Problémy s PC

[motji]

Ty soubory, co maže combofix, by měli být v pořádku. On si je stejně nějaký program obnovuje.
Momentálně jsou nějaké problémy s počítačem?

[Thrall]

Ty soubory, co maže combofix, by měli být v pořádku. On si je stejně nějaký program obnovuje.
Momentálně jsou nějaké problémy s počítačem?

JJ ano . Hirtorie se opakuje . Naposled to bylo tak ze jsme pul rok mel v obnove systemu (i kdyz jsme ji mazal) downloader co mi stahoval tyto dva soubory . G DATA ho nasel a mesic nebyl problem . Ale ais jsem si ho znovu stahl z te stranky . Ale AViRA hoé asi nasla

Kdyz bya pritelkyne na PC nebo ja mimo PC tak mi to asi hlasilo toto:
Virus or unwanted program 'TR/Agent.280125.A [trojan]'
detected in file 'C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP25\A0016750.exe.
Action performed: Deny access

Virus or unwanted program 'TR/Agent.280125.A [trojan]'
detected in file 'C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP25\A0016750.exe.
Action performed: Deny access

A pred chvili toto:
The file 'C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP25\A0016750.exe'
contained a virus or unwanted program 'TR/Agent.280125.A' [trojan]
Action(s) taken:
The file was moved to the quarantine directory under the name '4fe0953f.qua'.

Co teď mám dělat?

Protoze naposled mi to naslo dva viry v obnove a to znamena ze se mi tam potuluje jeste jeden .

PS: Chapu to tak , ze kdyz tam sedela pritelkyne proste klikla na krirek a AVIRA vir jenom zablokovala ale nevymazala?

[Thrall]

Mám tu dalsi logy.

Automatická kontrola: dokončeno před 15 min. (události: 8, objekty: 276087, čas: 01:12:36)
27.2.2011 15:33:53 Úloha byla spuštěna
27.2.2011 15:46:35 Zjištěno: not-a-virus:AdWare.Win32.AdMedia.kw C:\Documents and Settings\Uživatel\Plocha\Ostatni slozky\Download\WMV_Installer_v0701_r206_Win32.msi/_91A458A8EDA361E936C040C3D36D9C88/_37D7DDB981063872631E6BEBDFD3EAE9
27.2.2011 15:46:38 Neošetřeno: not-a-virus:AdWare.Win32.AdMedia.kw C:\Documents and Settings\Uživatel\Plocha\Ostatni slozky\Download\WMV_Installer_v0701_r206_Win32.msi Nelze dezinfikovat
27.2.2011 15:47:57 Odstraněno: not-a-virus:AdWare.Win32.AdMedia.kw C:\Documents and Settings\Uživatel\Plocha\Ostatni slozky\Download\WMV_Installer_v0701_r206_Win32.msi
27.2.2011 16:27:15 Zjištěno: not-a-virus:AdWare.Win32.AdMedia.kw C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP27\A0017852.msi/_91A458A8EDA361E936C040C3D36D9C88/_37D7DDB981063872631E6BEBDFD3EAE9
27.2.2011 16:27:16 Neošetřeno: not-a-virus:AdWare.Win32.AdMedia.kw C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP27\A0017852.msi Nelze dezinfikovat
27.2.2011 16:27:21 Odstraněno: not-a-virus:AdWare.Win32.AdMedia.kw C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP27\A0017852.msi
27.2.2011 16:46:29 Úloha byla dokončena

The file 'C:\System Volume Information\_restore{B8C1EFC6-E54B-4E33-9F55-F0A45A5E4978}\RP27\A0017830.exe'
contained a virus or unwanted program 'TR/Agent.280125.A' [trojan]
Action(s) taken:
The file was moved to the quarantine directory under the name '4fe0d0ee.qua'.

Ale porad nevim na 100% ze je PC cisty ...

[Thrall]

Prosim vas PC zacal strasne blbnout hned po prvnim restartu . Nekdy se samovolne restartuje ,dlouho se spousti a vypina a nekdy vubec nejde vypnout . Nekdy nejde firewall brana windowsu nebo antiviry . Vypsa to na virus akorat ze menejde spusstit nouzak a nevim co s tim .

