter Driver; C:\windows\system32\drivers\npf.sys [2008-06-01 34064]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\windows\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 AmdLLD;AMD Low Level Device Driver; C:\windows\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hamachi;Hamachi Network Interface; C:\windows\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HBtnKey;Wistron Tablet PC Keyboard Buttons HID Driver; C:\windows\system32\DRIVERS\a2ptbtn.sys [2010-03-10 7180]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\windows\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\windows\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\windows\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\windows\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\windows\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\windows\system32\DRIVERS\NVENETFD.sys [2006-09-11 57856]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\windows\system32\drivers\nvhda32.sys [2010-01-28 58600]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\windows\system32\DRIVERS\nvnetbus.sys [2006-09-11 19968]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\windows\system32\DRIVERS\point32.sys [2010-12-07 27792]
R3 SenFiltService;SenFilt Service; C:\windows\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R4 InCDfs;InCD File System; C:\windows\system32\drivers\InCDfs.sys [2005-07-25 101504]
S2 ATE_PROCMON;ATE_PROCMON; C:\windows\system32\drivers\ATE_PROCMON.sys []
S3 adxapie;adxapie; C:\windows\system32\drivers\adxapie.sys []
S3 anddcs15;anddcs15; C:\windows\system32\drivers\anddcs15.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\windows\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 EagleNT;EagleNT; C:\windows\system32\drivers\EagleNT.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\Matous\LOCALS~1\Temp\FFN15B.tmp []
S3 GGSAFERDriver;GGSAFER Driver; C:\windows\system32\drivers\GGSAFERDriver.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\windows\system32\DRIVERS\ewdcsc.sys [2009-12-15 24448]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\windows\system32\DRIVERS\ewusbmdm.sys [2009-12-15 102528]
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\windows\system32\DRIVERS\ewusbdev.sys [2009-12-15 100736]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; C:\windows\system32\drivers\MREMP50a64.sys []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; C:\windows\system32\drivers\MREMPR5.sys []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; C:\windows\system32\drivers\MRENDIS5.sys []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; C:\windows\system32\drivers\MRESP50a64.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\windows\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\windows\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\windows\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 SLIP;BDA Slip De-Framer; C:\windows\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 snpstd;USB PC Camera (SN9C102); C:\windows\system32\DRIVERS\snpstd.sys [2005-12-06 390656]
S3 streamip;BDA IPSink; C:\windows\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\windows\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\windows\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\windows\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apache2.2;Apache2.2; C:\dev\prog\bin\httpd.exe [2010-10-18 20549]
R2 Application Updater;Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [2010-10-22 386560]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-09-11 172032]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-04-13 20543]
R2 IJPLMSVC;PIXMA Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 99936]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-09-11 135227]
R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-09-11 65599]
R2 PnkBstrA;PnkBstrA; C:\windows\system32\PnkBstrA.exe [2011-01-18 75064]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
R3 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]
R3 WSearch;Windows Search; C:\windows\system32\SearchIndexer.exe [2008-05-26 439808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 Zwunzi Service;Zwunzi Service; C:\Documents and Settings\All Users\Data aplikací\Zwunzi\zwunzi141.exe [2010-01-29 58720]
S3 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 nvsvc;NVIDIA Display Driver Service; C:\windows\system32\nvsvc32.exe [2010-04-03 154216]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\windows\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2005-07-25 876032]
S4 InCDsrvR;InCD Helper (read only); C:\Program Files\Ahead\InCD\InCDsrv.exe [2005-07-25 876032]
S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Je tam pár šmejdů Udělejte sken ComboFix a dejte log.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[matousik]

