Ztráva výkonu NB 4 Motji

[BL4zer]

Pěkný věčer přeju
Rád bych se zeptal co by mohlo způsobovat zamrzání winu na mém NB.
Občas mi zamrzne win a dokážu vypnout explorer ale už ho pak nenahodím.O opeře ani nemluvím ta mi zamrzá tak 10X denně.
Zkoušel jsem jestli klesl přímo výkon a zapl jsem CS z míval jsem tradičně 100 FPS a nyní kolem 40-70 což je rapidní pokles.sice mi to nějak nevadí jelikož to už nehraju ale chtěl jsem jen zkusit jestli stím něco je a tím se mi to potvrdilo že ten nb někde ten výkon ztrácí . Jako bych měl spuštěných moc programu a NB to nestíhal.Netuším jestli to jde nějak pře OP nebo to nesíhá CPU.
Myslel jsem že to jsou viry ale nod nenajde nic.trojan najde jen fake esety tak nvm no

Prosím poradtě

[motji]

Hezký večer

poprosím o log ze Rsitu, viz můj podpis

[BL4zer]

Logfile of random's system information tool 1.07 (written by random/random)
Run by abc at 2010-07-01 22:39:48
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 24 GB (45%) free of 52 GB
Total RAM: 1789 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:40:05, on 1.7.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Pavel\programy\ESETnod\egui.exe
D:\Pavel\programy\powerdvd\PowerDVD10\PDVD10Serv.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
D:\Pavel\programy\ESETnod\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NDAS\System\ndassvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Aryvaa.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Winamp\winamp.exe
D:\Pavel\programy\Opera\opera.exe
C:\Documents and Settings\abc\Plocha\RSIT.exe
C:\Program Files\trend micro\abc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newversionchecker.com/?redr= ... tutils.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gogole.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\abc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\abc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Pavel\programy\adobe reader 9\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [egui] "D:\Pavel\programy\ESETnod\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EWABQAF7KL] C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Údržba databáze BUILDpower.lnk = C:\Program Files\RTS\BUILDpower\BPStartUp.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: TrekStor NDAS Device Management.lnk = C:\Program Files\NDAS\System\ndasmgmt.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (file missing)
O9 - Extra 'Tools' menuitem: My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (file missing)
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - D:\Pavel\programy\QIP Infium\infium.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: DisplayLink Service (DisplayLinkService) - DisplayLink Corp. - C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - D:\Pavel\programy\ESETnod\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - D:\Pavel\programy\ESETnod\ekrn.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System\ndassvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10134 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\abc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-26 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-26 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2005-08-04 343112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2009-11-11 287800]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-12-11 1044480]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2008-03-24 884736]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]
""= []
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-07-29 1545512]
"Adobe Reader Speed Launcher"=D:\Pavel\programy\adobe reader 9\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"egui"=D:\Pavel\programy\ESETnod\egui.exe [2010-02-26 2140880]
"BDRegion"=C:\Program Files\Cyberlink\Shared files\brs.exe [2010-04-02 75048]
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []
""= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EWABQAF7KL"=C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe [2010-07-01 163328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\Pavel\GameS\steam\Steam.exe [2010-05-08 1238352]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
TrekStor NDAS Device Management.lnk - C:\Program Files\NDAS\System\ndasmgmt.exe

C:\Documents and Settings\abc\Nabídka Start\Programy\Po spuštění
Údržba databáze BUILDpower.lnk - C:\Program Files\RTS\BUILDpower\BPStartUp.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-09-10 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"StartMenuLogOff"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"D:\Pavel\programy\QIPold\QIP\qip.exe"="D:\Pavel\programy\QIPold\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"D:\Pavel\programy\Opera\opera.exe"="D:\Pavel\programy\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"D:\Pavel\GameS\steam\Steam.exe"="D:\Pavel\GameS\steam\Steam.exe:*:Enabled:Steam"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\Pavel\programy\utorrent\uTorrent.exe"="D:\Pavel\programy\utorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Pavel\GameS\Garena\Garena.exe"="D:\Pavel\GameS\Garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Pavel\GameS\steam\steamapps\dj_l4m4\counter-strike\hl.exe"="D:\Pavel\GameS\steam\steamapps\dj_l4m4\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a042c82b-6b12-11df-9bb0-002186757a85}]
shell\AutoRun\command - F:\SamsungSoftware\APPInst.exe


======List of files/folders created in the last 1 months======

2010-07-01 22:39:49 ----D---- C:\Program Files\trend micro
2010-07-01 22:39:48 ----D---- C:\rsit
2010-07-01 19:04:17 ----A---- C:\WINDOWS\Aryvaa.exe
2010-07-01 19:04:07 ----A---- C:\WINDOWS\system32\sshnas21.dll
2010-06-30 21:46:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-06-28 22:39:49 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-28 22:39:31 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-06-28 22:39:18 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-28 22:39:06 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-06-28 22:38:01 ----HDC---- C:\WINDOWS\$NtUninstallKB981349$
2010-06-28 22:37:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-06-28 22:37:33 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-06-28 22:37:21 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-06-28 22:36:20 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-06-28 22:36:09 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-06-28 22:35:56 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-28 22:31:47 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-28 22:30:45 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-06-28 22:30:34 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-06-28 22:30:22 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-28 22:29:43 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-06-28 22:19:41 ----D---- C:\Program Files\MSXML 4.0
2010-06-19 14:17:17 ----D---- C:\Documents and Settings\abc\Data aplikací\CyberLink
2010-06-19 14:16:27 ----D---- C:\Program Files\Cyberlink
2010-06-19 14:16:27 ----D---- C:\Documents and Settings\All Users\Data aplikací\CyberLink
2010-06-19 14:16:13 ----D---- C:\Program Files\Common Files\CyberLink
2010-06-19 11:17:31 ----D---- C:\DOWNLOAD