[Thrall]

ComboFix toto ale PC s eporad chova nejak podivne. Je to divne dneska jsem na zadnych zavirovanych strankach nebyl . Jen jednou jsem nerad klikl na nejakou slovenskou reklamu ,ale pak jsem se koukl ze maj i facebook stranky a docela hodne lidi je v te jejich skupine . Spis to vipada jako by ten vir co jsem vymazal dnes z PC spustil nejakou sebezachovu .

omboFix 11-02-27.01 - Uživatel 27.02.2011 20:20:17.39.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1591 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie c:\windows\system32\dwwin.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\system32\dllcache\dwwin.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2011-01-27 do 2011-02-27 )))))))))))))))))))))))))))))))
.

2011-02-27 14:24 . 2011-02-27 16:07 -------- d-----w- c:\program files\Virus Removal Tool
2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- C:\Shoty
2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- c:\program files\ScreenShots
2011-02-21 19:33 . 2011-02-21 19:33 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Avira
2011-02-21 19:27 . 2011-01-10 13:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-02-21 19:27 . 2011-01-10 13:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-21 19:27 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-02-21 19:27 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-02-21 19:27 . 2011-02-21 19:27 -------- d-----w- c:\program files\Avira
2011-02-21 19:21 . 2011-02-27 19:16 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-21 19:21 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-02-21 19:21 . 2011-02-25 10:32 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-27 19:16 -------- d-----w- c:\program files\Spyware Terminator
2011-02-19 14:28 . 2011-02-19 14:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\EA Core
2011-02-19 14:27 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-02-19 14:02 . 2011-02-19 14:02 -------- d-----w- c:\program files\EA SPORTS
2011-02-19 14:01 . 2011-02-19 14:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Solidshield
2011-02-16 16:33 . 2011-02-16 16:33 -------- d-----w- c:\program files\Empire Interactive

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2008-04-14 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2008-04-14 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-23 11:27 . 2010-12-23 11:27 69400 ----a-w- c:\windows\system32\drivers\GRD.sys
2010-12-23 11:14 . 2010-12-23 11:14 51832 ----a-w- c:\windows\system32\drivers\GDTdiIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 29640 ----a-w- c:\windows\system32\drivers\GDNdisIc.sys
2010-12-23 11:14 . 2010-12-23 11:14 62584 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 33912 ----a-w- c:\windows\system32\drivers\GDBehave.sys
2010-12-22 12:34 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2008-04-14 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 17:09 . 2010-08-27 12:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-08-27 12:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 12:55 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-04-14 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2008-04-14 12:00 2194944 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 15:14 . 2008-04-14 08:06 2071552 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 14:30 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 13:43 . 2010-12-02 13:42 4902596 ----a-w- c:\windows\REGBK00.ZIP
2009-01-15 17:43 . 2009-01-15 17:43 1821008 ----a-w- c:\program files\instmsiw.exe
2009-01-15 17:43 . 2009-01-15 17:43 1707856 ----a-w- c:\program files\instmsia.exe
2009-01-15 17:43 . 2009-01-15 17:43 9296384 ----a-w- c:\program files\openofficeorg30.msi
.

((((((((((((((((((((((((((((( SnapShot_2011-02-23_17.27.11 )))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-02-21 3318784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-02-21 2216960]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\U§ivatel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.lnk - c:\documents and settings\U§ivatel\Local Settings\temp\_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.bat [N/A]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2007-02-26 08:40 249856 ----a-w- c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-01-24 10:32 2289664 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 10:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NMIndexingService"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=2 (0x2)
"gupdate1c9faffc1c539a5"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"\\\\macek\\storage\\Instalace\\!predinstalace\\Nero CZ a Power DVD\\CDS\\Nero\\Installation\\SetupX.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally_SSE1.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.2.2011 20:21 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [21.2.2011 20:27 135336]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5);c:\program files\Google\Update\GoogleUpdate.exe [2.7.2009 11:27 133104]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14.4.2008 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://centrum.cz
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/index.php?toolbar=centrum-1.0.0&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-27 20:27
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(612)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(300)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\savedump.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2011-02-27 20:30:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-27 19:30
ComboFix2.txt 2011-02-27 16:40
ComboFix3.txt 2011-02-26 14:25
ComboFix4.txt 2011-02-23 17:29
ComboFix5.txt 2011-02-27 19:18

