VIRY.CZ

Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v7.00.5730.13 (longhorn(wmbla).070711-1130)
Log vygenerován: 2010-09-26 15:11:44
================================================================

SmallARK
================================================================
[R]NtClose -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtCreateKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDeleteKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDeleteValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDuplicateObject -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenProcess -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenThread -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtQueryValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtRenameKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtRestoreKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtSetValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS



Běžící procesy
================================================================

C:\PROGRAM FILES\COMMON FILES\ACRONIS\SCHEDULE2\SCHEDUL2.EXE
C:\PROGRAM FILES\CYBERLINK\SHARED FILES\RICHVIDEO.EXE
C:\PROGRAM FILES\ACRONIS\TRUEIMAGEHOME\TRUEIMAGEMONITOR.EXE
C:\PROGRAM FILES\COMMON FILES\ACRONIS\SCHEDULE2\SCHEDHLP.EXE
C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMBGMONITOR.EXE
C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.EXE
C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQSTE08.EXE
C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQIMZONE.EXE

Scanner
================================================================
[S] explorer.exe
Spouští se po startu HKLM Winlogon [Shell]

[?] schedul2.exe
Nemá okno
Soubor 7%

[?] RichVideo.exe
Nemá okno
Soubor 7%

[?] TrueImageMonitor.exe
Spouští se po startu HKLM Run [TrueImageMonitor.exe]
Soubor 7%

[?] schedhlp.exe
Spouští se po startu HKLM Run [Acronis Scheduler2 Service]
Soubor 7%

[R] hpwuschd2.exe
Spouští se po startu HKLM Run [HP Software Update]

[R] jusched.exe
Spouští se po startu HKLM Run [SunJavaUpdateSched]

[R] AvastUI.exe
Spouští se po startu HKLM Run [avast5]

[S] ctfmon.exe
Spouští se po startu HKCU Run [CTFMON.EXE]

[?] NMBgMonitor.exe
Spouští se po startu HKCU Run [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
Soubor 7%

[?] NMIndexStoreSvr.exe
Soubor 7%

[R] BlueSoleil.exe
Spouští se po startu Po spuštění []
EntryPoint v sekci:
|_ Celkový počet sekcí: 7

[?] hpqtra08.exe
Spouští se po startu Po spuštění []
Soubor 7%

[?] hpqste08.exe
Soubor 14%

[?] hpqimzone.exe
EntryPoint v sekci:
|_ Celkový počet sekcí: 3
Soubor 7%


Po spuštění
================================================================

HKCU Run
|_ [?][BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
|_ [X][OEXPRESS] (Soubor nenalezen)

HKLM Run
|_ [?][TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
|_ [?][Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
|_ [?][LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe
|_ [?][Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
|_ [R][avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
|_ (Soubor nenalezen)
|_ [X][KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k (Soubor nenalezen)

HKLM IC
|_ [X][>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP (Soubor nenalezen)
|_ [X][>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP (Soubor nenalezen)
|_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
|_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
|_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp.inf ,PerUserStub
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll

Po spuštění
|_ C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
|_ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
|_ C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

Job
|_ [X][REGIST~1.JOB] C:\Program Files\ReviverSoft\Registry Reviver\RegistryReviver.exe (Soubor nenalezen)
|_ [X][VIDEOP~2.JOB] C:\Program Files\NCH Software\VideoPad\videopad.exe (Soubor nenalezen)
|_ [X][VIDEOP~1.JOB] C:\Program Files\NCH Software\VideoPad\videopad.exe (Soubor nenalezen)
|_ [X][VIDEOP~1.JOB] C:\Program Files\NCH Software\VideoPad\videopad.exe (Soubor nenalezen)


HKLM BHO
|_ [?][{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}] C:\Program Files\Translator\WebIE.dll
|_ [?][{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

HKCU IE WebBrowser Toolbar
|_ [X][{4B3803EA-5230-4DC3-A7FC-33638F3D3542}] (Soubor nenalezen)

HKLM IE Toolbar
|_ [?][{BFC32E1D-EE75-4A48-BC60-104E11EE2431}] C:\Program Files\Translator\WebIE.dll

Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] Acronis Scheduler2 Service
|_ Cesta: C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
| |_ Výrobce: Acronis
| |_ Popis: Acronis Scheduler 2
| |_ MD5: 540A982F6438010CB1A74A79EACA287F
|
|_ Jméno: AcrSch2Svc
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RpcSs