======List of files/folders modified in the last 1 months======

2010-07-01 22:39:50 ----D---- C:\WINDOWS\Temp
2010-07-01 22:39:49 ----RD---- C:\Program Files
2010-07-01 22:39:35 ----D---- C:\WINDOWS\Prefetch
2010-07-01 22:34:02 ----SD---- C:\WINDOWS\Tasks
2010-07-01 20:04:46 ----D---- C:\Program Files\kikin
2010-07-01 19:42:16 ----SHD---- C:\WINDOWS\Installer
2010-07-01 19:38:13 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-01 19:36:14 ----D---- C:\WINDOWS\system32
2010-07-01 19:36:14 ----D---- C:\WINDOWS
2010-07-01 19:36:14 ----D---- C:\Program Files\Mozilla Firefox
2010-07-01 19:36:14 ----D---- C:\Documents and Settings\abc\Data aplikací\uTorrent
2010-07-01 19:36:13 ----D---- C:\WINDOWS\Minidump
2010-07-01 15:15:32 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-01 09:12:14 ----D---- C:\Program Files\totalcmd
2010-06-30 22:24:28 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-06-29 08:15:54 ----D---- C:\Documents and Settings\abc\Data aplikací\vlc
2010-06-28 22:43:33 ----RSD---- C:\WINDOWS\assembly
2010-06-28 22:39:54 ----HD---- C:\WINDOWS\inf
2010-06-28 22:39:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-28 22:39:29 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-28 22:39:08 ----D---- C:\WINDOWS\system32\drivers
2010-06-28 22:38:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-06-28 22:37:37 ----D---- C:\Program Files\Movie Maker
2010-06-28 22:37:30 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-28 22:31:21 ----D---- C:\WINDOWS\WinSxS
2010-06-28 22:30:49 ----D---- C:\Program Files\Outlook Express
2010-06-28 22:28:31 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-28 22:20:26 ----D---- C:\WINDOWS\system32\cs-cz
2010-06-28 22:20:26 ----D---- C:\Program Files\Internet Explorer
2010-06-22 22:15:34 ----D---- C:\Documents and Settings\abc\Data aplikací\kikin
2010-06-19 14:16:13 ----HD---- C:\Program Files\InstallShield Installation Information
2010-06-19 14:16:13 ----D---- C:\Program Files\Common Files
2010-06-19 14:12:17 ----A---- C:\WINDOWS\system32\msvcr71.dll
2010-06-19 14:12:16 ----A---- C:\WINDOWS\system32\msvcp71.dll
2010-06-19 14:07:12 ----D---- C:\Program Files\Common Files\AVSMedia
2010-06-19 14:07:11 ----D---- C:\Program Files\AVS4YOU
2010-06-10 14:15:47 ----SD---- C:\Documents and Settings\abc\Data aplikací\Microsoft
2010-06-10 11:34:56 ----D---- C:\Documents and Settings\abc\Data aplikací\Skype
2010-06-10 08:29:58 ----D---- C:\Documents and Settings\abc\Data aplikací\skypePM
2010-06-07 21:18:03 ----A---- C:\WINDOWS\NeroDigital.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-02-26 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-02-26 95872]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/06/19 14:16:26]; \??\D:\Pavel\programy\powerdvd\PowerDVD10\NavFilter\000.fcl []
R2 ATE_PROCMON;ATE_PROCMON; \??\D:\Pavel\programy\Anti Trojan Elite\ATEPMon.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-02-26 139192]
R3 Accelerometer;HP Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [2008-05-23 28592]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-12-11 338944]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-07-13 94976]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-09-11 3230720]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2010-01-31 1735296]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2008-05-14 539512]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-05-14 37424]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-05-14 879624]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-05-14 156392]
R3 btwmodem;Bluetooth Modem; C:\WINDOWS\system32\DRIVERS\btwmodem.sys [2008-05-14 37280]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-05-14 74688]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 DisplayLinkGA;DisplayLinkGA; C:\WINDOWS\system32\DRIVERS\DisplayLinkGAport.sys [2008-10-24 20736]
R3 DisplayLinkmirror;DisplayLinkmirror; C:\WINDOWS\system32\DRIVERS\DisplayLinkmirrorport.sys [2008-10-24 18816]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2009-03-19 9216]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 ndasbus;NDAS Bus Driver; C:\WINDOWS\system32\DRIVERS\ndasbus.sys [2006-03-20 59136]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2008-04-14 5888]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2008-10-09 1810856]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-07-29 213680]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2009-06-04 297728]
S3 ambukgvp;ambukgvp; C:\WINDOWS\system32\drivers\ambukgvp.sys []
S3 AX88772;ASIX AX88772/AX88772A USB2.0 to Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\ax88772.sys [2007-09-21 29184]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 DisplayLinkUsbPort;DisplayLink USB Device; C:\WINDOWS\system32\DRIVERS\DisplayLinkUsbPort.sys [2008-10-24 20992]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\abc\LOCALS~1\Temp\YXD873.tmp []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 ndasscsi;NDAS SCSI Miniport Driver; C:\WINDOWS\system32\DRIVERS\ndasscsi.sys [2006-03-20 115584]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys []
S4 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-09-10 561152]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-05-12 264800]
R2 DisplayLinkService;DisplayLink Service; C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe [2008-10-24 443752]
R2 ekrn;ESET Service; D:\Pavel\programy\ESETnod\ekrn.exe [2010-02-26 810120]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-26 153376]
R2 ndassvc;NDAS Service; C:\Program Files\NDAS\System\ndassvc.exe [2006-03-20 304640]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; D:\Pavel\programy\ESETnod\EHttpSrv.exe [2010-02-26 33560]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Řekla bych, že tam něco bude


Dejte soubor otestovat na http://www.virustotal.com

C:\WINDOWS\Aryvaa.exe

-Na virustotalu dáte procházet, a do spodního okénka nakopírujete přímo cestu k souboru a dáte odeslat
-z prohlížeče zkopírujete adresu ke stránce s výsledky
-pokud se Vás zeptá, dejte soubor otestovat znovu, tak aby to byl soubor z Vašeho počítače

[BL4zer]

http://www.virustotal.com/cs/analisis/7 ... 1278017442

[motji]

Fůůj, takové zvířátko

Combofix stahněte takto:
- pravým myšítkem klikněte na odkaz combofixu --uložit jako.. ,a teď ho přejmenujte na Potvora.com a uložte.




Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

[BL4zer]

Napsalo to tuhle chybu.
http://img818.imageshack.us/img818/826/ ... bofixu.jpg

[motji]

Zkuste ho stahnout znovu a spustit v nouzovém režimu. Pokud nepůjde, vymyslíme něco jiného

[BL4zer]

Zkoušeno v nouzovém režimu a taky se nepovedlo se stejným výsledkem :/
win hlásí chybu spuštění z nějakého důvodu

[motji]

Zazálohujte si důležitá data, pro jistotu

Proveďte v nouzovém režimu

spusťte přejmenované HJT C:\Program Files\trend micro\abc.exe , má tuto ikonku

- Klikněte na "Do a system scan only"
- U řádku
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newversionchecker.com/?redr= ... tutils.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
O4 - HKCU\..\Run: [EWABQAF7KL] C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe
- Dejte fajfku do čtverečku a zmáčkněte Fix checked
- restartujte pc



Smažte cache Opery/Firefoxu bud ručně nebo ATF Cleanerem
http://www.slunecnice.cz/sw/atf-cleaner/

- v menu nahoře vyberte záložku Firefox / Opera a klikněte na ni
- zatrhněte Select All a pak klikněte na Empty Selected

pozor - přijdete o všechna hesla uložená ve FF /Opere!

- Na záložce main zaškrtněte All users temp a potvrdte Empty selected




Stáhněte Avenger
http://swandog46.geekstogo.com/avenger.exe

-spustíte program a potvrdíte kliknutím na ok,tím potvrzujete, že všechny činnosti s tím spojené činíte na vlastní riziko.
-Po odkliknutí se objeví hlavní okno programu,do bílého okna něj zkopírujte tento skript:

Kód: Vybrat vše

Files to delete:
C:\WINDOWS\Aryvaa.exe
C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

-zaškrtněte políčko scan for rootkits

a klikněte na tlačítko Execute.
-Potom se objeví okno,kde kliknutím Yes potvrdíte spuštění skriptu. Pak znovu tlačítkem yes potvrdíte restart počítače.
-Po restartu by se měl otevřít poznámkový blok s logem o vykonání skriptu, bude také uložený v C:\avenger.txt.
-Log vložte sem




Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT 

- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde



Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[BL4zer]

Vkládám log z avengeru


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\Aryvaa.exe" deleted successfully.

Error: file "C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe" not found!
Deletion of file "C:\DOCUME~1\abc\LOCALS~1\Temp\Az1.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job" deleted successfully.
File "C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[motji]

Fajn, počkám na ty ostatní logy.
Ale budu tu asi až večer po 22.hodině

[BL4zer]

´OTL scan

OTL logfile created on: 3.7.2010 13:50:16 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\abc\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 72,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 50,78 Gb Total Space | 22,97 Gb Free Space | 45,23% Space Free | Partition Type: NTFS
Drive D: | 98,26 Gb Total Space | 8,63 Gb Free Space | 8,78% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOFIS-NB-HP6735
Current User Name: abc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.07.03 13:49:12 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\abc\Plocha\OTL.exe
PRC - [2010.06.30 14:52:22 | 000,836,464 | ---- | M] (Opera Software) -- D:\Pavel\programy\Opera\opera.exe
PRC - [2010.06.20 04:04:47 | 000,035,760 | ---- | M] (Adobe Systems Incorporated) -- D:\Pavel\programy\adobe reader 9\Reader\reader_sl.exe
PRC - [2010.04.02 09:11:22 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files\Cyberlink\Shared files\brs.exe
PRC - [2008.12.11 13:08:46 | 001,044,480 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2008.10.24 13:19:12 | 000,492,904 | ---- | M] (DisplayLink Corp.) -- C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2008.10.24 13:19:10 | 000,443,752 | ---- | M] (DisplayLink Corp.) -- C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
PRC - [2008.10.24 13:19:08 | 004,613,480 | ---- | M] (DisplayLink Corp.) -- C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
PRC - [2008.05.12 15:55:10 | 001,440,384 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008.05.12 15:55:10 | 000,576,104 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.05.17 12:48:50 | 000,220,160 | ---- | M] (XIMETA, Inc.) -- C:\Program Files\NDAS\System\ndasmgmt.exe
PRC - [2006.03.20 21:40:08 | 000,304,640 | ---- | M] (XIMETA, Inc.) -- C:\Program Files\NDAS\System\ndassvc.exe


========== Modules (SafeList) ==========

MOD - [2010.07.03 13:49:12 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\abc\Plocha\OTL.exe
MOD - [2008.05.12 15:51:24 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll
MOD - [2008.05.12 15:49:02 | 000,040,960 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010.07.01 19:04:07 | 000,219,648 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\sshnas21.dll -- (SSHNAS)
SRV - [2008.11.11 10:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 13:19:10 | 000,443,752 | ---- | M] (DisplayLink Corp.) [Auto | Running] -- C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe -- (DisplayLinkService)
SRV - [2008.07.29 20:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2006.03.20 21:40:08 | 000,304,640 | ---- | M] (XIMETA, Inc.) [Auto | Running] -- C:\Program Files\NDAS\System\ndassvc.exe -- (ndassvc)