Před spuštěním: Volných bajtů: 40 297 455 616
Po spuštění: Volných bajtů: 40 325 304 320

- - End Of File - - DC90F1F2CF6C5E1CF8D92761D53D3387

[Thrall]

Tak znovu vas informuji o stavu meho pc . Nouzak jsem sputil pres msconfig. Zprva jsme byl prekvapen kdyz se mi objevila stranka s vyberem uzivatelu kde byli dva uzivatele : Administrator a Uzivatel . V administratorovi byla pulku plochy atd . V uzivatelu bylo vse normalne tak jsem spustil ComboFIX ale ten hlasil ze je spustena avira a avira hlasila ze je vypnu tak jsem dal config na normal rezim ale hlasilo mi to ze jsou prihlaseni uzivatele a muzou stratit data ,ale ja to stejne restartoval . Pak mi system noralne nabehl ale treba ve slozce disku /C mam ikonku tento pocitac s nazvem combofix . PC se fakt divne chova a ja se bojim abych nestratil sve drahocena data .

[Thrall]

Tady je novy log z combofixu a z RSIT . Nevite proc se mi v documents and settings udelala slozka administrator ? Ja se strasn bojim jestli jsem si nevymazal nejaka data . Vite ja mam rozdelen disk na dva . Na jeden kde mam plochu, dokumenty, windows atd... a druhou kde mam zalohu stareho disku ktera je velika ze kd yby se mi v ni neco smazala nevim jestli bych to poznal ...

omboFix 11-02-27.01 - Uživatel 27.02.2011 21:09:49.40.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1549 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Soubory vytvořené od 2011-01-27 do 2011-02-27 )))))))))))))))))))))))))))))))
.

2011-02-27 19:43 . 2011-02-27 19:47 -------- d-----w- c:\documents and settings\Administrator
2011-02-27 14:24 . 2011-02-27 16:07 -------- d-----w- c:\program files\Virus Removal Tool
2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- C:\Shoty
2011-02-23 20:11 . 2011-02-23 20:11 -------- d-----w- c:\program files\ScreenShots
2011-02-21 19:33 . 2011-02-21 19:33 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Avira
2011-02-21 19:27 . 2011-01-10 13:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-02-21 19:27 . 2011-01-10 13:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-21 19:27 . 2010-06-17 13:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-02-21 19:27 . 2010-06-17 13:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-02-21 19:27 . 2011-02-21 19:27 -------- d-----w- c:\program files\Avira
2011-02-21 19:21 . 2011-02-27 19:16 -------- d-----w- c:\documents and settings\Uživatel\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-21 19:21 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-02-21 19:21 . 2011-02-25 10:32 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-02-21 19:21 . 2011-02-27 19:16 -------- d-----w- c:\program files\Spyware Terminator
2011-02-19 14:28 . 2011-02-19 14:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\EA Core
2011-02-19 14:27 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-02-19 14:02 . 2011-02-19 14:02 -------- d-----w- c:\program files\EA SPORTS
2011-02-19 14:01 . 2011-02-19 14:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Solidshield
2011-02-16 16:33 . 2011-02-16 16:33 -------- d-----w- c:\program files\Empire Interactive

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2008-04-14 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-14 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2008-04-14 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-23 11:27 . 2010-12-23 11:27 69400 ----a-w- c:\windows\system32\drivers\GRD.sys
2010-12-23 11:14 . 2010-12-23 11:14 51832 ----a-w- c:\windows\system32\drivers\GDTdiIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 29640 ----a-w- c:\windows\system32\drivers\GDNdisIc.sys
2010-12-23 11:14 . 2010-12-23 11:14 62584 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2010-12-23 11:14 . 2010-12-23 11:14 33912 ----a-w- c:\windows\system32\drivers\GDBehave.sys
2010-12-22 12:34 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2008-04-14 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 17:09 . 2010-08-27 12:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-08-27 12:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 12:55 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-04-14 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2008-04-14 12:00 2194944 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 15:14 . 2008-04-14 08:06 2071552 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 14:30 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 13:43 . 2010-12-02 13:42 4902596 ----a-w- c:\windows\REGBK00.ZIP
2009-01-15 17:43 . 2009-01-15 17:43 1821008 ----a-w- c:\program files\instmsiw.exe
2009-01-15 17:43 . 2009-01-15 17:43 1707856 ----a-w- c:\program files\instmsia.exe
2009-01-15 17:43 . 2009-01-15 17:43 9296384 ----a-w- c:\program files\openofficeorg30.msi
.

