VIRY.CZ

Tak tady ještě ComboFix (omlouvám se za zpoždění, byla jsem pryč dva dni), ten IE určitě už nebude problém, pokud ten předchozí RSIT byl v pořádku, tak je to asi v pořádku.

ComboFix 10-02-01.01 - jana 01.02.2010 19:05:41.8.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.54.1029.18.1022.644 [GMT 1:00]
Running from: c:\documents and settings\jana\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1201 [VPS 080531-1] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Thumbs.db
c:\windows\system32\drivers\bfktruaeznel.sys
c:\windows\system32\drivers\str.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VZGTBIX


((((((((((((((((((((((((( Files Created from 2010-01-01 to 2010-02-01 )))))))))))))))))))))))))))))))
.

2010-02-01 14:42 . 2010-02-01 14:42 -------- d-----w- C:\Trinec
2010-01-28 11:53 . 2010-01-28 11:53 -------- d-----w- C:\_OTM
2010-01-26 13:46 . 2010-01-26 13:47 -------- d-----w- c:\program files\DCoder Image Source
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\FFMPEG Core Files
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\MONOGRAM AMR SplitterDecoder
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\CD Audio Reader Filter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\OpenSource AVI Splitter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\Gabest MPEG Splitter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\OpenSource DTSAC3DD+ Source Filter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\RealMedia
2010-01-26 13:45 . 2010-01-26 13:46 -------- d-----w- c:\program files\DScaler5
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\AC3Filter
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\DirectVobSub
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\Bass Audio Decoder
2010-01-26 13:45 . 2009-11-03 18:34 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-26 13:44 . 2010-01-26 13:44 -------- d-----w- c:\program files\Zoom Player
2010-01-26 13:36 . 2010-01-26 13:36 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-01-24 12:51 . 2010-01-24 12:51 -------- d-----w- c:\program files\CCleaner
2010-01-23 13:41 . 2010-01-23 13:41 -------- d-----w- C:\rsit
2010-01-23 13:32 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-23 13:32 . 2010-01-23 13:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 13:32 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 14:17 . 2010-01-20 14:17 -------- d-----w- C:\Chyby v SMV
2010-01-19 09:07 . 2010-01-19 09:07 389632 ----a-w- c:\windows\system32\CF13472.exe
2010-01-19 09:07 . 2010-01-19 09:04 389632 ----a-w- c:\windows\system32\CF12816.exe
2010-01-18 14:34 . 2010-01-18 14:34 -------- d-----w- c:\program files\trend micro
2010-01-04 00:09 . 2010-01-04 00:09 -------- d-----w- C:\My Music
2010-01-03 17:25 . 2010-01-03 17:26 2077163 ----a-w- C:\DivXLand_MediaSub_207.exe
2010-01-03 04:00 . 2010-01-03 04:00 -------- d-----w- C:\evik