========== Driver Services (SafeList) ==========

DRV - [2010.04.02 09:11:16 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/06/19 14:16:26] [Kernel | Auto | Running] -- D:\Pavel\programy\powerdvd\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2010.02.01 19:34:24 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.01.31 18:54:07 | 001,735,296 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2009.07.29 17:33:04 | 000,213,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2009.06.04 10:10:00 | 000,297,728 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2009.03.19 11:40:10 | 000,009,216 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2008.12.11 13:11:34 | 000,338,944 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2008.10.24 13:19:38 | 000,020,992 | ---- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DisplayLinkUsbPort.sys -- (DisplayLinkUsbPort)
DRV - [2008.10.24 13:19:38 | 000,020,736 | ---- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DisplayLinkGAport.sys -- (DisplayLinkGA)
DRV - [2008.10.24 13:19:38 | 000,018,816 | ---- | M] (DisplayLink Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DisplayLinkmirrorport.sys -- (DisplayLinkmirror)
DRV - [2008.10.09 12:32:46 | 001,810,856 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.09.11 04:32:26 | 003,230,720 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.05.23 14:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)
DRV - [2008.05.23 14:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2008.05.14 09:08:16 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.05.14 09:08:16 | 000,037,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2008.05.14 09:08:14 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.05.14 09:08:14 | 000,539,512 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2008.05.14 09:08:14 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2008.05.14 09:08:14 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.04.14 01:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Ovladač zvukové karty USB (WDM)
DRV - [2008.03.28 11:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)
DRV - [2007.09.21 15:09:00 | 000,029,184 | ---- | M] (ASIX Electronics Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ax88772.sys -- (AX88772)
DRV - [2007.06.18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007.04.16 17:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006.03.20 21:40:50 | 000,140,160 | ---- | M] (XIMETA, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\lfsfilt.sys -- (lfsfilt)
DRV - [2006.03.20 21:39:58 | 000,115,584 | ---- | M] (XIMETA, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ndasscsi.sys -- (ndasscsi)
DRV - [2006.03.20 21:39:58 | 000,059,136 | ---- | M] (XIMETA, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ndasbus.sys -- (ndasbus)
DRV - [2006.03.20 21:39:58 | 000,044,288 | ---- | M] (XIMETA, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\lpx.sys -- (lpx)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\abc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.newversionchecker.com/?redr= ... tutils.com"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.2
FF - prefs.js..keyword.URL: "http://search.qip.ru/search?from=FF&query="


FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: D:\Pavel\programy\NokiaPCsuite\Nokia PC Suite 7\bkmrksync\ [2010.02.02 19:29:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.25 11:03:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.01 07:26:31 | 000,000,000 | ---D | M]

[2010.01.31 19:10:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Mozilla\Extensions
[2010.05.30 21:01:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Mozilla\Firefox\Profiles\3wxsbd00.default\extensions
[2010.06.22 22:15:34 | 000,000,000 | ---D | M] (kikin plugin (JDownloader Edition)) -- C:\Documents and Settings\abc\Data aplikací\Mozilla\Firefox\Profiles\3wxsbd00.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.01.31 22:36:28 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\abc\Data aplikací\Mozilla\Firefox\Profiles\3wxsbd00.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.02.02 19:21:07 | 000,002,061 | ---- | M] () -- C:\Documents and Settings\abc\Data aplikací\Mozilla\Firefox\Profiles\3wxsbd00.default\searchplugins\qipsearch.xml
[2010.03.26 14:33:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.31 18:55:02 | 000,118,000 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\qippipe.dll
[2009.12.21 07:47:02 | 000,063,488 | ---- | M] (Nullsoft) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2009.12.02 10:09:39 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2009.12.02 10:09:39 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2009.12.02 10:09:39 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2009.12.02 10:09:39 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2009.12.02 10:09:39 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\abc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] D:\Pavel\programy\adobe reader 9\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - Startup: C:\Documents and Settings\abc\Nabídka Start\Programy\Po spuštění\Údržba databáze BUILDpower.lnk = C:\Program Files\RTS\BUILDpower\BPStartUp.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\TrekStor NDAS Device Management.lnk = C:\Program Files\NDAS\System\ndasmgmt.exe (XIMETA, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 1
O7 - HKU\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0011-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.1.0/jinsta ... s-i586.cab (Java Plug-in 1.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\abc\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\abc\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.01.31 16:41:05 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{a042c82b-6b12-11df-9bb0-002186757a85}\Shell\AutoRun\command - "" = F:\SamsungSoftware\APPInst.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010.01.31 16:40:22 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: SSHNAS - C:\WINDOWS\system32\sshnas21.dll ()

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\WINDOWS\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.scg726 - C:\WINDOWS\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.mp42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56308606093492224)