((((((((((((((((((((((((((((( SnapShot_2011-02-23_17.27.11 )))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-02-21 3318784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-02-21 2216960]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^Uživatel^Nabídka Start^Programy^Po spuštění^_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.lnk]
path=c:\documents and settings\Uživatel\Nabídka Start\Programy\Po spuštění\_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.lnk
backup=c:\windows\pss\_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2007-02-26 08:40 249856 ----a-w- c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-01-24 10:32 2289664 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 10:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"\\\\macek\\storage\\Instalace\\!predinstalace\\Nero CZ a Power DVD\\CDS\\Nero\\Installation\\SetupX.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally_SSE1.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.2.2011 20:21 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [21.2.2011 20:27 135336]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5);c:\program files\Google\Update\GoogleUpdate.exe [2.7.2009 11:27 133104]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [14.4.2008 13:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://centrum.cz
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/index.php?toolbar=centrum-1.0.0&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-27 21:15
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2772)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-02-27 21:17:02
ComboFix-quarantined-files.txt 2011-02-27 20:17
ComboFix2.txt 2011-02-27 19:30
ComboFix3.txt 2011-02-27 16:40
ComboFix4.txt 2011-02-26 14:25
ComboFix5.txt 2011-02-27 20:09

Před spuštěním: Volných bajtů: 40 315 805 696
Po spuštění: Volných bajtů: 40 291 831 808

