Občasné zamrznutí PC

[Zafrin]

Tak po přehození z ATI na nVidii, jsem neočekával žádné problémy, ale avšak však zmýlil jsem se. Po přechodu na nVidii sice vše šlape jak hodinky, výkon PC vzrostl absolutně nad očekávání, ale semo tamo se projeví malinkatý problémeček.
Občas dojde k zamrznutí počítače, hlavně při sledování videí na youtube.com nebo stream.cz (Flash Player problém?) a často dochází k zamrznutí počítače při hraní minecraftu (kde zároveň hostuji server - vše jede na Javě). Mám ASUS ENGTS 250 a jak název napovídá jádro GTS 250 od nVidie, pro jistotu jsem downgradnul drivery na verzi, která je ke stažení na domovských stránkách ASUSu (kvůli možnému konfliktu s deskou - viz. moje problémy s ASUS EAH3650 (ATI))
Taky jsem si několikrát všiml velice krátkého probliknutí černých artefaktů (?) na obrazovce.

Mimochodem maximální teplota, co se mi kdy podařila na kartě byla 43°C..

Zde přikládám log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Alexandr at 2011-05-31 19:34:51
Microsoft Windows XP Professional Service Pack 3
System drive C: has 17 GB (43%) free of 38 GB
Total RAM: 2046 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:35:01, on 31.5.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wltray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\SearchIndexer.exe
D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
D:\Downloads\Mods\RSIT (1).exe
C:\Program Files\trend micro\Alexandr.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\System32\wltray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ASUS Update Checker] C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://D:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0735348578
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9301 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1085031214-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1085031214-839522115-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-04-15 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-04-11 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"wltray.exe"=C:\WINDOWS\System32\wltray.exe [2005-06-08 778318]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2006-07-13 729088]
"ASUS Update Checker"=C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28 121472]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-03-04 281768]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-01-30 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-03-21 1230704]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2011-03-23 111208]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-03-23 13881448]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Alexandr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c []
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
D:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-09-28 159744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Games\World_of_Tanks_closed_Beta\WOTLauncher.exe"="D:\Games\World_of_Tanks_closed_Beta\WOTLauncher.exe:*:Enabled:World of Tanks Launcher"
"D:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe"="D:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe:*:Enabled:World of Tanks"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe"="D:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager"
"D:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe"="D:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi"
"D:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe"="D:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin"
"D:\Games\BFP4f.exe"="D:\Games\BFP4f.exe:*:Enabled:BFP4f"
"D:\Program Files\Microsoft Office\Office14\ONENOTE.EXE"="D:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe"="C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"D:\Program Files\Game\hl2.exe"="D:\Program Files\Game\hl2.exe:*:Enabled:hl2"
"D:\Games\Starcraft\StarCraft.exe"="D:\Games\Starcraft\StarCraft.exe:*:Enabled:Starcraft"