========== Files/Folders - Created Within 30 Days ==========

[2010.07.03 13:49:12 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\abc\Plocha\OTL.exe
[2010.07.03 13:46:18 | 000,000,000 | ---D | C] -- C:\Avenger
[2010.07.03 13:45:27 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\abc\Recent
[2010.07.03 13:39:40 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Documents and Settings\abc\Plocha\ATF-Cleaner.exe
[2010.07.01 23:42:17 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2010.07.01 22:41:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Plocha\skener
[2010.07.01 22:39:49 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.07.01 22:39:48 | 000,000,000 | ---D | C] -- C:\rsit
[2010.06.30 21:46:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
[2010.06.30 07:29:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Plocha\fotkyy
[2010.06.30 07:28:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Plocha\fotky na fulnek
[2010.06.28 22:19:41 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010.06.19 14:18:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Local Settings\Data aplikací\Cyberlink
[2010.06.19 14:17:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Dokumenty\CyberLink
[2010.06.19 14:17:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Data aplikací\CyberLink
[2010.06.19 14:16:27 | 000,000,000 | ---D | C] -- C:\Program Files\Cyberlink
[2010.06.19 14:16:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\CyberLink
[2010.06.19 14:16:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\CyberLink
[2010.06.19 11:17:31 | 000,000,000 | ---D | C] -- C:\DOWNLOAD
[2010.01.31 18:55:05 | 000,195,112 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010.01.31 18:55:01 | 000,186,920 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.07.03 13:49:12 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\abc\Plocha\OTL.exe
[2010.07.03 13:46:53 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.03 13:46:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.03 13:45:34 | 007,340,032 | -H-- | M] () -- C:\Documents and Settings\abc\NTUSER.DAT
[2010.07.03 13:45:34 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\abc\ntuser.ini
[2010.07.03 13:45:26 | 004,318,846 | -H-- | M] () -- C:\Documents and Settings\abc\Local Settings\Data aplikací\IconCache.db
[2010.07.03 13:44:38 | 000,731,136 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\avenger.exe
[2010.07.03 13:39:40 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\abc\Plocha\ATF-Cleaner.exe
[2010.07.02 21:23:10 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.02 11:17:02 | 000,012,881 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\Zazálohujte si důležitá data.docx
[2010.07.02 11:16:38 | 000,002,563 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\Microsoft Office Word 2007.lnk
[2010.07.02 08:17:55 | 000,047,104 | ---- | M] () -- C:\Documents and Settings\abc\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.01 23:29:30 | 000,167,354 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\chyba combofixu.JPG
[2010.07.01 20:20:29 | 000,100,908 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\SystemLook.exe
[2010.07.01 19:10:19 | 000,180,736 | ---- | M] () -- C:\WINDOWS\Aryvab.exe
[2010.07.01 19:04:07 | 000,219,648 | ---- | M] () -- C:\WINDOWS\System32\sshnas21.dll
[2010.07.01 07:28:00 | 000,128,079 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\deník janské.pdf
[2010.06.30 14:19:35 | 000,116,821 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\dveepedek.jpg
[2010.06.30 09:38:00 | 000,053,846 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\215-2010.dwg
[2010.06.29 08:16:04 | 001,152,731 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\Dj GeKKo vs Weebl - Badger and Snake.mp3
[2010.06.29 08:15:23 | 001,100,517 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\narwhals.mp3
[2010.06.28 22:48:29 | 000,293,272 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.28 22:28:31 | 000,988,320 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.06.28 22:28:31 | 000,435,594 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.06.28 22:28:31 | 000,432,572 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.06.28 22:28:31 | 000,079,464 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.06.28 22:28:31 | 000,068,490 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.06.19 14:12:17 | 000,353,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll
[2010.06.19 14:12:16 | 000,505,128 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll
[2010.06.16 08:45:20 | 000,038,618 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\tattoo.jpg
[2010.06.16 08:41:58 | 000,017,868 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\Berserk_Mark_by_Opeth0012.jpg
[2010.06.15 13:21:00 | 000,050,176 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\Smlouva 2 - subdodavatel 1.doc
[2010.06.11 07:50:00 | 000,160,768 | ---- | M] () -- C:\Documents and Settings\abc\Plocha\nabídkový rozpocet most v Oskavě.xls
[2010.06.07 21:18:21 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\abc\Data aplikací\AVSDVDPlayer.m3u
[2010.06.07 21:18:03 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.07.03 13:44:38 | 000,731,136 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\avenger.exe
[2010.07.02 11:17:02 | 000,012,881 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\Zazálohujte si důležitá data.docx
[2010.07.01 23:29:29 | 000,167,354 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\chyba combofixu.JPG
[2010.07.01 23:12:59 | 000,180,736 | ---- | C] () -- C:\WINDOWS\Aryvab.exe
[2010.07.01 20:20:29 | 000,100,908 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\SystemLook.exe
[2010.07.01 19:04:07 | 000,219,648 | ---- | C] () -- C:\WINDOWS\System32\sshnas21.dll
[2010.07.01 07:28:00 | 000,128,079 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\deník janské.pdf
[2010.06.30 14:19:35 | 000,116,821 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\dveepedek.jpg
[2010.06.30 09:38:00 | 000,053,846 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\215-2010.dwg
[2010.06.29 08:16:04 | 001,152,731 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\Dj GeKKo vs Weebl - Badger and Snake.mp3
[2010.06.29 08:14:54 | 001,100,517 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\narwhals.mp3
[2010.06.16 08:45:20 | 000,038,618 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\tattoo.jpg
[2010.06.16 08:41:58 | 000,017,868 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\Berserk_Mark_by_Opeth0012.jpg
[2010.06.15 13:21:00 | 000,050,176 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\Smlouva 2 - subdodavatel 1.doc
[2010.06.11 07:50:00 | 000,160,768 | ---- | C] () -- C:\Documents and Settings\abc\Plocha\nabídkový rozpocet most v Oskavě.xls
[2010.03.14 02:40:14 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.02.25 23:17:23 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2010.02.03 20:31:47 | 000,139,336 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.02.02 20:58:38 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2010.02.02 20:58:38 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.02.01 19:25:47 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.02.01 15:30:40 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\KOAZXA_L.DLL
[2010.01.31 19:12:25 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.01.31 19:12:23 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.01.31 19:12:21 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2010.01.31 19:12:20 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.01.31 18:55:05 | 001,810,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2010.01.31 18:55:05 | 000,034,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010.01.31 18:55:05 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010.01.31 18:47:23 | 000,000,880 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2008.09.17 19:02:20 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\MSHRES0E.DLL
[2008.08.20 02:36:54 | 000,028,779 | ---- | C] () -- C:\WINDOWS\MSUMLT0E.INI
[2008.05.12 15:51:50 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007.03.29 23:00:40 | 000,203,264 | ---- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2005.11.30 13:49:56 | 000,161,792 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2005.10.14 12:56:50 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005.02.17 13:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005.02.17 13:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.11.14 14:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2010.02.01 19:40:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\DAEMON Tools Lite
[2010.02.01 17:34:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\ESET
[2010.01.31 19:12:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\GHISLER
[2010.02.03 20:36:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\id Software
[2010.06.22 22:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\kikin
[2010.02.07 10:35:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Leadertech
[2010.02.02 19:48:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Nokia
[2010.02.01 18:54:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Opera
[2010.02.02 19:48:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\PC Suite
[2010.03.30 19:16:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\TS3Client
[2010.01.31 19:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\TuneUp Software
[2010.07.01 19:36:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\uTorrent
[2010.02.01 19:33:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2010.07.01 23:17:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.05.12 10:34:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\id Software
[2010.02.02 19:27:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Installations
[2010.02.02 19:31:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Suite
[2010.02.05 19:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Pinnacle
[2010.06.30 22:24:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2010.02.02 09:16:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
[2010.01.31 19:13:59 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 14:00:00 | 000,015,360 | ---- | M] (Microsoft Corporation)