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-28 20:16 . 2009-12-28 20:16 -------- d-----w- c:\program files\Mp3 Knife
2009-12-26 18:25 . 2009-12-26 18:25 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-26 18:25 . 2009-12-26 18:25 -------- d-----w- c:\program files\HP
2009-12-26 17:51 . 2009-12-26 17:51 -------- d--h--w- c:\program files\Agilent-HP
2009-12-25 21:18 . 2009-12-25 21:18 311 ----a-w- c:\program files\ComboFix (2).lnk
2009-12-25 21:18 . 2009-12-25 21:18 311 ----a-w- c:\program files\ComboFix.lnk
2009-12-22 13:32 . 2009-12-22 13:32 -------- d-----w- c:\program files\Ulead Systems
2009-12-21 19:08 . 2005-07-03 02:17 916480 ------w- c:\windows\system32\wininet.dll
2009-12-10 15:23 . 2005-01-26 19:20 62934 ----a-w- c:\windows\system32\perfc005.dat
2009-12-10 15:23 . 2005-01-26 19:20 380730 ----a-w- c:\windows\system32\perfh005.dat
2009-11-21 16:46 . 2004-08-18 19:00 470528 ----a-w- c:\windows\AppPatch\AcLayers.dll
2009-08-20 00:42 . 2009-08-20 00:38 466944 ----a-w- c:\program files\U95.exe
2007-11-18 12:03 . 2007-11-18 12:03 2293848 ----a-w- c:\program files\FLV PlayerFCSetup.exe
2007-11-18 12:02 . 2007-11-18 12:02 3928264 ----a-w- c:\program files\FLV PlayerRCATSetup.exe
2007-11-18 12:00 . 2007-11-18 11:59 411248 ----a-w- c:\program files\FLV PlayerRCSetup.exe
2008-08-04 22:59 . 2006-08-28 15:35 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-12-27 98304]
"HP OrderReminder Cleaner"="c:\windows\hporclnr.exe" [2006-12-27 104960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
"c:\\Program Files\\Microsoft Office\\Office10\\FRONTPG.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre1.6.0\\bin\\javaw.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\System32\\spool\\drivers\\W32X86\\3\\HP1005MC.EXE"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 15:36 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 15:36 20560]
S2 gupdate1c9b52ecaa98480;Služba Google Update (gupdate1c9b52ecaa98480);c:\program files\Google\Update\GoogleUpdate.exe [4.4.2009 16:08 133104]
S2 vzgtbix;vzgtbix;\??\c:\windows\system32\drivers\bfktruaeznel.sys --> c:\windows\system32\drivers\bfktruaeznel.sys [?]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://seznam.cz
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = local
IE: Stáhnout pomocí Net Transportu - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Stáhnout vše pomocí &Net Transportu - c:\program files\Xi\NetTransport 2\NTAddList.html
TCP: {EA9E9B0F-A356-4F89-9E96-13F1962E0336} = 192.168.2.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 19:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3672)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Acer\Acer eConsole\MediaServerService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2010-02-01 19:15:56 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-01 18:15
ComboFix2.txt 2010-01-26 17:26

Pre-Run: 1 828 487 168
Post-Run: 2 437 349 376

- - End Of File - - 6AE23C468A12E7AD379FDFF5DEC8E845

Vypadá to, že se nám tam usadil jakýsi Rootkit.

~~~

Stáhněte The Avenger.
Dvojklikem spusťte a klikněte na OK.
Otevře se Vám samotné okno programu. Následující skript v zeleném poli vkopírujte do okna 'Input Script Here'. Klikněte na 'Execute'. Následně potvrdíte spuštění skriptu a restart.
Po restartu Vám program vyhodí log, ten mi sem vkopírujete.

~~~

Stáhněte GMER a dvojklikem spusťte.
Několik sekund bude skenovat. Poté klikněte na 'Save' v pravém dolním rohu a uložte první log - ten vložte sem do fóra.
Poté vytvořte druhý log, přičemž se budete řídit tímto návodem. Tento log sem také vložte.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: "c:\windows\system32\drivers\" is a folder, not a file!
Deletion of file "c:\windows\system32\drivers\" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory

Driver "vzgtbix" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

---------------------------------------------------------------

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-02-02 16:10:20
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\jana\LOCALS~1\Temp\pgwdrpog.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

---------------------------------------------------------------

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-02 16:17:04
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\jana\LOCALS~1\Temp\pgwdrpog.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF41A2588]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF41A2444]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF41A2922]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF41A201C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF41A251E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF41A1F5C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF41A1FC0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF41A263E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF41A25FE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF41A277E]

---- Kernel code sections - GMER 1.0.15 ----

? zjxfpx.sys Systém nemuže nalézt uvedený soubor. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6AAF380, 0x346307, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!UnhookWindowsHookEx 7E36F21E 5 Bytes JMP 415248CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!CallNextHookEx 7E36F85B 5 Bytes JMP 415AD189 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!CreateWindowExW 7E36FC25 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!DialogBoxParamW 7E37555F 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 415B9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!DialogBoxIndirectParamW 7E382032 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!MessageBoxIndirectA 7E38A04A 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!DialogBoxParamA 7E38B10C 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!MessageBoxExW 7E3A05D8 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!MessageBoxExA 7E3A05FC 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!DialogBoxIndirectParamA 7E3A6B50 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] USER32.dll!MessageBoxIndirectW 7E3B62AB 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] ole32.dll!CoCreateInstance 774EFAC3 5 Bytes JMP 415BD9C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] ole32.dll!OleLoadFromStream 7751A257 5 Bytes JMP 416B4717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!CreateWindowExW 7E36FC25 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!DialogBoxParamW 7E37555F 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!DialogBoxIndirectParamW 7E382032 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!MessageBoxIndirectA 7E38A04A 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!DialogBoxParamA 7E38B10C 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!MessageBoxExW 7E3A05D8 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!MessageBoxExA 7E3A05FC 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!DialogBoxIndirectParamA 7E3A6B50 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3764] USER32.dll!MessageBoxIndirectW 7E3B62AB 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!UnhookWindowsHookEx 7E36F21E 5 Bytes JMP 415248CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!CallNextHookEx 7E36F85B 5 Bytes JMP 415AD189 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!CreateWindowExW 7E36FC25 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!DialogBoxParamW 7E37555F 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 415B9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!DialogBoxIndirectParamW 7E382032 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!MessageBoxIndirectA 7E38A04A 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!DialogBoxParamA 7E38B10C 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!MessageBoxExW 7E3A05D8 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!MessageBoxExA 7E3A05FC 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!DialogBoxIndirectParamA 7E3A6B50 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] USER32.dll!MessageBoxIndirectW 7E3B62AB 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] ole32.dll!CoCreateInstance 774EFAC3 5 Bytes JMP 415BD9C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] ole32.dll!OleLoadFromStream 7751A257 5 Bytes JMP 416B4717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[160] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00660002
IAT C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00660000
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[3948] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device Fastfat.sys (Fast FAT File System Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Dobrá, blbě jsem mazal.
Ještě soubor.

~~~

Stáhněte The Avenger.
Dvojklikem spusťte a klikněte na OK.
Otevře se Vám samotné okno programu. Následující skript v zeleném poli vkopírujte do okna 'Input Script Here'. Klikněte na 'Execute'. Následně potvrdíte spuštění skriptu a restart.
Po restartu Vám program vyhodí log, ten mi sem vkopírujete.

~~~

Poté nový ComboFix log.

Tohle je asi nekonečné . Říkám to kvůli vám, ptž už toho asi máte dost.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "c:\windows\system32\drivers\bfktruaeznel.sys" not found!
Deletion of file "c:\windows\system32\drivers\bfktruaeznel.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.


----------------------------------------------------------

ComboFix 10-02-03.08 - jana 04.02.2010 19:51:13.9.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.54.1029.18.1022.682 [GMT 1:00]
Running from: c:\documents and settings\jana\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1201 [VPS 080531-1] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-01-04 to 2010-02-04 )))))))))))))))))))))))))))))))
.

2010-02-03 13:59 . 2010-02-03 13:59 -------- d-----w- C:\Remakes
2010-01-28 11:53 . 2010-01-28 11:53 -------- d-----w- C:\_OTM
2010-01-26 13:46 . 2010-01-26 13:47 -------- d-----w- c:\program files\DCoder Image Source
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\FFMPEG Core Files
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\MONOGRAM AMR SplitterDecoder
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\CD Audio Reader Filter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\OpenSource AVI Splitter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\Gabest MPEG Splitter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\OpenSource DTSAC3DD+ Source Filter
2010-01-26 13:46 . 2010-01-26 13:46 -------- d-----w- c:\program files\RealMedia
2010-01-26 13:45 . 2010-01-26 13:46 -------- d-----w- c:\program files\DScaler5
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\AC3Filter
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\DirectVobSub
2010-01-26 13:45 . 2010-01-26 13:45 -------- d-----w- c:\program files\Bass Audio Decoder
2010-01-26 13:45 . 2009-11-03 18:34 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-26 13:44 . 2010-01-26 13:44 -------- d-----w- c:\program files\Zoom Player
2010-01-26 13:36 . 2010-01-26 13:36 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-01-24 12:51 . 2010-01-24 12:51 -------- d-----w- c:\program files\CCleaner
2010-01-23 13:41 . 2010-01-23 13:41 -------- d-----w- C:\rsit
2010-01-23 13:32 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-23 13:32 . 2010-01-23 13:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 13:32 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 14:17 . 2010-01-20 14:17 -------- d-----w- C:\Chyby v SMV
2010-01-19 09:07 . 2010-01-19 09:07 389632 ----a-w- c:\windows\system32\CF13472.exe
2010-01-19 09:07 . 2010-01-19 09:04 389632 ----a-w- c:\windows\system32\CF12816.exe
2010-01-18 14:34 . 2010-01-18 14:34 -------- d-----w- c:\program files\trend micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 17:26 . 2010-01-03 17:25 2077163 ----a-w- C:\DivXLand_MediaSub_207.exe
2009-12-28 20:16 . 2009-12-28 20:16 -------- d-----w- c:\program files\Mp3 Knife
2009-12-26 18:25 . 2009-12-26 18:25 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-26 18:25 . 2009-12-26 18:25 -------- d-----w- c:\program files\HP
2009-12-26 17:51 . 2009-12-26 17:51 -------- d--h--w- c:\program files\Agilent-HP
2009-12-25 21:18 . 2009-12-25 21:18 311 ----a-w- c:\program files\ComboFix (2).lnk
2009-12-25 21:18 . 2009-12-25 21:18 311 ----a-w- c:\program files\ComboFix.lnk
2009-12-22 13:32 . 2009-12-22 13:32 -------- d-----w- c:\program files\Ulead Systems
2009-12-21 19:08 . 2005-07-03 02:17 916480 ------w- c:\windows\system32\wininet.dll
2009-12-10 15:23 . 2005-01-26 19:20 62934 ----a-w- c:\windows\system32\perfc005.dat
2009-12-10 15:23 . 2005-01-26 19:20 380730 ----a-w- c:\windows\system32\perfh005.dat
2009-11-21 16:46 . 2004-08-18 19:00 470528 ----a-w- c:\windows\AppPatch\AcLayers.dll
2009-08-20 00:42 . 2009-08-20 00:38 466944 ----a-w- c:\program files\U95.exe
2007-11-18 12:03 . 2007-11-18 12:03 2293848 ----a-w- c:\program files\FLV PlayerFCSetup.exe
2007-11-18 12:02 . 2007-11-18 12:02 3928264 ----a-w- c:\program files\FLV PlayerRCATSetup.exe
2007-11-18 12:00 . 2007-11-18 11:59 411248 ----a-w- c:\program files\FLV PlayerRCSetup.exe
2008-08-04 22:59 . 2006-08-28 15:35 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-12-27 98304]
"HP OrderReminder Cleaner"="c:\windows\hporclnr.exe" [2006-12-27 104960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
"c:\\Program Files\\Microsoft Office\\Office10\\FRONTPG.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre1.6.0\\bin\\javaw.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\System32\\spool\\drivers\\W32X86\\3\\HP1005MC.EXE"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 15:36 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 15:36 20560]
S2 gupdate1c9b52ecaa98480;Služba Google Update (gupdate1c9b52ecaa98480);c:\program files\Google\Update\GoogleUpdate.exe [4.4.2009 16:08 133104]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://seznam.cz
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = local
IE: Stáhnout pomocí Net Transportu - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Stáhnout vše pomocí &Net Transportu - c:\program files\Xi\NetTransport 2\NTAddList.html
TCP: {EA9E9B0F-A356-4F89-9E96-13F1962E0336} = 192.168.2.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-04 19:55
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-02-04 19:56:28
ComboFix-quarantined-files.txt 2010-02-04 18:56
ComboFix2.txt 2010-02-01 18:15
ComboFix3.txt 2010-01-26 17:26

Pre-Run: 811 139 072
Post-Run: 1 299 349 504

- - End Of File - - BC623404D49F4AA5BB733ACA32FA063A

Dobře. Teď další kroky.
Jinak v pohodě, dost toho nemám. Dělám to, protože mě to baví.

~~~

Otestujte na VirusTotal soubory: Jednoduše tam vkopírujete cesty, co jsem napsal do code, když Vám to napíše, že soubor byl testován, dejte otestovat znovu. Poté jsem vložíte linky (odkazy) na jednotlivé testy.

~~~

A za další - nový RSIT log.

To U95 je program na justin.tv, jednou jsem se na cosi dívala a byl tam limit 1000 lidí, tak s tímto programem jsem se mohla dívat bez toho, aby mi to nevypadávalo.

Ale nevypadá to moc pěkně
http://www.virustotal.com/cs/analisis/8 ... 1265647337

Logfile of random's system information tool 1.06 (written by random/random)
Run by jana at 2010-02-08 17:44:34
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 259 MB (0%) free of 116 GB
Total RAM: 1022 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:44:42, on 8.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\hporclnr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\jana\Plocha\RSIT.exe
C:\Program Files\trend micro\jana.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP OrderReminder Cleaner] C:\WINDOWS\hporclnr.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Stáhnout pomocí Net Transportu - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Stáhnout vše pomocí &Net Transportu - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA9E9B0F-A356-4F89-9E96-13F1962E0336}: NameServer = 192.168.2.1
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate1c9b52ecaa98480) (gupdate1c9b52ecaa98480) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 7125 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-06-19 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0\bin\ssv.dll [2007-03-11 501384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-10-15 256112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll [2009-10-15 761840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C56CB6B0-0D96-11D6-8C65-B2868B609932}]
NTIECatcher Class - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll [2004-07-19 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll [2009-10-15 458736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-10-15 256112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"Ulead AutoDetector v2"=C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe [2004-11-26 90112]
"OrderReminder"=C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [2006-12-27 98304]
"HP OrderReminder Cleaner"=C:\WINDOWS\hporclnr.exe [2006-12-27 104960]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2006-05-24 1372160]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštení
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Acer\Acer eConsole\MediaSync.exe"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe:LocalSubNet:Enabled:Media Synchoronizer"
"C:\Program Files\Acer\Acer eConsole\eConsole.exe"="C:\Program Files\Acer\Acer eConsole\eConsole.exe:LocalSubNet:Enabled:eConsole"
"C:\Program Files\Acer\Acer eConsole\MediaServerService.exe"="C:\Program Files\Acer\Acer eConsole\MediaServerService.exe:LocalSubNet:Enabled:Acer Media Server"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\Real\RealPlayer\RealPlay.exe"="C:\Program Files\Real\RealPlayer\RealPlay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Microsoft Office\Office10\FRONTPG.EXE"="C:\Program Files\Microsoft Office\Office10\FRONTPG.EXE:*:Enabled:Microsoft FrontPage"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Java\jre1.6.0\bin\javaw.exe"="C:\Program Files\Java\jre1.6.0\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\WINDOWS\System32\spool\drivers\W32X86\3\HP1005MC.EXE"="C:\WINDOWS\System32\spool\drivers\W32X86\3\HP1005MC.EXE:*:Enabled:SMLMProxy Module - HP1005MC.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"

======List of files/folders created in the last 1 months======

2010-02-07 20:03:59 ----A---- C:\PocketDivXEncoder_0.3.50.exe
2010-02-06 20:27:32 ----D---- C:\templates
2010-02-05 12:08:39 ----D---- C:\stare certifikaty
2010-02-04 19:58:44 ----SHD---- C:\Recycled
2010-02-04 19:56:29 ----A---- C:\ComboFix.txt
2010-02-04 19:47:51 ----A---- C:\avenger.txt
2010-02-03 14:59:38 ----D---- C:\Remakes
2010-02-02 16:03:16 ----D---- C:\Avenger
2010-02-01 19:04:57 ----A---- C:\WINDOWS\zip.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\SWSC.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\SWREG.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\sed.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\PEV.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\MBR.exe
2010-02-01 19:04:57 ----A---- C:\WINDOWS\grep.exe
2010-02-01 19:04:44 ----D---- C:\Qoobox
2010-01-28 12:53:49 ----D---- C:\_OTM
2010-01-26 14:46:58 ----D---- C:\Program Files\DCoder Image Source
2010-01-26 14:46:55 ----D---- C:\Program Files\FFMPEG Core Files
2010-01-26 14:46:33 ----D---- C:\Program Files\MONOGRAM AMR SplitterDecoder
2010-01-26 14:46:29 ----D---- C:\Program Files\CD Audio Reader Filter
2010-01-26 14:46:28 ----D---- C:\Program Files\OpenSource AVI Splitter
2010-01-26 14:46:27 ----D---- C:\Program Files\Gabest MPEG Splitter
2010-01-26 14:46:25 ----D---- C:\Program Files\OpenSource DTSAC3DD+ Source Filter
2010-01-26 14:46:21 ----D---- C:\Program Files\RealMedia
2010-01-26 14:45:58 ----D---- C:\Program Files\DScaler5
2010-01-26 14:45:51 ----D---- C:\Program Files\AC3Filter
2010-01-26 14:45:39 ----D---- C:\Program Files\DirectVobSub
2010-01-26 14:45:36 ----D---- C:\Program Files\Bass Audio Decoder
2010-01-26 14:45:19 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2010-01-26 14:45:18 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2010-01-26 14:44:19 ----D---- C:\Program Files\Zoom Player
2010-01-26 14:44:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Zoom Player
2010-01-26 14:36:50 ----D---- C:\Program Files\Combined Community Codec Pack
2010-01-24 13:51:35 ----D---- C:\Program Files\CCleaner
2010-01-23 14:41:00 ----D---- C:\rsit
2010-01-23 14:32:29 ----D---- C:\Documents and Settings\jana\Data aplikací\Malwarebytes
2010-01-23 14:32:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-23 14:32:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-01-20 15:17:11 ----D---- C:\Chyby v SMV
2010-01-19 10:11:29 ----RASHD---- C:\cmdcons
2010-01-19 10:07:40 ----A---- C:\WINDOWS\system32\CF13472.exe
2010-01-19 10:07:02 ----A---- C:\WINDOWS\system32\CF12816.exe
2010-01-18 15:34:56 ----D---- C:\Program Files\trend micro
2010-01-14 06:34:34 ----HD---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-14 06:34:14 ----HD---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-02-08 11:54:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-04 19:55:12 ----A---- C:\WINDOWS\system.ini
2010-01-27 11:51:50 ----A---- C:\WINDOWS\cdplayer.ini
2010-01-19 10:11:34 ----RASH---- C:\boot.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-05-16 26944]
R1 AmdK8;Ovladac procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [1999-09-10 25244]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-05-16 42912]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R1 StyleXPHelper;StyleXPHelper; \??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-05-16 94416]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2004-08-03 87424]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-09-22 3727680]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-05-16 23152]
R3 hidusb;Ovladac trídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-18 9600]
R3 mouhid;Ovladac myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2005-01-26 6144]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-07-29 34048]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-07-29 12928]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbehci;Ovladac miniportu rozšíreného radice hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-18 26624]
R3 usbhub;Rozbocovac umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-18 57600]
R3 usbohci;Ovladac Miniport otevreného hostitelského radice Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-18 17024]
R3 USBSTOR;Ovladac velkokapacitního pametového zarízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-18 26496]
S1 kbdhid;Ovladac klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-18 14848]
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-18 60800]
S3 catchme;catchme; \??\C:\DOCUME~1\jana\LOCALS~1\Temp\catchme.sys []
S3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-18 61824]
S3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20060807.097\symidsco.sys []
S3 usbccgp;Obecný nadrazený ovladac Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-18 31616]
S3 usbprint;Trída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S4 WS2IFSL;Podpurné prostredí zprostredkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Acer Media Server;Acer Media Server; C:\Program Files\Acer\Acer eConsole\MediaServerService.exe [2005-09-21 438272]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-05-16 17272]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-05-16 144760]
R2 Irmon;Sledování infracerveného prenosu; C:\WINDOWS\system32\svchost.exe [2004-08-18 14336]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 StyleXPService;StyleXPService; C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe [2006-05-24 372736]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-05-16 247160]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-05-16 349560]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2004-08-18 268288]
S2 gupdate1c9b52ecaa98480;Služba Google Update (gupdate1c9b52ecaa98480); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-04 133104]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-06-30 654848]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-10-15 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-18 14336]

-----------------EOF-----------------

Já bych to raději smazal...

~~~

Prosím o zazipování a uploadnutí na server www.leteckaposta.cz následující složky: Odkazy mi poté pošlete přes Soukromou zprávu!

~~~

Fixnutí v HJT

• Spusťte přejmenované HijackThis - C:\Program Files\Trend Micro\HijackThis\jmeno_uzivatele.exe
• Klikněte na 'Do a system scan only'.
• U níže uvedených položek udělejte fajfku do čtverečku a poté klikněte na 'Fix Checked'.

  Kód: Vybrat vše

  R3 - URLSearchHook: (no name) - - (no file)
  O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

• Pokud by tam nějaká položka nebyla, vynechte ji.

Všechno provedeno, mám ještě udělat nějaký log?

Včera se mi to tu zas zasekávalo, když jsem použila program avidemux na obyčejné spojení dvou videí, což je normálně udělané za 5 sekund, povedlo se mi to až tak napočtvré, co bylo znovu zaplé PC. Ale snad to byla náhoda, všechno už jede rychle, teď jsem si na C uvolnila 20 giga a vypadá to, že je teď PC ještě rychlejší díky tomu.

Co mám dělat, když se objeví ta ikonka plného využití?

Můžete nový RSIT log.