"D:\Downloads\Command.and.Conquer.Red.Alert.3.Multi4.Full-Rip.Skullptura\Data\ra3_1.0.game"="D:\Downloads\Command.and.Conquer.Red.Alert.3.Multi4.Full-Rip.Skullptura\Data\ra3_1.0.game:*:Enabled:Command & Conquer™ Red Alert™ 3"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\Documents and Settings\Alexandr\Application Data\GameRanger\GameRanger\GameRanger.exe"="C:\Documents and Settings\Alexandr\Application Data\GameRanger\GameRanger\GameRanger.exe:*:Enabled:GameRanger"
"D:\Games\Titan Quest\Titan Quest.exe"="D:\Games\Titan Quest\Titan Quest.exe:*:Enabled:Titan Quest"
"D:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe"="D:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe:*:Enabled:Tqit"
"C:\Program Files\1C Company\Men of War. Assault Squad\mow_assault_squad.exe"="C:\Program Files\1C Company\Men of War. Assault Squad\mow_assault_squad.exe:*:Enabled:Main executable"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Games\World_of_Tanks\WOTLauncher.exe"="D:\Games\World_of_Tanks\WOTLauncher.exe:*:Enabled:World of Tanks Launcher"
"D:\Games\World_of_Tanks\WorldOfTanks.exe"="D:\Games\World_of_Tanks\WorldOfTanks.exe:*:Disabled:World of Tanks"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-05-31 19:34:51 ----D---- C:\rsit
2011-05-31 19:34:51 ----D---- C:\Program Files\trend micro
2011-05-30 18:02:25 ----A---- C:\WINDOWS\Panzer Command Ostfront Demo Uninstall Log.txt
2011-05-25 14:07:26 ----D---- C:\Documents and Settings\Alexandr\Application Data\Mumble
2011-05-25 14:07:06 ----D---- C:\Program Files\Mumble
2011-05-21 12:31:22 ----D---- C:\Documents and Settings\All Users\Application Data\Skype Extras
2011-05-21 12:30:55 ----D---- C:\Program Files\Common Files\Skype
2011-05-20 21:32:34 ----RHD---- C:\Documents and Settings\Alexandr\Application Data\SecuROM
2011-05-16 17:44:36 ----A---- C:\WINDOWS\system32\nvunrm.exe
2011-05-16 17:44:36 ----A---- C:\WINDOWS\system32\nvuninst.exe
2011-05-16 17:17:21 ----RA---- C:\WINDOWS\system32\nvgenco322040.dll
2011-05-16 17:17:21 ----RA---- C:\WINDOWS\system32\nvdispco322090.dll
2011-05-16 17:17:06 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-05-16 17:17:04 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2011-05-16 17:17:04 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2011-05-16 17:17:04 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2011-05-16 17:17:04 ----A---- C:\WINDOWS\system32\nvcuda.dll
2011-05-16 17:17:02 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-05-16 17:17:02 ----A---- C:\WINDOWS\system32\nvapi.dll
2011-05-16 17:16:38 ----D---- C:\Program Files\NVIDIA Corporation
2011-05-16 17:11:22 ----A---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-05-16 17:11:18 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-05-16 15:07:27 ----D---- C:\Documents and Settings\Alexandr\Application Data\.minecraft
2011-05-15 18:34:23 ----D---- C:\Documents and Settings\Alexandr\Application Data\DivX
2011-05-14 16:49:38 ----D---- C:\Program Files\1C Company
2011-05-14 16:01:10 ----A---- C:\WINDOWS\Panzer Command Ostfront Demo Setup Log.txt
2011-05-12 14:53:45 ----D---- C:\Documents and Settings\Alexandr\Application Data\DDMSettings
2011-05-12 14:50:22 ----D---- C:\Program Files\Common Files\DivX Shared
2011-05-12 14:49:57 ----D---- C:\Program Files\DivX
2011-05-12 14:49:12 ----D---- C:\Documents and Settings\All Users\Application Data\DivX
2011-05-10 21:41:08 ----D---- C:\Documents and Settings\Alexandr\Application Data\GameRanger
2011-05-10 18:18:08 ----RA---- C:\WINDOWS\system32\psfind.dll
2011-05-09 21:02:30 ----A---- C:\WINDOWS\system32\drivers\AmdLLD.sys
2011-05-09 21:02:29 ----D---- C:\Program Files\AMD
2011-05-09 20:48:34 ----D---- C:\Documents and Settings\Alexandr\Application Data\NVIDIA
2011-05-09 20:42:32 ----D---- C:\NVIDIA
2011-05-09 17:03:44 ----D---- C:\Program Files\Phyxion.net
2011-05-07 23:00:16 ----D---- C:\Documents and Settings\Alexandr\Application Data\Red Alert 3
2011-05-07 21:12:09 ----D---- C:\Program Files\Microsoft XNA