- - End Of File - - 7734733CCB13D01B641EAD4BD2590065

Logfile of random's system information tool 1.08 (written by random/random)
Run by Uživatel at 2011-02-27 21:22:07
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 38 GB (26%) free of 150 GB
Total RAM: 2047 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:22:14, on 27.2.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Documents and Settings\Uživatel\Plocha\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Služba Google Update (gupdate1c9faffc1c539a5) (gupdate1c9faffc1c539a5) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 5704 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-09-02 1241448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-09-02 1241448]
{D5D47440-0750-463D-BAEF-A47D02414806}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-02-21 2216960]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-01-10 281768]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-02-21 3318784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
C:\Program Files\lg_fwupdate\fwupdate.exe [2007-02-26 249856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Uživatel^Nabídka Start^Programy^Po spuštění^_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.lnk]
C:\Documents and Settings\Uživatel\Local Settings\temp\_uninst_setup_9.0.0.722_27.02.2011_14-23.exe.bat []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-07-08 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"\\macek\storage\Instalace\!predinstalace\Nero CZ a Power DVD\CDS\Nero\Installation\SetupX.exe"="\\macek\storage\Instalace\!predinstalace\Nero CZ a Power DVD\CDS\Nero\Installation\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\Program Files\SEGA\SEGA Rally\SEGA Rally.exe"="C:\Program Files\SEGA\SEGA Rally\SEGA Rally.exe:*:Enabled:SEGA Rally"
"C:\Program Files\SEGA\SEGA Rally\SEGA Rally_SSE1.exe"="C:\Program Files\SEGA\SEGA Rally\SEGA Rally_SSE1.exe:*:Enabled:SEGA Rally"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Counter-Strike Source\hl2.exe"="C:\Program Files\Counter-Strike Source\hl2.exe:*:Disabled:hl2"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Disabled:Garena"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2011-02-27 21:17:05 ----D---- C:\WINDOWS\temp
2011-02-27 21:17:03 ----A---- C:\ComboFix.txt
2011-02-27 15:24:55 ----D---- C:\Program Files\Virus Removal Tool
2011-02-23 21:11:45 ----D---- C:\Shoty
2011-02-23 21:11:32 ----D---- C:\Program Files\ScreenShots
2011-02-21 20:33:20 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Avira
2011-02-21 20:27:31 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2011-02-21 20:27:30 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys
2011-02-21 20:27:28 ----D---- C:\Program Files\Avira
2011-02-21 20:21:30 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Spyware Terminator
2011-02-21 20:21:30 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-02-21 20:21:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-02-21 20:21:28 ----D---- C:\Program Files\Spyware Terminator
2011-02-19 15:28:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\EA Core
2011-02-19 15:27:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2011-02-19 15:02:46 ----D---- C:\Program Files\EA SPORTS
2011-02-19 15:01:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\Solidshield
2011-02-16 17:33:41 ----D---- C:\Program Files\Empire Interactive
2011-02-10 08:21:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2478971$
2011-02-10 08:21:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2485376$
2011-02-10 08:21:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2479628$
2011-02-10 08:21:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2483185$
2011-02-10 08:18:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2476687$
2011-02-10 08:18:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2478960$
2011-02-10 08:18:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2393802$
2011-01-28 18:21:29 ----D---- C:\Program Files\Monte Cristo
2011-01-23 17:57:32 ----D---- C:\rsit
2011-01-22 10:50:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Avira
2011-01-19 18:23:42 ----A---- C:\WINDOWS\zip.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWSC.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\SWREG.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\sed.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\PEV.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\NIRCMD.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\MBR.exe
2011-01-19 18:23:42 ----A---- C:\WINDOWS\grep.exe
2011-01-19 18:23:26 ----D---- C:\Qoobox
2011-01-19 13:41:28 ----HDC---- C:\WINDOWS\ie8
2011-01-18 17:08:50 ----D---- C:\Program Files\Unlocker
2011-01-12 18:30:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2419632$
2010-12-30 20:03:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\DivX
2010-12-25 10:45:59 ----HDC---- C:\WINDOWS\$NtUninstallKB963093$
2010-12-25 10:45:34 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2010-12-25 10:45:15 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2010-12-25 10:42:41 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2010-12-24 22:16:23 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Windows Search
2010-12-24 22:12:16 ----D---- C:\WINDOWS\system32\WindowsPowerShell
2010-12-24 22:12:15 ----D---- C:\WINDOWS\system32\winrm
2010-12-24 22:12:11 ----HDC---- C:\WINDOWS\$968930Uinstall_KB968930$
2010-12-24 22:12:09 ----D---- C:\WINDOWS\$NtUninstallKB968930$
2010-12-24 22:11:51 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2010-12-24 22:11:42 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2010-12-24 22:11:25 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Windows Desktop Search
2010-12-24 22:10:35 ----D---- C:\Program Files\Windows Desktop Search
2010-12-24 22:10:34 ----D---- C:\WINDOWS\system32\GroupPolicy
2010-12-24 22:10:22 ----HDC---- C:\WINDOWS\$NtUninstallKB940157$
2010-12-24 22:10:11 ----HDC---- C:\WINDOWS\$NtUninstallKB915800-v4$
2010-12-24 22:09:37 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-12-24 22:09:36 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2010-12-24 22:09:11 ----D---- C:\Program Files\Windows Media Connect 2
2010-12-24 22:09:03 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2010-12-24 22:08:04 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-12-24 22:07:27 ----D---- C:\WINDOWS\system32\LogFiles
2010-12-24 22:07:27 ----D---- C:\WINDOWS\system32\drivers\UMDF
2010-12-24 22:07:24 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-12-24 22:04:46 ----D---- C:\WINDOWS\system32\URTTEMP
2010-12-24 21:36:01 ----D---- C:\Program Files\Microsoft.NET
2010-12-24 21:27:13 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Apple Computer
2010-12-24 21:10:47 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Opera
2010-12-24 21:10:38 ----D---- C:\Program Files\Opera
2010-12-23 12:27:25 ----A---- C:\WINDOWS\system32\drivers\GRD.sys
2010-12-23 12:14:43 ----A---- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys
2010-12-23 12:14:43 ----A---- C:\WINDOWS\system32\drivers\GDNdisIc.sys
2010-12-23 12:14:41 ----A---- C:\WINDOWS\system32\drivers\MiniIcpt.sys
2010-12-23 12:14:41 ----A---- C:\WINDOWS\system32\drivers\GDBehave.sys
2010-12-23 12:14:13 ----D---- C:\Program Files\G Data
2010-12-23 12:14:13 ----D---- C:\Program Files\Common Files\G Data
2010-12-23 12:14:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\G DATA
2010-12-23 12:13:55 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2010-12-23 11:33:45 ----D---- C:\WINDOWS\ERDNT
2010-12-15 18:07:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2296199$
2010-12-15 18:07:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2443105$
2010-12-15 18:06:54 ----HDC---- C:\WINDOWS\$NtUninstallKB2440591$
2010-12-15 18:06:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2443685$
2010-12-15 18:06:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2436673$
2010-12-15 18:06:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2010-12-15 18:04:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2423089$