< c:\windows\*.* /U >
[3 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.02.03 14:29:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Adobe
[2010.01.31 18:37:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\ATI
[2010.06.19 14:19:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\CyberLink
[2010.02.01 19:40:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\DAEMON Tools Lite
[2010.02.01 17:34:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\ESET
[2010.01.31 19:12:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\GHISLER
[2010.01.31 18:50:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\hpqLog
[2010.01.31 19:19:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\HpUpdate
[2010.02.03 20:36:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\id Software
[2010.01.31 16:59:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Identities
[2010.01.31 18:18:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\InstallShield
[2010.06.22 22:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\kikin
[2010.02.07 10:35:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Leadertech
[2010.01.31 19:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Macromedia
[2010.06.10 14:15:47 | 000,000,000 | --SD | M] -- C:\Documents and Settings\abc\Data aplikací\Microsoft
[2010.01.31 19:10:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Mozilla
[2010.03.13 20:55:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Nero
[2010.02.02 19:48:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Nokia
[2010.02.01 18:54:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Opera
[2010.02.02 19:48:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\PC Suite
[2010.06.10 11:34:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Skype
[2010.06.10 08:29:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\skypePM
[2010.02.25 23:20:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Sun
[2010.03.30 19:16:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\TS3Client
[2010.01.31 19:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\TuneUp Software
[2010.07.01 19:36:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\uTorrent
[2010.02.01 20:14:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Ventrilo
[2010.06.29 08:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\vlc
[2010.01.31 19:22:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\Winamp
[2010.01.31 19:20:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\abc\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2010.01.31 19:09:03 | 000,038,784 | ---- | M] () -- C:\Documents and Settings\abc\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe


< MD5 for: AGP440.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 02:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: CDROM.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.04.14 14:00:00 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\dllcache\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: HAL.DLL >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.04.14 14:00:00 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=4329EE7D502C9113EBA0F9570392F5EE -- C:\WINDOWS\system32\hal.dll

< MD5 for: CHANGER.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys

< MD5 for: IASTOR.SYS >
[2008.10.17 13:26:39 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\NLDRV\001\iastor.sys

< MD5 for: ISAPNP.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2008.04.14 14:00:00 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\dllcache\lsass.exe
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\dllcache\ndis.sys
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\dllcache\smss.exe
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\dllcache\ws2_32.dll
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008.09.10 23:25:20 | 000,421,888 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.02.01 19:34:24 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2010.01.31 17:22:11 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010.01.31 17:22:11 | 001,093,632 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010.01.31 17:22:11 | 000,503,808 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2008.09.10 23:25:20 | 000,421,888 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.07.01 19:04:07 | 000,219,648 | ---- | M] () -- C:\WINDOWS\system32\sshnas21.dll
[2010.07.02 21:23:10 | 000,013,646 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:5C321E34
< End of report >

[BL4zer]