======List of files/folders modified in the last 1 months======

2011-05-31 19:35:01 ----D---- C:\WINDOWS\Prefetch
2011-05-31 19:34:51 ----RD---- C:\Program Files
2011-05-31 19:27:20 ----D---- C:\Documents and Settings\Alexandr\Application Data\Skype
2011-05-31 17:41:06 ----D---- C:\WINDOWS\Temp
2011-05-31 17:39:45 ----D---- C:\Documents and Settings\Alexandr\Application Data\skypePM
2011-05-31 17:08:35 ----D---- C:\WINDOWS\system32\CatRoot2
2011-05-31 17:08:17 ----D---- C:\WINDOWS
2011-05-30 23:26:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-05-29 15:51:11 ----SHD---- C:\WINDOWS\Installer
2011-05-29 15:50:55 ----D---- C:\Program Files\Google
2011-05-25 16:43:51 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2011-05-25 16:43:48 ----SD---- C:\Documents and Settings\Alexandr\Application Data\Microsoft
2011-05-25 14:07:07 ----D---- C:\WINDOWS\system32
2011-05-23 22:58:40 ----D---- C:\Documents and Settings\Alexandr\Application Data\uTorrent
2011-05-23 18:29:07 ----D---- C:\WINDOWS\WinSxS
2011-05-23 18:28:52 ----D---- C:\WINDOWS\system32\DirectX
2011-05-23 18:28:50 ----HD---- C:\WINDOWS\inf
2011-05-23 18:27:35 ----RSD---- C:\WINDOWS\assembly
2011-05-23 16:03:56 ----HD---- C:\Program Files\InstallShield Installation Information
2011-05-22 13:53:48 ----D---- C:\Documents and Settings\Alexandr\Application Data\gtk-2.0
2011-05-21 12:31:23 ----RD---- C:\Program Files\Skype
2011-05-21 12:30:55 ----D---- C:\Program Files\Common Files
2011-05-21 12:30:53 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2011-05-20 21:32:33 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2011-05-16 18:31:44 ----D---- C:\WINDOWS\Microsoft.NET
2011-05-16 17:45:24 ----D---- C:\WINDOWS\system32\CatRoot
2011-05-16 17:44:38 ----D---- C:\WINDOWS\system32\drivers
2011-05-16 17:18:03 ----D---- C:\WINDOWS\Help
2011-05-16 17:17:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-05-16 17:10:51 ----D---- C:\Documents and Settings
2011-05-16 15:24:44 ----D---- C:\WINDOWS\Minidump
2011-05-15 22:46:54 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-05-14 16:08:56 ----D---- C:\WINDOWS\system32\en-us
2011-05-14 16:08:38 ----D---- C:\Program Files\Microsoft.NET
2011-05-11 16:59:50 ----A---- C:\WINDOWS\system32\MRT.exe
2011-05-09 23:07:02 ----RSH---- C:\boot.ini
2011-05-09 23:07:02 ----A---- C:\WINDOWS\win.ini
2011-05-09 23:07:02 ----A---- C:\WINDOWS\system.ini
2011-05-09 16:56:52 ----D---- C:\Documents and Settings\Alexandr\Application Data\ATI
2011-05-09 16:46:30 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-05-07 23:37:27 ----D---- C:\WINDOWS\system32\config
2011-05-07 21:12:09 ----D---- C:\Program Files\Common Files\Microsoft Shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;Ovladaè procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 AsUpIO;AsUpIO; C:\WINDOWS\system32\drivers\AsUpIO.sys [2009-07-06 11448]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2011-03-04 137656]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-04-24 218688]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\System32\DRIVERS\AegisP.sys [2011-03-21 17801]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2011-03-04 61960]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 BCM43XX;Belkin 802.11 ovladac sítového adaptéru; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [2004-12-11 371584]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-03-31 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-03-28 9933952]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2008-08-01 54784]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2008-08-01 22016]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdXP3.sys []
S3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-03-04 269480]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; D:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 1242504]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-04-11 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-03-23 155752]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\wltrysvc.exe [2004-12-11 65536]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-03-21 136176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-03-21 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-03-22 75136]

-----------------EOF-----------------

[Rudy]

Pokud jste tak neučinil, odinstalujte poůvodní ovladač od ATI, případně podle návodu: http://www.viry.cz/forum/viewtopic.php?f=11&t=2791 ručně odstraňte z registry jeho zbytky.

[Zafrin]

Díky, o to se celou dobu snažím ale driver sweeper, nechápu proč, nedokáže ty zombie file/reg zničit. (našel jsem i pár dalších pozůstatků po ATI, ale s těmi se prostě nedá hnout + část těch věcí je ještě spojeno s zvukem, stále trošku nechápu, jak to v PC chodí) Jen mohl byste prosím jen vypsat o jaké kusy registru se jedná?