======List of files/folders modified in the last 3 months======

2011-02-27 21:22:13 ----D---- C:\Program Files\trend micro
2011-02-27 21:17:05 ----D---- C:\WINDOWS
2011-02-27 21:15:14 ----A---- C:\WINDOWS\system.ini
2011-02-27 21:13:18 ----D---- C:\WINDOWS\system32\drivers
2011-02-27 21:13:18 ----D---- C:\WINDOWS\system32
2011-02-27 21:13:18 ----D---- C:\WINDOWS\AppPatch
2011-02-27 21:13:17 ----D---- C:\Program Files\Common Files
2011-02-27 21:09:17 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-02-27 21:08:00 ----D---- C:\WINDOWS\system32\CatRoot2
2011-02-27 21:06:17 ----RASH---- C:\boot.ini
2011-02-27 21:06:17 ----A---- C:\WINDOWS\win.ini
2011-02-27 21:04:33 ----D---- C:\Program Files\lg_fwupdate
2011-02-27 21:04:32 ----A---- C:\WINDOWS\lgfwup.ini
2011-02-27 20:58:08 ----D---- C:\WINDOWS\pss
2011-02-27 20:43:56 ----D---- C:\Documents and Settings
2011-02-27 20:27:23 ----D---- C:\WINDOWS\system32\drivers\etc
2011-02-27 20:26:50 ----D---- C:\WINDOWS\Minidump
2011-02-27 20:09:50 ----D---- C:\WINDOWS\Prefetch
2011-02-27 16:37:40 ----D---- C:\WINDOWS\system32\NtmsData
2011-02-27 16:35:08 ----D---- C:\WINDOWS\Registration
2011-02-27 15:29:08 ----SHD---- C:\System Volume Information
2011-02-27 15:25:07 ----HD---- C:\WINDOWS\inf
2011-02-27 15:24:55 ----RD---- C:\Program Files
2011-02-26 13:07:28 ----D---- C:\Program Files\Electronic Arts
2011-02-26 13:07:27 ----HD---- C:\Program Files\InstallShield Installation Information
2011-02-25 19:19:02 ----HD---- C:\WINDOWS\$hf_mig$
2011-02-25 18:41:37 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Skype
2011-02-25 18:24:22 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\skypePM
2011-02-23 18:16:41 ----D---- C:\WINDOWS\system32\CatRoot
2011-02-23 18:16:36 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-02-23 18:16:28 ----D---- C:\WINDOWS\ie8updates
2011-02-23 18:13:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-02-23 18:12:17 ----D---- C:\WINDOWS\Help
2011-02-23 18:12:13 ----D---- C:\WINDOWS\Cursors
2011-02-23 18:12:09 ----D---- C:\Program Files\Windows NT
2011-02-19 15:28:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Electronic Arts
2011-02-19 15:27:05 ----D---- C:\WINDOWS\system32\DirectX
2011-02-18 16:11:07 ----D---- C:\Program Files\Mozilla Firefox
2011-02-16 17:35:56 ----SHD---- C:\WINDOWS\Installer
2011-02-10 15:13:16 ----D---- C:\WINDOWS\Debug
2011-02-10 08:19:20 ----A---- C:\WINDOWS\system32\MRT.exe
2011-02-10 08:19:11 ----D---- C:\Program Files\Internet Explorer
2011-02-08 06:40:00 ----SD---- C:\WINDOWS\Tasks
2011-02-01 09:16:10 ----D---- C:\WINDOWS\Network Diagnostic
2011-01-29 21:13:12 ----D---- C:\Documents and Settings\Uživatel\Data aplikací\Media Player Classic
2011-01-28 18:52:22 ----D---- C:\Program Files\Warcraft III
2011-01-22 10:46:35 ----D---- C:\Program Files\World of Warcraft Model Viewer
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shimgvw.dll
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shell32.dll
2011-01-19 18:23:41 ----D---- C:\WINDOWS\system32\Restore
2011-01-19 13:49:13 ----D---- C:\WINDOWS\system32\cs-cz
2011-01-19 13:42:08 ----D---- C:\WINDOWS\WBEM
2011-01-19 13:41:53 ----D---- C:\WINDOWS\Media
2011-01-07 15:09:02 ----A---- C:\WINDOWS\system32\atmfd.dll
2011-01-02 16:53:52 ----D---- C:\Program Files\World of Warcraft
2011-01-01 22:46:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-01-01 18:45:55 ----D---- C:\Program Files\ICQ6.5
2010-12-29 18:20:52 ----A---- C:\WINDOWS\NeroDigital.ini
2010-12-25 09:06:16 ----RSD---- C:\WINDOWS\assembly