extras

OTL Extras logfile created on: 3.7.2010 13:50:16 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\abc\Plocha
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 72,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 50,78 Gb Total Space | 22,97 Gb Free Space | 45,23% Space Free | Partition Type: NTFS
Drive D: | 98,26 Gb Total Space | 8,63 Gb Free Space | 8,78% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOFIS-NB-HP6735
Current User Name: abc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- D:\Pavel\programy\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "D:\Pavel\programy\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "D:\Pavel\programy\Opera\opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"D:\Pavel\programy\QIPold\QIP\qip.exe" = D:\Pavel\programy\QIPold\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"D:\Pavel\programy\Opera\opera.exe" = D:\Pavel\programy\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"D:\Pavel\GameS\steam\Steam.exe" = D:\Pavel\GameS\steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"D:\Pavel\programy\utorrent\uTorrent.exe" = D:\Pavel\programy\utorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"D:\Pavel\GameS\Garena\Garena.exe" = D:\Pavel\GameS\Garena\Garena.exe:*:Enabled:Garena -- (Garena Online PTE LTD)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"D:\Pavel\GameS\steam\steamapps\dj_l4m4\counter-strike\hl.exe" = D:\Pavel\GameS\steam\steamapps\dj_l4m4\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01378950-F60D-5CCD-A756-741F11AC28A3}" = Catalyst Control Center Localization Thai
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{112A080C-7FEE-DF04-0A98-5A46952F4988}" = CCC Help English
"{129DDEC1-A6A3-3D60-AABE-76E6E5334922}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - CSY
"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{18058624-242D-BBD2-A7E7-05DC0FCE99E8}" = CCC Help French
"{1C77BC2B-8F8B-C6EF-3906-09FAF21A7700}" = Catalyst Control Center Localization Russian
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1E2FDD18-E514-4631-AF4A-0CC58FD93DCB}" = Quake Live Mozilla Plugin
"{1EA82200-BD9C-3312-4FB2-F975D23FBA76}" = ccc-utility
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{276E1803-51FF-C2B4-1AA9-8FB1BA1018A8}" = Catalyst Control Center Localization Czech
"{339DEED7-B03A-79A6-746A-FD434E4E2D70}" = Catalyst Control Center Localization Swedish
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36E42EEB-84E3-66AB-8A5E-BCB0FAB9426B}" = Catalyst Control Center Localization Dutch
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam
"{3A8C38B6-54E4-0DD0-B0FB-574831671127}" = Catalyst Control Center Graphics Light
"{426C3B1B-61D2-AF3F-1BE8-79937C075AFF}" = CCC Help Polish
"{448F39D3-5CF5-2F5C-A135-8C51C94C6B37}" = CCC Help Norwegian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A276AF9-46BC-3896-EC3A-2F7BB470CAF7}" = CCC Help Finnish
"{4A352AF2-336D-45B6-CD3E-8B6E86879BB2}" = CCC Help Italian
"{53F9B21C-34C1-F83E-468E-09EA9A194527}" = Catalyst Control Center Localization Norwegian
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}" = Nokia PC Suite
"{5C07BDD0-F57C-852E-46DF-3196B699DE5A}" = CCC Help Chinese Standard
"{66944E9D-C37E-C8F4-0A5E-3204C6D75D86}" = Catalyst Control Center Localization German
"{6911CEE7-4D8B-9D8E-CAFF-4DEB6906AD5E}" = Catalyst Control Center Localization Hungarian
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{6D06E9C7-CF20-28A0-3D54-272EE2737867}" = CCC Help Turkish
"{6FE8B722-4D7E-3CD7-BB3A-3AD1684B1295}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - CSY
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73156E77-9AD7-A683-82CF-742A39E91D37}" = Skins
"{74DCC43B-33C9-3389-BD0D-33EB37973657}" = Microsoft .NET Framework 3.5 Language Pack - csy
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7981D8E3-ACD0-3C16-2D79-0ACE5BEE523D}" = CCC Help Portuguese
"{7B3CBEAC-3EF5-F318-D79C-5ADC12D6F362}" = Catalyst Control Center Graphics Full New
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{822049E9-CFE9-9BF6-508F-59267B5F59D8}" = ccc-core-preinstall
"{831E39CD-3968-4E70-3DEE-F66CFE59AA7A}" = CCC Help Danish
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = HP Integrated Module with Bluetooth wireless technology
"{8481CF72-E3C3-8E58-77F1-771F996E722A}" = Catalyst Control Center Localization Polish
"{8686D4FE-62EF-46FB-B9FD-00679EB381FF}_is1" = Trojan Killer 2.0
"{8BF17C99-355A-CD4F-B434-AF8884816C56}" = CCC Help Hungarian
"{8D6CDC85-F545-DF9A-AFB4-1396F7D75301}" = CCC Help Swedish
"{8EBE68FC-E9F8-BBC7-52CC-BAAF145D1E31}" = Catalyst Control Center Localization Greek
"{8F6E6502-0F6E-ADE3-FB36-C97220308ABF}" = Catalyst Control Center Localization Spanish
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0015-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}_PROHYBRIDR_{1FC5BC34-0301-40D2-9432-05BA220277B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}_PROHYBRIDR_{294B4278-CF7B-40B9-86A1-2D3FF0C2C524}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-001F-041B-0000-0000000FF1CE}_PROHYBRIDR_{10EC59E5-9BCE-4884-BB1A-E28627220232}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}_PROHYBRIDR_{E12F9D31-4025-4BC6-B1B2-AB262C5580B0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{915CECD9-6DF0-4107-72DA-FF86957F4187}" = Catalyst Control Center Core Implementation
"{9616E67E-B9D4-9069-AE1C-8BF09C69BE5F}" = CCC Help Russian
"{983201E9-1271-411F-A0E0-A11539C3198D}" = DisplayLink Core Software
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9E0136C7-1D9F-E793-1AD9-BE99B5E0A69B}" = Catalyst Control Center Localization Turkish
"{A0A76C15-3BF4-0F9D-93A5-4C287AD75EBE}" = Catalyst Control Center Localization Finnish
"{A12A36EB-ACB7-11D9-8E75-000D614181EB}" = TrekStor NDAS Software 3.11.1327
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3C37BB1-616F-454D-B4FA-E6B1E3BBE85B}" = HP 3D DriveGuard
"{AA6DC0E7-B8A1-6CDA-7369-86ED00E93739}" = Catalyst Control Center Localization Italian
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9DFF68B-831A-FD06-2099-4A7041FCB55F}" = Catalyst Control Center Localization Chinese Standard
"{BAE5E379-AC64-0D09-6295-EA45B4A26069}" = CCC Help Korean
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{BE263A6B-A71B-642E-9CD3-711D7283DA23}" = Catalyst Control Center Localization Portuguese
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C349C10C-1474-4000-9073-9299856C8A70}" = Catalyst Control Center - Branding
"{C6B47196-5208-47F6-BF83-E56CC78C4FED}" = HP USB Docking Video
"{CD68E5C1-39DD-9D43-C789-548671A2944C}" = CCC Help Chinese Traditional
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF2ED54C-B246-CB92-0D6E-3A1EF72AF65A}" = Catalyst Control Center Localization French
"{CFBD250D-6D35-A09A-A38E-7D8A30742160}" = Catalyst Control Center Graphics Full Existing
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3E93FE6-59AC-5583-FA56-CAE69465FC58}" = Catalyst Control Center Localization Danish
"{D848D140-41C3-4A53-86D8-E866A100B4CD}" = PC Connectivity Solution
"{DA859954-14AC-A262-69F8-9CB4B3AD16B5}" = CCC Help German
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{E045FAC9-0B70-4796-AD3A-7035E89CE536}" = SCR3xxx Smart Card Reader
"{E4899684-465D-0D18-0523-0B4BAB9196A2}" = CCC Help Spanish
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin (JDownloader Edition) 2.2
"{E51EB395-646F-ABE0-1BD5-0C3DB568D1BC}" = CCC Help Japanese
"{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}" = Need for Speed™ Undercover
"{E89DE689-A678-CE28-8B4E-D8086F80B6CE}" = CCC Help Greek
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{EB4528AD-E9CA-831E-3A94-C66B794B5E1A}" = CCC Help Thai
"{EEC248D2-C838-2503-0C03-05BDFF920ADA}" = Catalyst Control Center Localization Japanese
"{F0803639-33A5-8772-AB08-67676B6B330B}" = ccc-core-static
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F4105AFC-B69D-575F-44E6-CAB6E86DA0AA}" = CCC Help Dutch
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F6FAEA51-3ED4-4BAB-E815-F015476D7FA6}" = Catalyst Control Center Localization Korean
"{FACC20DD-DD0B-B913-9A8F-3FCBC16B4EFF}" = CCC Help Czech
"{FC976AA0-B59F-3FF6-BCC7-0EB40E806FC9}" = Catalyst Control Center Localization Chinese Traditional
"5986551A16FD8E9B1B4C89E7AAD17C1BB3196D28" = Balíček ovladače systému Windows - Nokia Modem (10/27/2008 7.01.0.1)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0 CE" = Adobe Photoshop 7.0 CE
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"Broadcom 802.11b Network Adapter" = Bezdrátový adaptér Broadcom 802.11 LAN
"BSPlayer1" = BSPlayer
"BUILDpower - sestava Dodavatel_is1" = BUILDpower - sestava Dodavatel ver. 9.0.1.0
"CCleaner" = CCleaner
"CDex" = CDex extraction audio
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Convert WAV To MP3_is1" = Convert WAV To MP3 1.0
"ft_Transport Tycoon Deluxe" = Transport Tycoon Deluxe
"Garena" = Garena 2010
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"IrfanView" = IrfanView (remove only)
"Java Plug-in" = Java Plug-in 1.1.3
"JDownloader" = JDownloader
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.7.0 (Full)
"KONICA MINOLTA magicolor 4690MF" = KONICA MINOLTA magicolor 4690MF
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack - csy" = Microsoft .NET Framework 3.5 Language Pack - CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"Nero - Burning Rom!UninstallKey" = Nero 6
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"PROHYBRIDR" = 2007 Microsoft Office system
"PunkBusterSvc" = PunkBuster Services
"rajče.net_is1" = rajče beta53 sestavení 101
"Shutter_is1" = Shutter
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Steam App 10" = Counter-Strike
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"VentriloMIX" = VentriloMIX
"VLC media player" = VLC media player 1.0.3
"Warkeys" = Warkeys 1.9.1.0b
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1123561945-1844823847-1644491937-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP Infium" = QIP Infium 2.0.9032 RC4
"Warcraft III" = Warcraft III: All Products
"Winamp Detect" = Winamp Application Detect