Zde je log z ComboFixu:
ComboFix 11-02-09.05 - Admin 11.02.2011 7:24.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1555 [GMT 1:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\directory\CyberGate
c:\documents and settings\Adam\Data aplikací\Dealio
c:\documents and settings\Adam\Data aplikací\Dealio\res\widgets.xml
c:\documents and settings\Adam\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Admin\Data aplikací\Dealio
c:\documents and settings\Admin\Data aplikací\Dealio\res\widgets.xml
c:\documents and settings\Admin\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Admin\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_top_7days__cnid=[CHANNEL_ID]&ccv=[CODE_VER]&ISN=[ISN].xml
c:\documents and settings\Admin\Data aplikací\PriceGong
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\1.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\a.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\b.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\c.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\d.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\e.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\f.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\g.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\h.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\i.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\J.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\k.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\l.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\m.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\mru.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\n.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\o.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\p.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\q.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\r.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\s.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\t.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\u.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\v.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\w.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\x.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\y.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\z.xml
c:\documents and settings\All Users\Data aplikací\Zwunzi
c:\documents and settings\All Users\Data aplikací\Zwunzi\zwunzi141.exe
c:\documents and settings\Matous\Data aplikací\Dealio
c:\documents and settings\Matous\Data aplikací\Dealio\res\widgets.xml
c:\documents and settings\Matous\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\Matous\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_top_7days__cnid=[CHANNEL_ID]&ccv=[CODE_VER]&ISN=[ISN].xml
c:\documents and settings\Matous\Data aplikací\PriceGong
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\1.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\a.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\b.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\c.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\d.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\e.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\f.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\g.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\h.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\i.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\J.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\k.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\l.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\m.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\mru.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\n.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\o.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\p.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\q.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\r.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\s.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\t.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\u.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\v.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\w.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\x.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\y.xml
c:\documents and settings\Matous\Data aplikací\PriceGong\Data\z.xml
c:\documents and settings\Vera\Data aplikací\Dealio
c:\documents and settings\Vera\Data aplikací\Dealio\res\widgets.xml
c:\documents and settings\Vera\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
C:\install.exe
c:\program files\Zwunzi
c:\program files\Zwunzi\uninstall.exe
c:\program files\Zwunzi\zwunzi.exe
C:\start
c:\windows\AutoRun.ini
c:\windows\system32\midas.dll
c:\windows\system32\Script.vbs
c:\windows\system32\WIN32GI
F:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ZWUNZI_SERVICE
-------\Service_Zwunzi Service


((((((((((((((((((((((((( Soubory vytvořené od 2011-01-11 do 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-10 18:53 . 2011-02-10 19:37 -------- d-----w- c:\program files\trend micro
2011-02-10 18:53 . 2011-02-10 18:53 -------- dc----w- C:\rsit
2011-02-10 14:46 . 2011-02-10 14:46 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\Activision
2011-02-07 15:11 . 2011-02-07 15:11 -------- dc----w- C:\PHP
2011-02-07 14:55 . 2011-02-07 14:55 -------- dc----w- C:\dev
2011-02-02 17:02 . 2011-02-02 17:02 -------- d-----w- c:\documents and settings\Admin\Data aplikací\Ubisoft
2011-02-02 15:44 . 2011-02-02 15:44 -------- d-----w- c:\documents and settings\Admin\Data aplikací\LolClient
2011-02-02 15:27 . 2011-02-02 15:27 -------- dc----w- C:\Riot Games
2011-02-02 14:08 . 2011-02-04 15:02 -------- d-----w- c:\program files\League of legends
2011-02-02 14:08 . 2011-02-02 17:27 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\PMB Files
2011-02-02 14:07 . 2011-02-02 14:07 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2011-02-02 14:07 . 2011-02-02 14:07 -------- d-----w- c:\program files\Pando Networks
2011-01-30 13:09 . 2011-01-30 13:09 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\AliensVsPredator
2011-01-30 13:00 . 2007-06-29 13:47 34304 ----a-w- c:\windows\system32\drivers\AmdLLD.sys
2011-01-30 13:00 . 2011-01-30 13:00 -------- d-----w- c:\program files\AMD
2011-01-30 12:58 . 2010-06-02 03:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2011-01-30 12:58 . 2010-06-02 03:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2011-01-30 12:58 . 2010-06-02 03:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2011-01-30 12:58 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2011-01-30 12:03 . 2011-02-07 16:45 -------- d-----w- c:\program files\Aliens vs Predator 2010
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\UC.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\LHA.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\ARJ.PIF
2011-01-28 14:43 . 2011-01-28 14:44 -------- dc----w- C:\totalcmd
2011-01-28 14:43 . 2011-01-28 14:43 -------- d-----w- c:\documents and settings\Admin\Data aplikací\GHISLER
2011-01-27 15:35 . 2011-01-27 15:35 -------- d-----w- c:\documents and settings\Adam\Data aplikací\Skype
2011-01-27 15:32 . 2011-01-27 15:32 -------- d-----w- c:\documents and settings\Adam\Data aplikací\Canon
2011-01-21 14:44 . 2011-01-21 14:44 440320 -c----w- c:\windows\system32\dllcache\shimgvw.dll
2011-01-18 16:47 . 2011-01-18 16:47 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\PunkBuster
2011-01-18 13:44 . 2011-01-18 13:44 -------- d-----w- c:\documents and settings\Adam\Local Settings\Data aplikací\Ubisoft
2011-01-16 17:02 . 2011-01-18 15:57 -------- d-----w- c:\program files\Electronic Arts
2011-01-16 09:47 . 2011-01-16 09:47 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\Ubisoft
2011-01-16 09:08 . 2007-04-27 09:12 78784 ----a-w- c:\windows\system32\ISUSPM.cpl
2011-01-16 09:08 . 2006-09-10 20:56 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2011-01-16 09:08 . 2007-04-27 09:12 29640 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\_ispmres.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-10 17:15 . 2009-03-30 15:06 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-02-10 17:11 . 2009-03-30 15:06 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-02-10 14:44 . 2010-12-17 21:31 22328 ----a-w- c:\documents and settings\Admin\Data aplikací\PnkBstrK.sys
2011-02-10 14:43 . 2010-03-05 14:10 682280 ----a-w- c:\windows\system32\pbsvc.exe
2011-01-26 17:56 . 2009-08-29 16:25 214864 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-21 14:44 . 2004-08-18 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-18 16:48 . 2009-03-30 15:06 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-01-18 16:35 . 2010-04-28 07:00 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-01-13 08:47 . 2010-02-17 06:59 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-02-17 06:59 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-02-17 06:59 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-02-17 06:59 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-02-17 06:59 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-02-17 06:59 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-02-17 06:59 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-02-17 06:59 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-07 14:09 . 2004-08-18 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 20:06 . 2009-11-30 11:05 38848 ----a-w- c:\windows\avastSS.scr
2010-12-31 14:04 . 2004-08-18 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-18 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2004-08-18 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-18 12:00 385024 ----a-w- c:\windows\system32\html.iec
2010-12-14 19:03 . 2010-12-14 19:03 375808 ----a-w- c:\documents and settings\Admin\Local Settings\Data aplikací\0335924941.exe
2010-12-09 15:15 . 2004-08-18 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2004-08-17 15:45 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2004-08-18 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2004-08-18 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-07 17:05 . 2010-12-07 17:05 27792 ----a-w- c:\windows\system32\drivers\point32.sys
2010-11-18 18:15 . 2007-07-16 17:33 81920 ----a-w- c:\windows\system32\isign32.dll
2000-08-30 14:46 . 2000-08-30 14:46 1807072 ------w- c:\program files\vcredist.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-25 3911776]
"{dfabc5b5-039b-4865-979a-de31cdf3e351}"= "c:\program files\Media_Star\tbMedi.dll" [2010-12-09 3911776]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{dfabc5b5-039b-4865-979a-de31cdf3e351}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-27 20:06 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngin0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Softonic-Eng7\tbSof0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]
2007-12-10 12:46 1510424 ----a-w- c:\program files\Sigma_Team\tbSig0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B291E6C-9A74-4034-971B-A4B007A0B315}]
2010-01-11 10:18 451808 ----a-w- c:\program files\RadioBar\toolbar.ni.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2011-01-27 20:06 3911776 ----a-w- c:\program files\TorrentMan\tbTor1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-25 18:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTo1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dfabc5b5-039b-4865-979a-de31cdf3e351}]
2010-12-09 11:51 3911776 ----a-w- c:\program files\Media_Star\tbMedi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}"= "c:\program files\Sigma_Team\tbSig0.dll" [2007-12-10 1510424]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSof0.dll" [2010-10-18 3908192]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor1.dll" [2011-01-27 3911776]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-25 3911776]
"{dfabc5b5-039b-4865-979a-de31cdf3e351}"= "c:\program files\Media_Star\tbMedi.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-01-27 3911776]

[HKEY_CLASSES_ROOT\clsid\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{dfabc5b5-039b-4865-979a-de31cdf3e351}]

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bandwidth Meter.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bandwidth Meter.lnk
backup=c:\windows\pss\Bandwidth Meter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Monitor Apache Servers.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Monitor Apache Servers.lnk
backup=c:\windows\pss\Monitor Apache Servers.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSWUpdate
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-25 10:01 1397760 ------w- c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-10-11 16:25 1961984 ------w- c:\program files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-09-02 14:15 13351304 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SamSs"=2 (0x2)
"PnkBstrA"=2 (0x2)
"Microsoft SharePoint Workspace Audit Service"=3 (0x3)
"InCDsrvR"=2 (0x2)
"InCDsrv"=2 (0x2)
"ICQ Service"=2 (0x2)
"Hamachi2Svc"=2 (0x2)
"Apache2.2"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Fanda\\Plocha\\Skype.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Resonation\\Resonation.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Netdevil\\Warmonger\\Binaries\\WMGame.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"c:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX10.EXE"=
"c:\\Program Files\\Valve\\Half-Life 2\\hl2.exe"=
"c:\\Program Files\\Valve\\Half-Life 2 Episode One\\hl2.exe"=
"c:\\Program Files\\Valve\\Half-Life 2 Episode Two\\hl2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\Killing Floor\\System\\KillingFloor.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\Multiwina\\multiwinia.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\KillingFloor_v1011_NoSteam\\Killing Floor\\System\\KillingFloor.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Matous\\Plocha\\Mystiq.org Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\team fortress 2 meet the scout\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the ball demo\\Binaries\\Win32\\TheBall.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik6\\garrysmod\\hl2.exe"=
"c:\\Program Files\\TorrentBitch\\TorrentBitch.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\garrysmod\\hl2.exe"=
"c:\\Program Files\\Ubisoft\\Shaun White Snowboarding\\ShaunWhiteSnowboardingGame.exe"=
"c:\\Program Files\\Ubisoft\\Shaun White Snowboarding\\ShaunWhiteSnowboarding.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik6\\synergy\\hl2.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\srcds.exe"=
"c:\\Documents and Settings\\Vera\\Plocha\\Skype.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58034:TCP"= 58034:TCP:Pando Media Booster
"58034:UDP"= 58034:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 13:46 63352]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.11.2009 16:51 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [17.2.2010 7:59 294608]
R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2.8.2007 19:39 33824]
R1 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys [10.8.2007 19:42 1984]
R1 tidnet;TID NDIS Protocol Driver;c:\windows\system32\drivers\tidnet.sys [15.9.2009 10:51 19200]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30.7.2008 6:51 277736]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [22.10.2010 16:38 386560]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [17.2.2010 7:59 17744]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1.6.2008 8:13 34064]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [3.12.2009 13:09 58600]
S2 ATE_PROCMON;ATE_PROCMON; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 adxapie;adxapie; [x]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp --> c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver; [x]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\drivers\ewdcsc.sys [8.12.2010 16:18 24448]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [8.12.2010 16:18 100736]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 20:37 4640000]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 Apache2.2;Apache2.2;c:\dev\prog\bin\httpd.exe [18.10.2010 1:32 20549]
S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; [x]
S4 ICQ Service;ICQ Service; [x]
S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [21.1.2010 17:51 30963576]
.
Obsah adresáře 'Naplánované úlohy'

2011-02-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]

2011-02-11 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2010-03-09 12:18]

2011-02-11 c:\windows\Tasks\User_Feed_Synchronization-{127575F9-27B8-448F-A31B-9E5890722031}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2626277
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} - c:\program files\RadioBar\toolbar.ni.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
WebBrowser-{A6E4A4EB-D169-4E99-8988-250FCBAFE767} - (no file)
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-crss - (no file)
MSConfigStartUp-LogMeIn Hamachi Ui - c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
MSConfigStartUp-nwiz - nwiz.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-Anti Trojan Elite_is1 - c:\program files\Anti Trojan Elite\unins000.exe
AddRemove-Audacity 1.3 Beta (Unicode)_is1 - c:\program files\Audacity 1.3 Beta (Unicode)\unins000.exe
AddRemove-Free Mp3 Wma Ogg Converter_is1 - c:\program files\Free Mp3 Wma Ogg Converter\unins000.exe
AddRemove-Free Video Converter_is1 - c:\program files\Free Video Converter\unins000.exe
AddRemove-HLSW_is1 - c:\program files\HLSW\unins000.exe
AddRemove-LANGMaster Škola DNES_is1 - c:\program files\LANGMaster Škola DNES\unins000.exe
AddRemove-Machine World_is1 - c:\program files\FreeGamePick.com\Machine World\unins000.exe
AddRemove-Rayman M_is1 - c:\program files\Ubi Soft\RaymanM\unins000.exe
AddRemove-RCDEMO - c:\sierra\RCRacersDemo\Uninst.isu
AddRemove-RegClean Pro_is1 - c:\program files\RegClean Pro\unins000.exe
AddRemove-Registry Easy_is1 - c:\program files\Registry Easy\unins000.exe
AddRemove-RegistryFix_is1 - c:\program files\RegistryFix\unins000.exe
AddRemove-Ultimate Tank_is1 - c:\program files\FreeGamePick.com\Ultimate Tank\unins000.exe
AddRemove-Zwunzi - c:\program files\Zwunzi\uninstall.exe
AddRemove-{10ACC836-F47B-4236-96A5-DF52076EE70A}_is1 - c:\program files\NoVirusThanks\NoVirusThanks Malware Remover\unins000.exe
AddRemove-{BC2C6B8D-73A6-4540-8212-906527D43553}_is1 - c:\program files\City Life Super Deluxe\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-11 07:36
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Electronic Arts\C*o*m*m*a*n*d* *a*n*d* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Podpora]
"Order"=hex:08,00,00,00,02,00,00,00,8a,02,00,00,01,00,00,00,04,00,00,00,98,00,
00,00,00,00,00,00,8a,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,78,00,32,\

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:e3,14,f8,e1,50,8e,31,f2,c3,34,cb,77,1d,6a,0c,17,5a,f7,4f,58,ff,60,b7,
a6,86,2d,1f,b2,92,6a,c8,4d,bf,6d,24,b9,8d,41,37,35,27,1f,ba,98,23,3a,93,88,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\SecuROM\License information*]
"datasecu"=hex:05,67,9c,f0,1f,a8,ed,eb,84,58,5d,69,02,37,f9,09,37,cb,ff,ec,f5,
8c,e2,e0,7d,d0,86,9b,c9,df,15,a1,05,5e,aa,52,d4,02,9a,bb,ee,72,d1,d0,7d,52,\
"rkeysecu"=hex:17,0c,8b,a8,75,cb,05,56,56,b0,06,85,72,9c,ba,40
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(908)
c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(2488)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\phonebrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\SearchIndexer.exe
.
**************************************************************************
.
Celkový čas: 2011-02-11 07:42:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-11 06:42

Před spuštěním: 8 063 090 688
Po spuštění: Volných bajtů: 13 505 204 224

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 79973B203B73A9DA87104D3C08466718

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\system32\drivers\oreans32.sys

Driver::
oreans32
adxapie

Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[matousik]

Po skenu jsem odeslal vzorky na nějaký ten server, jak mi řekl ComboFix
Zde je log:
ComboFix 11-02-11.01 - Admin 11.02.2011 21:26:55.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1425 [GMT 1:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Admin\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

file zipped: c:\windows\system32\drivers\oreans32.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Data aplikací\PriceGong
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\1.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\a.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\b.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\c.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\d.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\e.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\f.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\g.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\h.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\i.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\J.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\k.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\l.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\m.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\mru.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\n.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\o.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\p.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\q.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\r.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\s.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\t.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\u.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\v.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\w.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\x.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\y.xml
c:\documents and settings\Admin\Data aplikací\PriceGong\Data\z.xml
c:\windows\system32\drivers\oreans32.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ADXAPIE
-------\Legacy_OREANS32
-------\Service_adxapie
-------\Service_oreans32


((((((((((((((((((((((((( Soubory vytvořené od 2011-01-11 do 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-11 07:17 . 2011-02-11 07:17 -------- d-----w- c:\documents and settings\Admin\Data aplikací\Canon
2011-02-10 18:53 . 2011-02-10 19:37 -------- d-----w- c:\program files\trend micro
2011-02-10 18:53 . 2011-02-10 18:53 -------- dc----w- C:\rsit
2011-02-10 14:46 . 2011-02-10 14:46 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\Activision
2011-02-07 15:11 . 2011-02-07 15:11 -------- dc----w- C:\PHP
2011-02-07 14:55 . 2011-02-07 14:55 -------- dc----w- C:\dev
2011-02-02 17:02 . 2011-02-02 17:02 -------- d-----w- c:\documents and settings\Admin\Data aplikací\Ubisoft
2011-02-02 15:44 . 2011-02-02 15:44 -------- d-----w- c:\documents and settings\Admin\Data aplikací\LolClient
2011-02-02 15:27 . 2011-02-02 15:27 -------- dc----w- C:\Riot Games
2011-02-02 14:08 . 2011-02-04 15:02 -------- d-----w- c:\program files\League of legends
2011-02-02 14:08 . 2011-02-02 17:27 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\PMB Files
2011-02-02 14:07 . 2011-02-02 14:07 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2011-02-02 14:07 . 2011-02-02 14:07 -------- d-----w- c:\program files\Pando Networks
2011-01-30 13:09 . 2011-01-30 13:09 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\AliensVsPredator
2011-01-30 13:00 . 2007-06-29 13:47 34304 ----a-w- c:\windows\system32\drivers\AmdLLD.sys
2011-01-30 13:00 . 2011-01-30 13:00 -------- d-----w- c:\program files\AMD
2011-01-30 12:58 . 2010-06-02 03:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2011-01-30 12:58 . 2010-06-02 03:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2011-01-30 12:58 . 2010-06-02 03:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2011-01-30 12:58 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2011-01-30 12:58 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2011-01-30 12:03 . 2011-02-07 16:45 -------- d-----w- c:\program files\Aliens vs Predator 2010
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\UC.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\LHA.PIF
2011-01-28 14:43 . 2010-11-29 06:56 545 ----a-w- c:\windows\ARJ.PIF
2011-01-28 14:43 . 2011-01-28 14:44 -------- dc----w- C:\totalcmd
2011-01-28 14:43 . 2011-01-28 14:43 -------- d-----w- c:\documents and settings\Admin\Data aplikací\GHISLER
2011-01-27 15:35 . 2011-01-27 15:35 -------- d-----w- c:\documents and settings\Adam\Data aplikací\Skype
2011-01-27 15:32 . 2011-01-27 15:32 -------- d-----w- c:\documents and settings\Adam\Data aplikací\Canon
2011-01-21 14:44 . 2011-01-21 14:44 440320 -c----w- c:\windows\system32\dllcache\shimgvw.dll
2011-01-18 16:47 . 2011-01-18 16:47 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\PunkBuster
2011-01-18 13:44 . 2011-01-18 13:44 -------- d-----w- c:\documents and settings\Adam\Local Settings\Data aplikací\Ubisoft
2011-01-16 17:02 . 2011-01-18 15:57 -------- d-----w- c:\program files\Electronic Arts
2011-01-16 09:47 . 2011-01-16 09:47 -------- d-----w- c:\documents and settings\Admin\Local Settings\Data aplikací\Ubisoft
2011-01-16 09:08 . 2007-04-27 09:12 78784 ----a-w- c:\windows\system32\ISUSPM.cpl
2011-01-16 09:08 . 2006-09-10 20:56 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2011-01-16 09:08 . 2007-04-27 09:12 29640 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\_ispmres.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-11 16:38 . 2009-03-30 15:06 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-02-10 17:15 . 2009-03-30 15:06 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-02-10 17:11 . 2009-03-30 15:06 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-02-10 14:44 . 2010-12-17 21:31 22328 ----a-w- c:\documents and settings\Admin\Data aplikací\PnkBstrK.sys
2011-02-10 14:43 . 2010-03-05 14:10 682280 ----a-w- c:\windows\system32\pbsvc.exe
2011-01-26 17:56 . 2009-08-29 16:25 214864 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-21 14:44 . 2004-08-18 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-18 16:35 . 2010-04-28 07:00 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-01-13 08:47 . 2010-02-17 06:59 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-02-17 06:59 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-02-17 06:59 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2010-02-17 06:59 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2010-02-17 06:59 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2010-02-17 06:59 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-02-17 06:59 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2010-02-17 06:59 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-07 14:09 . 2004-08-18 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 20:06 . 2009-11-30 11:05 38848 ----a-w- c:\windows\avastSS.scr
2010-12-31 14:04 . 2004-08-18 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-18 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2004-08-18 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-18 12:00 385024 ----a-w- c:\windows\system32\html.iec
2010-12-14 19:03 . 2010-12-14 19:03 375808 ----a-w- c:\documents and settings\Admin\Local Settings\Data aplikací\0335924941.exe
2010-12-09 15:15 . 2004-08-18 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2004-08-17 15:45 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2004-08-18 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2004-08-18 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-07 17:05 . 2010-12-07 17:05 27792 ----a-w- c:\windows\system32\drivers\point32.sys
2010-11-18 18:15 . 2007-07-16 17:33 81920 ----a-w- c:\windows\system32\isign32.dll
2000-08-30 14:46 . 2000-08-30 14:46 1807072 ------w- c:\program files\vcredist.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-25 3911776]
"{dfabc5b5-039b-4865-979a-de31cdf3e351}"= "c:\program files\Media_Star\tbMedi.dll" [2010-12-09 3911776]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{dfabc5b5-039b-4865-979a-de31cdf3e351}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-27 20:06 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngin0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Softonic-Eng7\tbSof0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]
2007-12-10 12:46 1510424 ----a-w- c:\program files\Sigma_Team\tbSig0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B291E6C-9A74-4034-971B-A4B007A0B315}]
2010-01-11 10:18 451808 ----a-w- c:\program files\RadioBar\toolbar.ni.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2011-01-27 20:06 3911776 ----a-w- c:\program files\TorrentMan\tbTor1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-25 18:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTo1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dfabc5b5-039b-4865-979a-de31cdf3e351}]
2010-12-09 11:51 3911776 ----a-w- c:\program files\Media_Star\tbMedi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}"= "c:\program files\Sigma_Team\tbSig0.dll" [2007-12-10 1510424]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSof0.dll" [2010-10-18 3908192]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor1.dll" [2011-01-27 3911776]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo1.dll" [2010-12-25 3911776]
"{dfabc5b5-039b-4865-979a-de31cdf3e351}"= "c:\program files\Media_Star\tbMedi.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-01-27 3911776]

[HKEY_CLASSES_ROOT\clsid\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{dfabc5b5-039b-4865-979a-de31cdf3e351}]

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bandwidth Meter.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bandwidth Meter.lnk
backup=c:\windows\pss\Bandwidth Meter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Monitor Apache Servers.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Monitor Apache Servers.lnk
backup=c:\windows\pss\Monitor Apache Servers.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-25 10:01 1397760 ------w- c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-10-11 16:25 1961984 ------w- c:\program files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-09-02 14:15 13351304 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SamSs"=2 (0x2)
"Microsoft SharePoint Workspace Audit Service"=3 (0x3)
"InCDsrvR"=2 (0x2)
"InCDsrv"=2 (0x2)
"ICQ Service"=2 (0x2)
"Hamachi2Svc"=2 (0x2)
"Apache2.2"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Fanda\\Plocha\\Skype.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Resonation\\Resonation.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Netdevil\\Warmonger\\Binaries\\WMGame.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX9.EXE"=
"c:\\Program Files\\CAPCOM\\RESIDENT EVIL 5\\RE5DX10.EXE"=
"c:\\Program Files\\Valve\\Half-Life 2\\hl2.exe"=
"c:\\Program Files\\Valve\\Half-Life 2 Episode One\\hl2.exe"=
"c:\\Program Files\\Valve\\Half-Life 2 Episode Two\\hl2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas\\Binaries\\R6Vegas_Launcher.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\Killing Floor\\System\\KillingFloor.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\Multiwina\\multiwinia.exe"=
"c:\\Documents and Settings\\Matous\\Plocha\\KillingFloor_v1011_NoSteam\\Killing Floor\\System\\KillingFloor.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Matous\\Plocha\\Mystiq.org Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\team fortress 2 meet the scout\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the ball demo\\Binaries\\Win32\\TheBall.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik6\\garrysmod\\hl2.exe"=
"c:\\Program Files\\TorrentBitch\\TorrentBitch.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik4\\garrysmod\\hl2.exe"=
"c:\\Program Files\\Ubisoft\\Shaun White Snowboarding\\ShaunWhiteSnowboardingGame.exe"=
"c:\\Program Files\\Ubisoft\\Shaun White Snowboarding\\ShaunWhiteSnowboarding.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield 2142 Deluxe Edition\\BF2142.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik6\\synergy\\hl2.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\srcds.exe"=
"c:\\Documents and Settings\\Vera\\Plocha\\Skype.exe"=
"c:\\Program Files\\Steam\\steamapps\\matousik\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58034:TCP"= 58034:TCP:Pando Media Booster
"58034:UDP"= 58034:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 13:46 63352]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.11.2009 16:51 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [17.2.2010 7:59 294608]
R1 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys [10.8.2007 19:42 1984]
R1 tidnet;TID NDIS Protocol Driver;c:\windows\system32\drivers\tidnet.sys [15.9.2009 10:51 19200]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [30.7.2008 6:51 277736]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [22.10.2010 16:38 386560]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [17.2.2010 7:59 17744]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1.6.2008 8:13 34064]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [3.12.2009 13:09 58600]
S2 ATE_PROCMON;ATE_PROCMON; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp --> c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver; [x]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\drivers\ewdcsc.sys [8.12.2010 16:18 24448]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [8.12.2010 16:18 100736]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 20:37 4640000]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 Apache2.2;Apache2.2;c:\dev\prog\bin\httpd.exe [18.10.2010 1:32 20549]
S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; [x]
S4 ICQ Service;ICQ Service; [x]
S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [21.1.2010 17:51 30963576]
.
Obsah adresáře 'Naplánované úlohy'

2011-02-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]

2011-02-11 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2010-03-09 12:18]

2011-02-11 c:\windows\Tasks\User_Feed_Synchronization-{127575F9-27B8-448F-A31B-9E5890722031}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2626277
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} - c:\program files\RadioBar\toolbar.ni.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-11 21:38
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Matous\LOCALS~1\Temp\FFN15B.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Electronic Arts\C*o*m*m*a*n*d* *a*n*d* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Podpora]
"Order"=hex:08,00,00,00,02,00,00,00,8a,02,00,00,01,00,00,00,04,00,00,00,98,00,
00,00,00,00,00,00,8a,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,78,00,32,\

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:e3,14,f8,e1,50,8e,31,f2,c3,34,cb,77,1d,6a,0c,17,5a,f7,4f,58,ff,60,b7,
a6,86,2d,1f,b2,92,6a,c8,4d,bf,6d,24,b9,8d,41,37,35,27,1f,ba,98,23,3a,93,88,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-1757981266-1715567821-725345543-1007\Software\SecuROM\License information*]
"datasecu"=hex:05,67,9c,f0,1f,a8,ed,eb,84,58,5d,69,02,37,f9,09,37,cb,ff,ec,f5,
8c,e2,e0,7d,d0,86,9b,c9,df,15,a1,05,5e,aa,52,d4,02,9a,bb,ee,72,d1,d0,7d,52,\
"rkeysecu"=hex:17,0c,8b,a8,75,cb,05,56,56,b0,06,85,72,9c,ba,40
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(908)
c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(1052)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\phonebrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\SearchIndexer.exe
.
**************************************************************************
.
Celkový čas: 2011-02-11 21:44:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-11 20:44
ComboFix2.txt 2011-02-11 06:42

Před spuštěním: 2 940 809 216
Po spuštění: 2 963 206 144

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - B9BA4C1608A26C01B250A246D47DDC3A

[Rudy]

Log již vypadá čistý. Nastala nějaká změna?

[matousik]

Nevypadá to tak, v procesech stále běží lsass.exe a využití CPU je stále větší než 50%.

[Rudy]

Váš lsass je legitimní soubor. Někdy se v PS objeví i další (v jiném adresáři) a to je trojan. Zkuste obnovu systému k datu, kdy korektně fungoval.

[matousik]

Nešlo by to nějak jinak? Datum, kdy to začalo už si přesně nepamatuji a navíc nemám žádný bod obnovení

[Rudy]

Zkuste vyhledat pomocí hledání, kde všude máte soubor lsass.exe. Ten legitimní by měl být v system32, příp. ještě v záloze. Ale nikde jinde.

[matousik]

lsass.exe v system32 je, ale při hledání mi to našlo jen TRLOG.txt - log z programu trojan remover, o kterém jsem se již zmínil v prvním příspěvku.
Nic jiného.

[Rudy]

Zkuste povypínat aut. aktualizace, a přeinstalovat antivir a sledujte, co se bude dít se zatížením.