2010-12-25 09:06:16 ----D---- C:\WINDOWS\Microsoft.NET
2010-12-24 22:19:12 ----D---- C:\WINDOWS\system32\config
2010-12-24 22:19:05 ----D---- C:\WINDOWS\system
2010-12-24 22:19:05 ----D---- C:\Program Files\Google
2010-12-24 22:12:15 ----D---- C:\WINDOWS\system32\wbem
2010-12-24 22:11:48 ----D---- C:\WINDOWS\security
2010-12-24 22:11:40 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-12-24 22:10:54 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-12-24 22:09:11 ----D---- C:\Program Files\Windows Media Player
2010-12-24 21:36:57 ----D---- C:\WINDOWS\WinSxS
2010-12-23 21:01:10 ----D---- C:\WINDOWS\repair
2010-12-22 13:34:22 ----A---- C:\WINDOWS\system32\kerberos.dll
2010-12-21 00:52:37 ----A---- C:\WINDOWS\system32\wininet.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\occache.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\mstime.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\mshtmled.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\licmgr10.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\jsproxy.dll
2010-12-21 00:52:36 ----N---- C:\WINDOWS\system32\iepeers.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\urlmon.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\mshtml.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\msfeeds.dll
2010-12-21 00:52:36 ----A---- C:\WINDOWS\system32\iertutil.dll
2010-12-21 00:52:35 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2010-12-20 18:25:50 ----A---- C:\WINDOWS\system32\lsasrv.dll
2010-12-20 13:55:37 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2010-12-20 11:52:38 ----A---- C:\WINDOWS\system32\ieframe.dll
2010-12-15 18:04:15 ----D---- C:\Program Files\Outlook Express
2010-12-09 16:15:19 ----A---- C:\WINDOWS\system32\ntdll.dll
2010-12-09 16:14:08 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2010-12-09 16:14:04 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2010-12-09 15:30:13 ----A---- C:\WINDOWS\system32\csrsrv.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R0 viamraid;viamraid; C:\WINDOWS\system32\drivers\viamraid.sys [2009-06-25 104064]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2009-06-25 9216]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2011-01-10 135096]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2011-01-10 61960]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-07-08 3257344]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-20 93696]
R3 catchme;catchme; \??\C:\DOCUME~1\UIVATE~1\LOCALS~1\Temp\catchme.sys []
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2005-12-15 1368000]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S3 ctljystk;Game port pro zařízení Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
S3 mbr;mbr; \??\C:\ComboFix\mbr.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-01-10 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-01-10 135336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-07-08 573440]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-02-21 496128]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-02 133104]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-09-17 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Omlouvám se, nebyla jsem celý den u počítače .

Tak combofix něco smazal. Podívejte se co je ve složce administrátor, ale já bych řekla, že je vše v pořádku. V lozích už nic zákeřného nevidím.
Obnovu systému vymažeme, pokud by jste měl dojem, že tam stále je, podíváme se na to pořádně.

Podívejte se, zda vám nechybí žádná data a napište mi, jaký je stav počítače ted.


Tohle jsou co za soubory?
C:\Documents and Settings\Uživatel\Plocha\Ostatni slozky\Download\WMV_Installer_v0701_r206_Win32.msi Nelze dezinfikovat
27.2.2011 15:47:57 Odstraněno: not-a-virus:AdWare.Win32.AdMedia.kw C:\Documents and Settings\Uživatel\Plocha\Ostatni slozky\Download\WMV_Installer_v0701_r206_Win32.msi

[Thrall]

Administratorovi jsou slozky ktere jsou prazdne .
Tamto je instalator WMV (myslim ze je to instalator takoveho toho sceneru ketry mate i tady na forum.Ten jak ma hodne falesnych detekci)
Jinak mohl jsem si neco smazat spustenim toho SAFEBOOTU? Me to neco takove psalo jako ze " Uzivatele jsou prihlaseni a restartovanim by mohli prijit o data " . Jsem se mel napred asi odhlasit co ? A co to bylo za havet a kde se vzala ?? Dnes jsem uplne normalne fungoval ... S tim "do hloubky" bych souhlasil .

[motji]

Nevím jakým způsobem jste ten nouzový režim spustil, ale nemyslím si, že by jste tím přišel o data.
Vyzkoušejte ted, jestli se Vám podaří spustit nouzový režim klasicky, tedy po restartu mačkejte F8, nouzový režim

Kde se ta havět vzala, netuším, můžeme ještě udělat gmer, pokud jsme ho nedělali

[Thrall]

Spustil jsem ho pres msconfig jak radite na forum . Popisuvam co jsem udelal a vy mi prosím reknete jestli jsem nekde neudelal chybu: Mam navyber si vybrat dva ucty vyberu (novy/predtim neznamy) ADMINISTRATOR . Tam je pulka plochy ,po spusteny internetu tam nejsou zadne oblibene a neni tam domovska stranka . Prepnu na ucet UZIVATEL ,tam je vse O.K. . Spustim Combofix ale hlasy ze je zapnuta Avira ,ale Avira hlasi ze je vypnuta .Tedy kliknu na OK ale Combofix hlasy ze je porad spustena Avira a ted se spusti ,ale na moje riziko . Zmenim v msconfigu na normalni rezim . Potom me to vyzve k restartovani , ja dam OK ale pc hlasi z jsou prihlaseni uzivatele a mohl bych stratit data ,ale ja podtlakem stejne restartuji a rychle odkliknu spoustejici Combofix . PS: Omlouvam se za pravopis ,pisu velmi rychle mam malo casu .

[motji]

Avira je sice vypnutá, ale combofix na ni prostě reaguje, to by nevadilo.
Ale nouzový režim se spouští až po restartu, tlačítkem F8


Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[Thrall]

Zapominate na postup ketry mate napsany na forum http://www.viry.cz/forum/viewtopic.php?t=7554 . Pres msconfig .

[motji]

Vzhledem k tomu, že my tu používáme hned ten první postup, tak na ten druhý jsem nepomyslela . ten první mi prostě přijde lepší.

[Thrall]

Vzhledem k tomu, že my tu používáme hned ten první postup, tak na ten druhý jsem nepomyslela . ten první mi prostě přijde lepší.

To jo no Ale me proste nejak nejde . Ja asi budu muset bezet . To znamena ze ta hlaska windowsu ze "Jsou prihlaseni uzivatele a vypnutim by mohlo dojit ke strate dat " byla plana ? Pak kdy by to slo zkuste sama tento zpusob nouzoveho rezimu . Jinak dekuji za dnesni pomoct . Ono stejne kdy by se nedejboze neco stratilo muze me jeste zachranit obnova systemu ,ne ? Tesne pred tim nouzakem jsem delal ComboFix a ten si vzdycky udela novou ,ale jak koukam do CCleaneru posledni obnovu mam z 26 a to je docela blby kdyz pomyslim ze dneska jsme z te obnovy mazali dost svinstva .