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 27.5.2010 2:44:46 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.

Error - 27.5.2010 10:58:41 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace bsplayer.exe, verze 1.3.7.826, chybující modul
bsplayer.exe, verze 1.3.7.826, adresa chyby 0x00001cc0.

Error - 10.6.2010 2:22:47 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 winword.exe, P2 12.0.6504.5000, P3
ntdll.dll, P4 5.1.2600.5755, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 17.6.2010 17:19:19 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace bsplayer.exe, verze 1.3.7.826, chybující modul
bsplayer.exe, verze 1.3.7.826, adresa chyby 0x00001cb5.

Error - 17.6.2010 17:33:51 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace bsplayer.exe, verze 1.3.7.826, chybující modul
, verze 1.3.7.826, adresa chyby 0x0000225a.

Error - 23.6.2010 1:18:12 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace explorer.exe, verze 6.0.2900.5512, chybující modul
atiadlxx.dll, verze 6.14.10.1007, adresa chyby 0x00001ed7.

Error - 1.7.2010 17:10:59 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace potvora.com.exe, verze 0.0.0.0, chybující modul
potvora.com.exe, verze 0.0.0.0, adresa chyby 0x00025a9b.

Error - 1.7.2010 17:22:55 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace potvora.com.exe, verze 0.0.0.0, chybující modul
potvora.com.exe, verze 0.0.0.0, adresa chyby 0x00025a9b.

Error - 1.7.2010 17:28:47 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace potvora.com.exe, verze 0.0.0.0, chybující modul
potvora.com.exe, verze 0.0.0.0, adresa chyby 0x00025a9b.

Error - 2.7.2010 1:12:03 | Computer Name = MOFIS-NB-HP6735 | Source = Application Error | ID = 1000
Description = Chybující aplikace potvora.com.exe, verze 0.0.0.0, chybující modul
potvora.com.exe, verze 0.0.0.0, adresa chyby 0x00025a9b.

[ OSession Events ]
Error - 4.2.2010 5:25:40 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4.2.2010 5:26:28 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4.2.2010 5:27:23 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4.2.2010 5:27:54 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.

Error - 24.3.2010 5:21:38 | Computer Name = MOFIS-NB-HP6735 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3499
seconds with 420 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2.7.2010 1:05:56 | Computer Name = MOFIS-NB-HP6735 | Source = sptd | ID = 262148
Description = Ovladač zjistil interní chybu ve vlastní struktuře dat u .

Error - 2.7.2010 1:07:00 | Computer Name = MOFIS-NB-HP6735 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2.7.2010 1:07:21 | Computer Name = MOFIS-NB-HP6735 | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: AmdPPM Fips sptd

Error - 2.7.2010 1:09:22 | Computer Name = MOFIS-NB-HP6735 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby StiSvc
s argumenty za účelem spuštění serveru: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2.7.2010 1:12:26 | Computer Name = MOFIS-NB-HP6735 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2.7.2010 11:08:22 | Computer Name = MOFIS-NB-HP6735 | Source = sptd | ID = 262148
Description = Ovladač zjistil interní chybu ve vlastní struktuře dat u .

Error - 2.7.2010 11:08:47 | Computer Name = MOFIS-NB-HP6735 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2.7.2010 11:08:54 | Computer Name = MOFIS-NB-HP6735 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby StiSvc
s argumenty za účelem spuštění serveru: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2.7.2010 11:09:47 | Computer Name = MOFIS-NB-HP6735 | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: AmdPPM Fips sptd

Error - 3.7.2010 7:47:18 | Computer Name = MOFIS-NB-HP6735 | Source = sr | ID = 1
Description = Filtr nástroje Obnovení systému zjistil neočekávanou chybu 0xC0000001
při zpracování souboru na svazku HarddiskVolume1. Sledování svazku bylo ukončeno.



< End of report >

[motji]

Prosím odstrante logy z code, špatně se mi to čte. děkuji

Použijte T-cleaner a zkuste ještě jendou stahnout combofix, jestli Vám bude znovu hlásit chybu, mělo by to už být opraveno.

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir


Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem