Prosím o pomoc, kontrolu něco je špatně

[Kope]

Dobrý den

Viditelné problémy -
1. restartování plochy, ikon (celá plocha na profilu se prostě restartla do defaultního nastavení když to tak řeknu a nejde nijak změnit pouze "klasicke nastaveni") takže to vypadá hrozně....
2. Start- všechyn programy vše zmizelo nejvíc mě štvě že tam není ani obnova systému a ani nikde jinde se mi ho nepodařilo najít.
3. Funkce Nápověda a odborná pomoc taky nefunguje

A vůbec si nedokážu vysvětlit jak k tomu mohlo samo od sebe dojít, příjdu k pc a najednou prostě jak kdyby to někdo přeinstaloval jen s tím že na disku vše je jen plocha a start- programy se tvařejí jako že v pc nic neni...




elLogfile of random's system information tool 1.08 (written by random/random)
Run by KoPe at 2011-05- 20:03:28
WIN_XP Service Pack 3
System drive C: has 4 GB (20%) free of 20 GB
Total RAM: 2046 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:03:32, on 16.5.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\KoPe.N9500-1GB\Dokumenty\Stažené soubory\RSIT.exe
C:\trend micro\KoPe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-19\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" (User '?')
O4 - HKUS\S-1-5-21-1229272821-1450960922-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: TPSvc - TPSvc.dll (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6202 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-1450960922-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-1450960922-839522115-1003UA.job
C:\WINDOWS\tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1302640198.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-14 37888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\KoPe\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-03-01 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-06-19 570664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroHomeFirstStart]
C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe [2008-06-24 19752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2009-01-16 13680640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
D:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2010-03-01 306088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2009-10-16 18782720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]


GoogleUpdateTaskUserS-1-5-21-1229272821-1450960922-839522115-1003Core.job
GoogleUpdateTaskUserS-1-5-21-1229272821-1450960922-839522115-1003UA.job
HP DArC Task #Hewlett-Packard#hp psc 1300 series#1302640198.job
SA.DAT
SCHEDLGU.TXT

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc]
TPSvc.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="D:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"D:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="D:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"D:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="D:\Program Files\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"E:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2BetaUpdater.exe"="E:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2BetaUpdater.exe:*:Enabled:Battlefield Bad Company 2 - BETA"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Football Superstars\FSClientr.exe"="D:\Football Superstars\FSClientr.exe:*:Enabled:FSClientr"
"C:\Program Files\Common Files\Nero\Nero Web\SetupX.exe"="C:\Program Files\Common Files\Nero\Nero Web\SetupX.exe:*:Enabled:Nero ControlCenter"
"C:\QIP Infium JadrisPack\infium.exe"="C:\QIP Infium JadrisPack\infium.exe:*:Enabled:QIP Infium"
"E:\Ubisoft\IL-2 Sturmovik 1946\il2fb.exe"="E:\Ubisoft\IL-2 Sturmovik 1946\il2fb.exe:*:Enabled:il2fb"
"E:\EA Games\Ultima Online 2D Client\client.exe"="E:\EA Games\Ultima Online 2D Client\client.exe:*:Enabled:Ultima Online Client"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"E:\Program Files\THQ\Company of Heroes\RelicCOH.exe"="E:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:RelicCOH"
"E:\Program Files\THQ\Company of Heroes\BugReport\BugReport.exe"="E:\Program Files\THQ\Company of Heroes\BugReport\BugReport.exe:*:Enabled:BugReport"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"D:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe"="D:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"E:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.exe"="E:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\Documents and Settings\KoPe\Data aplikací\Football Superstars\FSClientr.exe"="D:\Documents and Settings\KoPe\Data aplikací\Football Superstars\FSClientr.exe:*:Enabled:FSClientr"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"E:\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="E:\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\Program Files\HLSW\hlsw.exe"="C:\Program Files\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe"="C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe:*:Enabled:aTube Catcher to download and convert videos."
"E:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe"="E:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe:*:Enabled:Need for Speed(TM) Hot Pursuit"
"E:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\NFS11.exe"="E:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\NFS11.exe:*:Enabled:Need for Speed(TM) Hot Pursuit Application"
"C:\Program Files\SpacialAudio\SAMBC\SAMBC.exe"="C:\Program Files\SpacialAudio\SAMBC\SAMBC.exe:*:Enabled:SAMBC"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Documents and Settings\KoPe\Data aplikací\GameRanger\GameRanger\GameRanger.exe"="C:\Documents and Settings\KoPe\Data aplikací\GameRanger\GameRanger\GameRanger.exe:*:Enabled:GameRanger"
"I:\Program Files\CABAL\launcher\update\ESTdnheadless.exe"="I:\Program Files\CABAL\launcher\update\ESTdnheadless.exe:*:Enabled:EST! download engine"
"D:\Program Files\launcher\update\ESTdnheadless.exe"="D:\Program Files\launcher\update\ESTdnheadless.exe:*:Enabled:EST! download engine"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"

======List of files/folders created in the last 1 months======

2011-05-20 19:01:36 ----D---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\Macromedia
2011-05-20 18:54:55 ----D---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\vlc
2011-05-20 17:22:38 ----D---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\Winamp
2011-05-20 17:14:23 ----D---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\Mozilla
2011-05-20 16:59:32 ----D---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\Adobe
2011-05-20 15:20:30 ----D---- C:\WINDOWS\Common Files
2011-05-20 15:19:59 ----SD---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\Microsoft
2011-05-20 15:19:59 ----ASH---- C:\Documents and Settings\KoPe.N9500-1GB\Data aplikací\desktop.ini
2011-05-20 15:17:38 ----D---- C:\WINDOWS\system32\%programfiles%
2011-05-20 15:17:37 ----D---- C:\WINDOWS\system32\%commonprogramfiles%
2011-05-16 19:46:26 ----D---- C:\trend micro
2011-05-16 19:46:26 ----D---- C:\rsit
2011-05-16 19:46:26 ----D---- \trend micro
2011-05-16 19:46:26 ----D---- \trend micro
2011-05-16 19:46:26 ----D---- \rsit
2011-05-16 19:46:26 ----D---- \rsit
2011-05-01 22:14:21 ----A---- C:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2011-05-20 19:00:14 ----SHD---- C:\WINDOWS\Installer
2011-05-20 19:00:14 ----D---- C:\Config.Msi
2011-05-20 19:00:14 ----D---- \Config.Msi
2011-05-20 19:00:14 ----D---- \Config.Msi
2011-05-20 19:00:10 ----D---- C:\WINDOWS\Prefetch
2011-05-20 18:56:07 ----D---- C:\WINDOWS
2011-05-20 18:56:07 ----D---- \WINDOWS
2011-05-20 18:56:07 ----D---- \WINDOWS
2011-05-20 18:56:06 ----A---- C:\WINDOWS\imsins.BAK
2011-05-20 17:22:57 ----A---- C:\WINDOWS\NeroDigital.ini
2011-05-20 16:52:17 ----D---- C:\WINDOWS\system32\drivers
2011-05-20 15:18:04 ----SD---- C:\WINDOWS\Tasks
2011-05-20 15:16:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-05-18 22:49:12 ----RD---- C:\Program Files
2011-05-18 22:49:12 ----RD---- \Program Files
2011-05-18 22:49:12 ----RD---- \Program Files
2011-05-18 20:45:03 ----D---- C:\WINDOWS\inf
2011-05-16 19:52:38 ----D---- C:\WINDOWS\system32\CatRoot2
2011-05-16 19:52:17 ----D---- C:\WINDOWS\Temp
2011-05-16 19:31:33 ----D---- C:\Documents and Settings
2011-05-16 19:31:33 ----D---- \Documents and Settings
2011-05-16 19:31:33 ----D---- \Documents and Settings
2011-05-16 19:28:21 ----D---- C:\WINDOWS\system32
2011-05-14 17:30:13 ----D---- C:\WINDOWS\Debug
2011-05-14 12:46:37 ----D---- C:\WINDOWS\Minidump
2011-05-12 10:40:09 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2011-05-12 03:05:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-05-12 03:01:46 ----A---- C:\WINDOWS\system32\MRT.exe
2011-05-01 21:29:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\firebird

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-03-01 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2011-04-12 43488]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R2 npf;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2009-11-16 50704]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add; C:\WINDOWS\system32\DRIVERS\GcKernel.sys [2008-04-13 59136]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2011-04-03 25280]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual; C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys [2001-08-18 2688]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-10-28 5937152]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-16 6305120]
R3 NVENETFD;NVIDIA nForce 10/100 Mbps Ethernet ; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2008-08-01 54784]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2008-08-01 22016]
R3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA; C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys [2001-08-18 3968]
S3 a8um6znz;a8um6znz; C:\WINDOWS\system32\drivers\a8um6znz.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 GMSIPCI;GMSIPCI; \??\G:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-22 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-22 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-06-22 21744]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSICPL;MSICPL; \??\G:\install4\MSICPL.sys []
S3 NTACCESS;NTACCESS; \??\G:\NTACCESS.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\G:\NTGLM7X.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe [2010-09-17 98304]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-12-02 75136]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe [2010-09-17 3735552]
S2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe []
S2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-16 163908]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2011-04-07 4350944]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Kope]

Tak nevím combo nějak nereaguje..... normál to scanovalo pak to napsalo že je to uspesně dokončeno a completni a modrá tabulka zmizela a nic to nedela normal jen plocha na ktere je jen pozadi a kurzor.... proste mrtvo... co ted ?

[Rudy]

Pokud neexistuje soubor logu v c:\combofix.txt, udělejte nový sken, ale v nouz. režimu.

[Kope]

Tak tady to je... to byl porod....

ComboFix 11-05-19.02 - KoPe 16.05.2011 21:27:25.1.2 - x86
Spuštěný z: c:\documents and settings\KoPe.N9500-1GB\Dokumenty\Stažené soubory\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
/wow section - STAGE 27
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
Systém nemůže nalézt uvedenou cestu.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
SED: can't read CuRun.dmp: No such file or directory
SED: can't read CuRun.dmp: No such file or directory
grep: temp2401: No such file or directory
_____ _ _
_ __ _____ _| ___(_)_ __ __| |
| '_ \ / _ \ \ / / |_ | | '_ \ / _` |
| |_) | __/\ V /| _| | | | | | (_| |
| .__/ \___| \_/ |_| |_|_| |_|\__,_|
|_| by Billy Robert O'Neal III
Version 1021
Distributed under the Boost Software License, Version 1.0.
http://www.boost.org/LICENSE_1_0.txt
pevFind contains some code from Info-ZIP, used with permission.
In accordance with Info-ZIP's License, it can be found at
http://billy-oneal.com/infozip.txt
Filename regular expressions library is
Copyright (C)1997-1998 by David R. Tribble, all rights reserved.
.
Nesprávná syntaxe příkazu
.
.
Přerušeno ... Prosím spusťte ComboFix znovu.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Ijl11.dll
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\vbpng1.dll
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-16 do 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-20 13:20 . 2011-05-20 13:20 -------- d-----w- c:\windows\Common Files
2011-05-20 13:19 . 2011-05-20 15:26 -------- d-----w- c:\documents and settings\KoPe.N9500-1GB
2011-05-20 13:17 . 2011-05-20 13:17 -------- d-sh--w- c:\documents and settings\LocalService.NT AUTHORITY
2011-05-20 13:17 . 2011-05-20 13:17 -------- d-sh--w- c:\documents and settings\NetworkService.NT AUTHORITY
2011-05-20 13:17 . 2011-05-20 13:17 -------- d-----w- c:\windows\system32\%programfiles%
2011-05-20 13:17 . 2011-05-20 13:17 -------- d-----w- c:\windows\system32\%commonprogramfiles%
2011-05-16 19:25 . 2011-05-16 19:25 -------- d-sha-r- \cmdcons \cmdcons
2011-05-16 19:25 . 2011-05-16 19:25 -------- d-sha-r- \cmdcons \cmdcons
2011-05-16 19:21 . 2011-05-16 19:57 -------- d-----w- \ComboFix \ComboFix
2011-05-16 19:21 . 2011-05-16 19:57 -------- d-----w- \ComboFix \ComboFix
2011-05-16 19:17 . 2011-05-16 19:22 -------- d-----w- \Qoobox \Qoobox
2011-05-16 19:17 . 2011-05-16 19:22 -------- d-----w- \Qoobox \Qoobox
2011-05-16 17:46 . 2011-05-16 18:03 -------- d-----w- C:\trend micro
2011-05-16 17:46 . 2011-05-16 18:03 -------- d-----w- \trend micro \TRENDM~1
2011-05-16 17:46 . 2011-05-16 18:03 -------- d-----w- \trend micro \TRENDM~1
2011-05-16 17:46 . 2011-05-16 17:46 -------- d-----w- C:\rsit
2011-05-16 17:46 . 2011-05-16 17:46 -------- d-----w- \rsit \rsit
2011-05-16 17:46 . 2011-05-16 17:46 -------- d-----w- \rsit \rsit
2011-05-05 15:52 . 2011-05-05 15:52 -------- d-----w- c:\documents and settings\KoPe\Data aplikací\dvdcss
2011-05-01 20:14 . 2011-05-01 20:14 -------- d-----w- c:\documents and settings\Administrator
2011-04-25 20:31 . 2011-04-25 20:31 -------- d-----w- c:\documents and settings\KoPe\Data aplikací\vlc
2011-04-25 06:25 . 2011-04-25 06:25 -------- d-----w- c:\documents and settings\KoPe\Local Settings\Data aplikací\GamePlayLabs Plugin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 16:38 . 2010-03-01 16:38 0 --sha-r- \MSDOS.SYS \MSDOS.SYS
2010-03-01 16:38 . 2010-03-01 16:38 0 --sha-r- \IO.SYS \IO.SYS
2010-03-01 16:38 . 2010-03-01 16:38 0 ----a-w- \CONFIG.SYS \CONFIG.SYS
2010-03-01 16:38 . 2010-03-01 16:38 0 ----a-w- \AUTOEXEC.BAT \AUTOEXEC.BAT
2004-08-03 20:38 . 2004-08-03 20:38 47564 --sha-r- \NTDETECT.COM \NTDETECT.COM
2001-10-25 14:00 . 2001-10-25 14:00 4952 --sha-r- \Bootfont.bin \Bootfont.bin
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\KoPe\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Obsah aplikace OneNote.onetoc2 [2010-10-31 3656]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\docume~1\ALLUSE~1\NABDKA~1\Programy\POSPUT~1\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-7-7 233472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-01 17:42 135664 ----atw- c:\documents and settings\KoPe\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-06-24 15:06 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-06-08 08:31 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-06-19 08:53 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroHomeFirstStart]
2008-06-24 15:05 19752 ----a-w- c:\program files\Common Files\Nero\Lib\NMFirstStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-01-16 01:42 13680640 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-01-16 01:42 1657376 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2010-03-01 21:04 306088 ----a-w- d:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-10-16 12:59 18782720 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 13:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
2008-08-15 16:33 1473536 ----a-w- c:\program files\TO2SSM\McciTrayApp.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Football Superstars\\FSClientr.exe"=
"c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"c:\\QIP Infium JadrisPack\\infium.exe"=
"e:\\Ubisoft\\IL-2 Sturmovik 1946\\il2fb.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"=
"e:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"e:\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Program Files\\DsNET Corp\\aTube Catcher 2.0\\yct.exe"=
"e:\\Program Files\\Electronic Arts\\Need for Speed(TM) Hot Pursuit\\Launcher.exe"=
"e:\\Program Files\\Electronic Arts\\Need for Speed(TM) Hot Pursuit\\NFS11.exe"=
"c:\\Program Files\\SpacialAudio\\SAMBC\\SAMBC.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Documents and Settings\\KoPe\\Data aplikací\\GameRanger\\GameRanger\\GameRanger.exe"=
"d:\\Program Files\\launcher\\update\\ESTdnheadless.exe"=
.
R1 aswSP;aswSP; [x]
R2 aswFsBlk;aswFsBlk; [x]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_5\bin\fbguard.exe [2010-09-17 98304]
R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_5\bin\fbserver.exe [2010-09-17 3735552]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-04-07 4350944]
R3 SetupNTGLM7X;SetupNTGLM7X;G:\NTGLM7X.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-01 691696]
S3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA;c:\windows\system32\DRIVERS\SWUSBFLT.sys [2001-08-17 3968]
.
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Notify-TPSvc - TPSvc.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 21:57
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Celkový čas: 2011-05-16 22:00:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-05-16 20:00
.
Před spuštěním: 930 136 064
Po spuštění: 4 002 689 024
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - CCF648CB950AC9DAB04F1726B19D6CD3

[Rudy]

Pár infekcí CF smazal, nicméně to vypadá na poškozený systém. Jak se nyní PC chová?

[Kope]

Mno jediná změna kterou jsem zaznamenal je ta že funguje funkce "nápověda a odborná pomoc" která mě moc nezajímá jinak furt stejný v základním zobrazení a například funkce "hledat" nefunguje stále.... Já bych tam hodil cd s win. a dal bych opravit jenže problém je v tom že prostě to nenabootuju... nevím jak je to možné ale já tu cd-romku ani v tom biosu nevidím přitom když mi pc naběhne tak jí tu mám a normál cd spustím tak to nechápu....

[Rudy]

To je zajímavé. Zkuste provést reset biosu (vyjměte zálohovací baterii na cca 20s a pak ji vložte zpět a spusťte PC). Nechápu, jak je možné, že bios CDROM nevidí a Win ano. Pak zkuste tu opravu. Jinou možnost nevidím.

[Kope]

No taky jsem to nechápal ale ten restart BIOSU pomohl a podařilo se nabootovat. udělal jsem jen opravu a vše vypadá že jede jak má zatím žádnej problém. Ale vůbec si nedokážu vysvětlit jak k tomu mohlo dojít co se to vlastně stalo a proč to udělalo jentak zničeho nic.... Virus tedy můžeme vyloužit? Popřípadně nemám to ještě něčím projet? Jinak samozřejmně děkuji za pomoc.

[Rudy]

Virus bych vyloučil. Pokud by se problém opakoval, byl by asi nutný reflash biosu. Proč se to stalo, se můžeme jen dohadovat.

[Kope]

Ještě mám dotaz, když chci spustit Microsoft Office tak mi to hodí Windows Installer a píše to že funkce kterou chci použít se nachází na síťovém prostředku který není přístupný + tam mám možnost zadat cestu instalačního balíčku -> zadám tam zdroj a nic se nestane zmizí to.... to samé to dělá když se to pokusím odinstalovat jak přes ovládací panely či odstranit v programu CCleaner prostě nic nemůžu to z pc zaboha dostat a nový Office mi nainstalovat nejdou píše to neznámou chybu při instalaci takže asi nejdřív prostě musím dostat pryč ty staré....

[Rudy]

MSOffice asi chybí nějaký komponent a žádá o jeho doinstalování. K tomu budete potřebovat orig. instalační CD.

[Kope]

Nevíte prosím jak se zbavím při startu pc "Vyberte operační systém který chcete spustit" a teď tu mám ten svůj Win a po těch scriptech se tu objevila ještě možnost "Recovery Consol" díky

[Rudy]

To nemáte ze skriptů, nýbrž proto, že dostatečně nečtete pokyny. Já jsem po vás nechtěl, abyste instaloval recovery console. Kdyby tomu tak bylo, zvlášť bych vás na to upozornil. Při výběru OS (pokud nebudete nic tisknout) zdrží start cca o 3s a nastaruje Win. Pokud vám to natolik vadí, že to v PC nechcete, budete muset editovat soubor boot.ini do této podoby.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

Vřele doporučuji si zazálohovat původní soubor, neboť při chybě editace se vám může stát, že Winm nenastartujete.