[Zafrin]

C:\WINDOWS\system32\Ati2evxx.dll
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdXP3.sys []
S3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]

to je vše, co vidím.. ATI jsem odinstalovával, samo sebou jsem nedůvěřoval 'odinstalátoru' od ATI a projel jsem PC ještě driver sweeperem.. ale jak je vidno, něco tam stále zůstalo..
+ vidim, že tyhle drivery jsou stopnuté, tak proč je takový problém, je smazat?

[Rudy]

Dejte log z ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Zkusíme to sestřelit.

[Zafrin]

Tu je: (Omlouvám se za menší zpoždění)
ComboFix 11-05-31.01 - Alexandr 31.05.2011 22:43:41.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1563 [GMT 2:00]
Running from: c:\documents and settings\Alexandr\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Alexandr\~WebUpdateHelper.exe
c:\windows\system32\Thumbs.db
.
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-31 )))))))))))))))))))))))))))))))
.
.
2011-05-31 17:34 . 2011-05-31 17:35 -------- d-----w- C:\rsit
2011-05-31 17:34 . 2011-05-31 17:35 -------- d-----w- c:\program files\trend micro
2011-05-25 12:07 . 2011-05-27 17:39 -------- d-----w- c:\documents and settings\Alexandr\Application Data\Mumble
2011-05-25 12:07 . 2011-05-25 12:07 -------- d-----w- c:\program files\Mumble
2011-05-21 10:31 . 2011-05-29 14:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype Extras
2011-05-21 10:30 . 2011-05-21 10:30 -------- d-----w- c:\program files\Common Files\Skype
2011-05-20 19:32 . 2011-05-20 19:32 -------- d--h--r- c:\documents and settings\Alexandr\Application Data\SecuROM
2011-05-16 15:44 . 2008-07-08 06:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin
2011-05-16 15:44 . 2008-07-29 18:33 446464 ----a-w- c:\windows\system32\nvunrm.exe
2011-05-16 15:44 . 2008-07-29 18:33 446464 ----a-w- c:\windows\system32\nvuninst.exe
2011-05-16 15:16 . 2011-05-16 15:18 -------- d-----w- c:\program files\NVIDIA Corporation
2011-05-16 15:11 . 2011-03-28 16:27 9933952 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-05-16 15:11 . 2011-03-28 16:27 9933952 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-05-16 15:11 . 2011-03-28 16:27 6407936 -c--a-w- c:\windows\system32\dllcache\nv4_disp.dll
2011-05-16 15:11 . 2011-03-28 16:27 6407936 ----a-w- c:\windows\system32\nv4_disp.dll
2011-05-16 13:07 . 2011-05-31 16:26 -------- d-----w- c:\documents and settings\Alexandr\Application Data\.minecraft
2011-05-15 16:34 . 2011-05-15 16:34 -------- d-----w- c:\documents and settings\Alexandr\Application Data\DivX
2011-05-15 11:40 . 2011-05-15 11:40 -------- d-----w- c:\documents and settings\Alexandr\.thumbnails
2011-05-14 14:49 . 2011-05-14 14:49 -------- d-----w- c:\program files\1C Company
2011-05-12 12:53 . 2011-05-12 12:53 -------- d-----w- c:\documents and settings\Alexandr\Application Data\DDMSettings
2011-05-12 12:50 . 2011-05-12 12:50 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-05-12 12:49 . 2011-05-12 12:50 -------- d-----w- c:\program files\DivX
2011-05-12 12:49 . 2011-05-12 12:50 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2011-05-10 19:41 . 2011-05-10 19:41 -------- d-----w- c:\documents and settings\Alexandr\Application Data\GameRanger
2011-05-10 16:18 . 2007-01-01 18:03 40960 ----a-r- c:\windows\system32\psfind.dll
2011-05-10 15:23 . 2006-02-07 13:40 204800 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2011-05-10 15:23 . 2006-02-07 13:40 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2011-05-10 15:23 . 2006-02-07 13:40 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2011-05-10 15:23 . 2005-11-13 21:19 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2011-05-10 15:23 . 2006-02-07 13:45 757760 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2011-05-10 15:23 . 2011-05-10 15:23 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2011-05-10 15:23 . 2011-05-10 15:23 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-05-09 19:02 . 2007-06-29 12:47 34304 ----a-w- c:\windows\system32\drivers\AmdLLD.sys
2011-05-09 19:02 . 2011-05-09 19:02 -------- d-----w- c:\program files\AMD
2011-05-09 18:48 . 2011-05-09 18:48 -------- d-----w- c:\documents and settings\Alexandr\Application Data\NVIDIA
2011-05-09 18:42 . 2011-05-09 18:42 -------- d-----w- C:\NVIDIA
2011-05-09 15:03 . 2011-05-09 15:03 -------- d-----w- c:\program files\Phyxion.net
2011-05-07 21:00 . 2011-05-07 21:05 -------- d-----w- c:\documents and settings\Alexandr\Application Data\Red Alert 3
2011-05-07 19:12 . 2011-05-07 19:12 -------- d-----w- c:\program files\Microsoft XNA
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-20 19:32 . 2011-03-25 18:40 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-04-24 20:57 . 2011-04-24 20:57 967 ----a-w- c:\windows\ScUnin.pif
2011-04-24 20:57 . 2011-04-24 20:57 68096 ----a-w- c:\windows\ScUnin.exe
2011-04-24 20:55 . 2011-04-24 20:55 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-04-11 16:08 . 2011-04-11 16:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-11 16:08 . 2011-04-11 16:09 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-24 16:45 . 2011-03-22 20:51 138264 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-03-24 16:45 . 2011-03-24 16:45 234768 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-03-24 16:45 . 2011-03-22 20:51 234768 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-03-23 21:42 . 2011-03-23 21:42 81920 ----a-w- c:\windows\system32\nvwddi.dll
2011-03-23 21:42 . 2011-03-23 21:42 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-03-23 21:42 . 2011-03-23 21:42 13881448 ----a-w- c:\windows\system32\nvcpl.dll
2011-03-23 21:42 . 2011-03-23 21:42 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-03-23 21:42 . 2011-03-23 21:42 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-03-23 21:42 . 2011-03-23 21:42 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2011-03-23 21:42 . 2011-03-23 21:42 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-03-23 21:42 . 2011-03-23 21:42 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-03-23 21:42 . 2011-03-23 21:42 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-03-23 21:42 . 2011-03-23 21:42 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-03-23 21:42 . 2011-03-23 21:42 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-03-23 21:42 . 2011-03-23 21:42 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-03-23 21:42 . 2011-03-23 21:42 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-03-23 21:42 . 2011-03-23 21:42 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-03-23 21:42 . 2011-03-23 21:42 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-03-23 21:42 . 2011-03-23 21:42 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-03-23 21:42 . 2011-03-23 21:42 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-03-23 21:42 . 2011-03-23 21:42 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-03-23 21:42 . 2011-03-23 21:42 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-03-23 21:42 . 2011-03-23 21:42 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-03-23 21:42 . 2011-03-23 21:42 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-03-23 21:42 . 2011-03-23 21:42 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-03-23 21:42 . 2011-03-23 21:42 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-03-23 21:42 . 2011-03-23 21:42 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-03-23 21:42 . 2011-03-23 21:42 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-03-23 21:42 . 2011-03-23 21:42 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-03-23 21:42 . 2011-03-23 21:42 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-03-23 21:42 . 2011-03-23 21:42 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-03-23 21:42 . 2011-03-23 21:42 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-03-23 21:42 . 2011-03-23 21:42 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-03-23 21:42 . 2011-03-23 21:42 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-03-23 21:42 . 2011-03-23 21:42 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-03-23 21:42 . 2011-03-23 21:42 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-03-23 21:42 . 2011-03-23 21:42 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-03-23 21:42 . 2011-03-23 21:42 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-03-22 20:51 . 2011-03-22 20:51 138056 ----a-w- c:\documents and settings\Alexandr\Application Data\PnkBstrK.sys
2011-03-22 20:51 . 2011-03-22 20:51 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-03-21 17:48 . 2011-03-21 17:48 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2011-03-07 05:33 . 2011-03-21 17:29 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 15:11 . 2011-03-22 16:49 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-04 13:37 . 2011-03-22 16:49 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-03-04 06:45 . 2003-03-31 12:00 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2003-03-31 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wltray.exe"="c:\windows\System32\wltray.exe" [2005-06-08 778318]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"ASUS Update Checker"="c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe" [2009-12-28 121472]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-03-23 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-03-23 13881448]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- d:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-03-28 13:41 1910152 ----a-w- d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"d:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Games\\Starcraft\\StarCraft.exe"=
"c:\\Documents and Settings\\Alexandr\\Application Data\\GameRanger\\GameRanger\\GameRanger.exe"=
"d:\\Games\\Titan Quest\\Titan Quest.exe"=
"d:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"=
"c:\\Program Files\\1C Company\\Men of War. Assault Squad\\mow_assault_squad.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Games\\World_of_Tanks\\WOTLauncher.exe"=
"d:\\Games\\World_of_Tanks\\WorldOfTanks.exe"=
.
R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [22.3.2011 18:42 11448]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [24.4.2011 22:55 218688]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [22.3.2011 18:49 136360]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [28.3.2011 15:41 1242504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7.4.2011 18:40 136176]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys --> c:\windows\system32\drivers\AtihdXP3.sys [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7.4.2011 18:40 136176]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-07 20:30]
.
2011-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-07 20:30]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - d:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - d:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Minecraft 1.2.0_02 - c:\documents and settings\Alexandr\Application Data\Uninstal.exe
AddRemove-PunkBusterSvc - d:\games\pbsvc_p4f.exe
AddRemove-{87686C21-8A15-4b4d-A3F1-11141D9BE094} - d:\games\uninstaller.exe
AddRemove-Scavenger Armors - d:\games\Fallout3\Uninstal.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-31 22:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-299502267-1085031214-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:ea,26,63,2b,03,3a,b8,fb,c6,84,2b,a7,fe,e7,66,b4,c1,26,7c,97,f5,
98,df,9a,b7,70,da,3b,65,04,b9,a6,f8,46,57,75,09,96,95,eb,db,df,e7,9c,b0,8b,\
"rkeysecu"=hex:aa,6c,94,c1,7d,ed,67,8a,97,82,41,73,bf,a4,48,54
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\System32\BCMLogon.dll
.
Completion time: 2011-05-31 22:50:02
ComboFix-quarantined-files.txt 2011-05-31 20:50
.
Pre-Run: 17 254 916 096 bytes free
Post-Run: 19 335 151 616 bytes free
.
- - End Of File - - CFB363C7DF7ED052735AF3870F7FDF00

[Rudy]

Několik položek CF smazal, zbytek logu vypadá čistý. Nastala nějaká změna?

[Zafrin]

No zatím žádný hryz.. ale nějak teď nemám čas to ozkoušet, škola mi žere čas. Ale stejně dík za ubitý čas se mnou zítra to plánuji řádně vyzkoušet a podat hlášení.

[Rudy]

OK, ozvěte se. Zatím není zač!

[Zafrin]

Tak zkouška neprobíhal zrovna dlouho, a kupodivu tentokrát mi to vyhodilo i chybovou hlášku.

[Rudy]

Zkuste reinstalovat ovladač gr karty a OpenGL.

[Zafrin]

Dobrý, tak po reinstallu se zatím žádný z příznaků neobjevil.. tak doufám, že to tak zůstane nadále.. díky Vám/ti Rudy za pomoc a utracený čas

[Rudy]

Nemáte zač!

[Zafrin]

Tak teď už se jen naučit, jak číst z logu.. jak operovat s ComboFixem ad. + scripty a mám to Rád bych se něčemu přiučil.. až budu mít čas.. Už jsem slyšel o té vaší škole tady na fórech a chtěl jsem se zeptat, jak dlouho takový kurs trvá?

[Rudy]

Kurs trvá podle toho, jak často se fóru můžete věnovat. Pokud nemáte dlouhé pauzy, za měsíc se dá zvládnout. Všechny podrobnosti vám vysvětlí moderátoři vyosek a caroprd111, kteří mají školení na starosti.