[X] Služba Google Update (gupdate)
|_ Cesta: C:\Program Files\Google\Update\GoogleUpdate.exe /svc
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: gupdate
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS

[X] Java Quick Starter
|_ Cesta: C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: JavaQuickStarterService
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:

[?] Cyberlink RichVideo Service(CRVS)
|_ Cesta: C:\Program Files\CyberLink\Shared files\RichVideo.exe
| |_ Výrobce:
| |_ Popis: RichVideo Module
| |_ MD5: BD517C7FB119997EFFBE39D5E4B37B05
|
|_ Jméno: RichVideo
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RPCSS


Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] PPdus ASPI Shell
|_ Cesta: C:\WINDOWS\system32\drivers\Afc.sys
| |_ Výrobce: Arcsoft, Inc.
| |_ Popis: Arcsoft(R) ASPI Shell
| |_ MD5: A7B8A3A79D35215D798A300DF49ED23F
|
|_ Jméno: Afc
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] ati2mtag
|_ Cesta: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI RAGE 128 Miniport Driver
| |_ MD5: 86BE5339A67C0A309F3E3EF8B0901EE5
|
|_ Jméno: ati2mtag
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] C-Media WDM Audio Interface
|_ Cesta: C:\WINDOWS\system32\drivers\cmuda.sys
| |_ Výrobce: C-Media Inc
| |_ Popis: C-Media Audio WDM Driver
| |_ MD5: 997F912324B3BB977AF2DF376E5508CE
|
|_ Jméno: cmuda
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] mdmxsdk
|_ Cesta: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
| |_ Výrobce: Conexant
| |_ Popis: Diagnostic Interface DRIVER
| |_ MD5: 195741AEE20369980796B557358CD774
|
|_ Jméno: mdmxsdk
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] PCLEPCI
|_ Cesta: C:\WINDOWS\system32\drivers\pclepci.sys
| |_ Výrobce: Pinnacle Systems GmbH
| |_ Popis: PCLEPCI
| |_ MD5: 1BEBE7DE8508A02650CDCE45C664C2A2
|
|_ Jméno: PCLEPCI
|_ StartName:
|_ Typ spouštění: System Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency: RPCSS

[?] Sony Ericsson seehcri Device Driver
|_ Cesta: C:\WINDOWS\system32\DRIVERS\seehcri.sys
| |_ Výrobce: Sony Ericsson Mobile Communications
| |_ Popis: seehcri Driver
| |_ MD5: E5B56569A9F79B70314FEDE6C953641E
|
|_ Jméno: seehcri
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] SiS PCI Fast Ethernet Adapter Driver
|_ Cesta: C:\WINDOWS\system32\DRIVERS\sisnic.sys
| |_ Výrobce: SiS Corporation
| |_ Popis: SiS PCI Fast Ethernet Adapter Driver
| |_ MD5: 3FBB6EF8B5A71A2FA11F5F461BB73219
|
|_ Jméno: SISNIC
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Acronis Snapshots Manager
|_ Cesta: C:\WINDOWS\system32\DRIVERS\snapman.sys
| |_ Výrobce: Acronis
| |_ Popis: Acronis Snapshot API
| |_ MD5: 9B242D08A973E7FC22455FAE1CD678B0
|
|_ Jméno: snapman
|_ StartName:
|_ Typ spouštění: Boot Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Acronis True Image FS Filter
|_ Cesta: C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
| |_ Výrobce: Acronis
| |_ Popis: Acronis True Image File System Filter
| |_ MD5: 9AFC73DC6092274C116FD4E486E53FC6
|
|_ Jméno: tifsfilter
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:

[?] Acronis True Image Backup Archive Explorer
|_ Cesta: C:\WINDOWS\system32\DRIVERS\timntr.sys
| |_ Výrobce: Acronis
| |_ Popis: Acronis True Image Backup Archive Explorer
| |_ MD5: F4F657B230DF4DCE7CD2BEA78D706C7A
|
|_ Jméno: timounter
|_ StartName:
|_ Typ spouštění: Boot Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:


lNetStat
================================================================
Typ: PID Proces Local <-> Remote Status
-----------------------------------------------------------------------------------------
TCP (1020) svchost.exe 0.0.0.0:135 LISTENING
TCP (4) Systém 0.0.0.0:445 LISTENING
TCP (960) svchost.exe 0.0.0.0:3389 LISTENING
TCP (2404) alg.exe 127.0.0.1:1031 LISTENING
TCP (688) jqs.exe 127.0.0.1:5152 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12025 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12080 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12110 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12119 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12143 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12465 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12563 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12993 LISTENING
TCP (1540) AvastSvc.exe 127.0.0.1:12995 LISTENING
TCP (4) Systém 192.168.1.102:139 LISTENING
TCP (2572) AvastUI.exe 192.168.1.102:1050 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1051 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1052 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1053 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1054 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1055 CLOSE_WAIT
TCP (2572) AvastUI.exe 192.168.1.102:1056 CLOSE_WAIT
TCP (2124) jucheck.exe 192.168.1.102:1058 <-> 65.49.74.72:80 ESTABLISHED
UDP (4) Systém 0.0.0.0:445 <-> 199.7.51.190:80 ESTABLISHED
UDP (808) lsass.exe 0.0.0.0:500
UDP (1176) svchost.exe 0.0.0.0:1025
UDP (1176) svchost.exe 0.0.0.0:1028
UDP (1176) svchost.exe 0.0.0.0:1049
UDP (808) lsass.exe 0.0.0.0:4500
UDP (1112) svchost.exe 127.0.0.1:123
UDP (1304) svchost.exe 127.0.0.1:1900
UDP (1112) svchost.exe 192.168.1.102:123
UDP (4) Systém 192.168.1.102:137
UDP (4) Systém 192.168.1.102:138
UDP (1304) svchost.exe 192.168.1.102:1900

Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[?] relog_ap.dll
|_ Cesta: C:\WINDOWS\system32\relog_ap.dll
|_ MD5: 7B6E7F7C6529F37302AED6C0C15FF497
|_ Výrobce: Acronis
|_ Procesy
|_ lsass.exe (808)

[?] mdimon.dll
|_ Cesta: C:\WINDOWS\system32\mdimon.dll
|_ MD5: CF0376023360AADD55C89BA50564AFDC
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ spoolsv.exe (1848)

[?] pdfshell.dll
|_ Cesta: C:\Program Files\Adobe\Acrobat 7.0\ActiveX\pdfshell.dll
|_ MD5: 4B0991CD076B617A2231B19A6663C1C9
|_ Výrobce: Adobe Systems, Inc.
|_ Procesy
|_ explorer.exe (1996)

[?] webie.dll
|_ Cesta: C:\Program Files\Translator\WEBIE.DLL
|_ MD5: B12D9F0CD1DD04C0FEC44226BF3EF7CB
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1996)

[?] medialibrarynse.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\MediaLibraryNSE.dll
|_ MD5: 9210CD075966FDDEAA8C02F28D76B52E
|_ Výrobce: Nero AG
|_ Procesy
|_ explorer.exe (1996)

[?] nmindexstoresvrps.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvrPS.dll
|_ MD5: 7157B4ED863CDEDD405E07786CB632C9
|_ Výrobce: Nero AG
|_ Procesy
|_ NMBgMonitor.exe (2780)
|_ NMIndexStoreSvr.exe (2924)

[?] nmdataservices.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMDataServices.dll
|_ MD5: 27FA2BCB4D397305AF0A1891F875A91D
|_ Výrobce: Nero AG
|_ Procesy
|_ NMBgMonitor.exe (2780)
|_ NMIndexStoreSvr.exe (2924)

[?] advrcntr2.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\AdvrCntr2.dll
|_ MD5: 58638D54FBFF495D812D1C1F7A032CBF
|_ Výrobce: Nero AG
|_ Procesy
|_ NMBgMonitor.exe (2780)

[?] nmlogcxx.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMLogCxx.dll
|_ MD5: CE6CE5B27B9EE425F79D246FFACB4442
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] log4cxx.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\log4cxx.dll
|_ MD5: BA2F8E8AB6C96649D19F1E35DF7347A5
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] nmcofoundation.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMCoFoundation.dll
|_ MD5: 90F435A7D1B0627906079ED6F5C86999
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] nmpluginbase.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMPluginBase.dll
|_ MD5: 1317A02A628E8A271BEC3B27EB91817B
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] nmfulltextextraction.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMFullTextExtraction.dll
|_ MD5: 703823CF46B56B746827E48968CF2D6B
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] nmsearchpluginsimilarimages.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMSearchPluginSimilarImages.dll
|_ MD5: 6D352B04256E96CA57F13414D4C3CC76
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] neroipp.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NeroIPP.dll
|_ MD5: 6D6D8C61D844CB4FDC7DFE534E9235D0
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] nmsqldb.dll
|_ Cesta: C:\Program Files\Common Files\Ahead\Lib\NMSQLDB.dll
|_ MD5: 193DD6FB64D5626DD589698B3568AA81
|_ Výrobce: Nero AG
|_ Procesy
|_ NMIndexStoreSvr.exe (2924)

[?] btwin.dll
|_ Cesta: C:\Program Files\IVT Corporation\BlueSoleil\btwin.dll
|_ MD5: 7A5195733D7D7728822EB881BCB1E248
|_ Výrobce: IVT Corporation.
|_ Procesy
|_ BlueSoleil.exe (2936)

[?] versit.dll
|_ Cesta: C:\Program Files\IVT Corporation\BlueSoleil\versit.dll
|_ MD5: A9A1434C4B94351196DE168E47342EA2
|_ Výrobce: IVT Corporation.
|_ Procesy
|_ BlueSoleil.exe (2936)

[?] btpres.dll
|_ Cesta: C:\Program Files\IVT Corporation\BlueSoleil\btpres.dll
|_ MD5: A31CC963EC65C73608CE3445CE4ABC8E
|_ Výrobce: IVT Corporation.
|_ Procesy
|_ BlueSoleil.exe (2936)

[?] setup.dll
|_ Cesta: C:\Program Files\IVT Corporation\BlueSoleil\setup.dll
|_ MD5: 1B915385A08CAAA460E586130CB61188
|_ Výrobce: IVT Corporation.
|_ Procesy
|_ BlueSoleil.exe (2936)

[?] msvcp60.dll
|_ Cesta: C:\Program Files\IVT Corporation\BlueSoleil\Msvcp60.dll
|_ MD5: 6050BCC1B23F3DF7A1876CBDCBAC8232
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ BlueSoleil.exe (2936)
|_ hpqtra08.exe (2972)
|_ hpqste08.exe (3568)
|_ hpqimzone.exe (3792)

[?] hpqmif08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqmif08.dll
|_ MD5: DA74F6CB9B6BADC53E72F49BDA478DDF
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpotradd.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpotradd.dll
|_ MD5: AEA0B0AA26E4EA377D6A12B3B5D6F90F
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpqusg.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqusg.dll
|_ MD5: 9EE09FD74D7D844F10A8450F0849B455
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpqrif08.dll
|_ Cesta: C:\PROGRA~1\HP\DIGITA~1\bin\hpqrif08.dll
|_ MD5: 20A1DE2D6A22DBCA17F0E6445420BE47
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpquio08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpquio08.dll
|_ MD5: 82E047AC9DCFA908F169EBB20C157198
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpodio08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpodio08.dll
|_ MD5: FC99DC360CFA2E32276151EB7B1D899D
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)
|_ hpqste08.exe (3568)

[?] hpqcob08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqcob08.dll
|_ MD5: B245E6716CF85BDC55D17030CA609A73
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)
|_ hpqste08.exe (3568)

[?] hpqcxm08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqcxm08.dll
|_ MD5: EA99B12613E5909526123EEC64D6ABDC
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)
|_ hpqste08.exe (3568)
|_ hpqimzone.exe (3792)

[?] hpqtra08.rsc
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.rsc
|_ MD5: E2D194424B3CC526B1AB5820BEEDB2E5
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpqtao08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqtao08.dll
|_ MD5: 621D873625B55315D248204E6588BA2D
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpotra08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpotra08.dll
|_ MD5: 4C7CE6459461B61EAD294EAF50AF3160
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpotra08.rsc
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpotra08.rsc
|_ MD5: 25BE3D23320501FC1C9A93517FB3B677
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpodvd09.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpodvd09.dll
|_ MD5: A490EDE46A746E14AE6876021B6D4269
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpoddcomm09.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpoddcomm09.dll
|_ MD5: 6BDA568A2AED0F84C717B5649F70C91C
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqtra08.exe (2972)

[?] hpqste08.rsc
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqste08.rsc
|_ MD5: E3210A65F4F2040A222EE3780A4D67D0
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpqsem08.rsc
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqsem08.rsc
|_ MD5: 4F75BF471A79C101DA797916522A8E5F
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpqmfc09.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqmfc09.dll
|_ MD5: 7BC9BBC3C0C756B69E3F152ABAD0B44F
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpocxi08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpocxi08.dll
|_ MD5: 891736C55CEF9D265F915BCC0737D8A8
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpqtap08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqtap08.dll
|_ MD5: 1BF96F094044E1A6DEBEFC6FC7E1025F
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpqsti08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqsti08.dll
|_ MD5: BCBEC1B5FDE429B2839410D22B5A0D15
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] hpqstp08.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqstp08.dll
|_ MD5: ADB83EDD735EB87F4030E5A9E9BA3D5C
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqste08.exe (3568)

[?] fusion.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
|_ MD5: B8294AFC55B31D835BE038222F61230C
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqcc2.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqcc2\3.0.0.0__a53cf5803f4c3827\hpqcc2.dll
|_ MD5: BB2BE4BA77C0C84D1A3F135D418B4659
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqutils.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqutils\4.0.0.0__a53cf5803f4c3827\hpqutils.dll
|_ MD5: 17DA38CB41189C545E84C4682F25A0F3
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqfmrsc.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqfmrsc\4.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll
|_ MD5: B22BA6939F9230CDD87EAD85F3ECD1D9
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqtray.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqtray\4.0.0.0__a53cf5803f4c3827\hpqtray.dll
|_ MD5: 80A137E5FB9E9CC95C1DCC9300905343
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqovskn.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqovskn\3.0.0.0__a53cf5803f4c3827\hpqovskn.dll
|_ MD5: 33DFCA90B4BE8C62B20CE0BEEE4CAC1D
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqimvlt.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqimvlt\3.0.0.0__a53cf5803f4c3827\hpqimvlt.dll
|_ MD5: BC33C1A2E9107E290A4B4F12894E25BD
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqimgrc.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqimgrc\4.0.0.0__a53cf5803f4c3827\hpqimgrc.dll
|_ MD5: 350750024696FD6496DDA08EBE5A1EA4
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqimzone.resources.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\cs\hpqimzone.resources.dll
|_ MD5: D246A2C9D0D643AF76654DBFDB14DE9A
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqntrop.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqntrop\4.0.0.0__a53cf5803f4c3827\hpqntrop.dll
|_ MD5: 5BDB40C486291CA8AF13A08232BAA177
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] interop.hpqcxm08.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\Interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\Interop.hpqcxm08.dll
|_ MD5: 659272675EABDCCFDA85CF5892ED244B
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\LEAD\13.0.0.113__9cf889f53ea9b907\LEAD.dll
|_ MD5: 648FE0D27734BB73EF04BC6789B20935
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.wrapper.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\LEAD.Wrapper\13.0.0.113__9cf889f53ea9b907\LEAD.Wrapper.dll
|_ MD5: 335270904FED5F3629FE0D2FCAB7BD4F
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqtray.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqtray.resources\4.0.0.0_cs_a53cf5803f4c3827\hpqtray.resources.dll
|_ MD5: E7B93781A3F0DD27BCF32009AFA49407
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqfmrsc.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqfmrsc.resources\4.0.0.0_cs_a53cf5803f4c3827\hpqfmrsc.resources.dll
|_ MD5: 055992845927E32EA77811A4F442D9C3
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.windows.forms.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\LEAD.Windows.Forms\13.0.0.113__9cf889f53ea9b907\LEAD.Windows.Forms.dll
|_ MD5: 4BBF2F7E4F0F21FDCF30F540E7331BD7
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.drawing.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\LEAD.Drawing\13.0.0.113__9cf889f53ea9b907\LEAD.Drawing.dll
|_ MD5: B8549829AABD31329CB20367F05630EA
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] interop.hpqimgr.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\interop.hpqimgr\3.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll
|_ MD5: 5D9E5C12AFA844EFCC6763A29BA8A76C
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqasset.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqasset\4.0.0.0__a53cf5803f4c3827\hpqasset.dll
|_ MD5: 6348FE0BB6230406E4401E94C3A660D8
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqmirsc.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqmirsc.dll
|_ MD5: 11DDA07E408DCDE39D4BE4FD5FFEF6D0
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqmirsc.resources.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\cs\hpqmirsc.resources.dll
|_ MD5: 868BBF45A6030443CCE609DB488FEEA5
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqedit.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqedit\3.0.0.0__a53cf5803f4c3827\hpqedit.dll
|_ MD5: 32DDD519C87B37C8520D3B48C1A13F96
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqvideo.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll
|_ MD5: AA50961D0889B2085C3A54B0A024643B
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.windows.forms.drawingcontainer.dll
|_ Cesta: c:\windows\assembly\gac\lead.windows.forms.drawingcontainer\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.drawingcontainer.dll
|_ MD5: D086D14AE3E163DD38230CBC804C6747
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqmdmr.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqmdmr\4.0.0.0__a53cf5803f4c3827\hpqmdmr.dll
|_ MD5: 8F8A3958A3AD696172C8D19827319E7D
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] lead.drawing.imaging.imageprocessing.dll
|_ Cesta: c:\windows\assembly\gac\lead.drawing.imaging.imageprocessing\13.0.0.113__9cf889f53ea9b907\lead.drawing.imaging.imageprocessing.dll
|_ MD5: F5A621C69B659258E5164306A15C9CAA
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqimlib.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll
|_ MD5: 268D22AD922CF3DC49962CD977B73A45
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqedit.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqedit.resources\3.0.0.0_cs_a53cf5803f4c3827\hpqedit.resources.dll
|_ MD5: 3671FE19CEDE2C6E6A224E96A3D4E308
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqglutl.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqglutl\4.0.0.0__a53cf5803f4c3827\hpqglutl.dll
|_ MD5: 603B55EA0E2A583D42133615C451BC5B
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqcc2.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqcc2.resources\3.0.0.0_cs_a53cf5803f4c3827\hpqcc2.resources.dll
|_ MD5: AB39AD2203E4A4AF8519A4D62C2D2527
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqvideo.resources.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\cs\hpqvideo.resources.dll
|_ MD5: 35E68A70B6875DD3DFBDC3F631B289FC
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] interop.hpqvideo.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\Interop.hpqvideo\3.0.0.0__a53cf5803f4c3827\Interop.hpqvideo.dll
|_ MD5: 67588302DFD1C8519311501DB3582623
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqvdcom.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqvdcom.dll
|_ MD5: 175E8A8B8705FD9D8EC3F582930B07A9
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqprrsc.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqprrsc\4.0.0.0__a53cf5803f4c3827\hpqprrsc.dll
|_ MD5: 66D547A0C6D70C23BD39AA6B1868A8E4
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqprrsc.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqprrsc.resources\4.0.0.0_cs_a53cf5803f4c3827\hpqprrsc.resources.dll
|_ MD5: 4CB607FF428FEA352DFD790BB32528EE
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] mscorlib.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\mscorlib.resources\1.0.5000.0_cs_b77a5c561934e089\Mscorlib.resources.dll
|_ MD5: 83D0F52B94011B3289EB7BF826CC8A71
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] interop.hprblog.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\Interop.hprblog\3.0.0.0__a53cf5803f4c3827\Interop.hprblog.dll
|_ MD5: F89BDD4110A8F493AB2E4637F52EB1F4
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqcprsc.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll
|_ MD5: A7B5156E9D435BBDE7F080556BF547B1
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqcprsc.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqcprsc.resources\3.0.0.0_cs_a53cf5803f4c3827\hpqcprsc.resources.dll
|_ MD5: 12FFA74F4E47D3F253153A6A57124CA5
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqisrtb.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll
|_ MD5: 4EB6946C795B0BEF7A5CF0151347E379
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqisrtb.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqisrtb.resources\4.0.0.0_cs_a53cf5803f4c3827\hpqisrtb.resources.dll
|_ MD5: 76D4A732E1A23D8991ABD42FF3360BAF
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqbakup.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqbakup\3.0.0.0__a53cf5803f4c3827\hpqbakup.dll
|_ MD5: 3F6922E3CFB53D5E58A0F2E8BE28259D
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqbakup.resources.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqbakup.resources\3.0.0.0_cs_a53cf5803f4c3827\hpqbakup.resources.dll
|_ MD5: 592BB7D6573331651AE96B5986684C1A
|_ Výrobce:
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqthumb.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll
|_ MD5: 1924C6FB611923DA4BEEC3DE6D5DC1EB
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqimgr.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\hpqimgr.dll
|_ MD5: F11CEBCEE8EBD44650500E790F5BEDE9
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] hpqiface.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\hpqiface\4.0.0.0__a53cf5803f4c3827\hpqiface.dll
|_ MD5: A0DCB32156BDF2EB4AF72EE38141E7B7
|_ Výrobce: Hewlett-Packard Co.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] ltkrn13n.dll
|_ Cesta: C:\Program Files\HP\Digital Imaging\bin\ltkrn13n.dll
|_ MD5: E2CD12A09AAB75B19123E4AB807B2D25
|_ Výrobce: LEAD Technologies, Inc.
|_ Procesy
|_ hpqimzone.exe (3792)

[?] mscorwks.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
|_ MD5: D928FFABCE0AC9D69FEF1F645C6C7B1D
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] mscorjit.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
|_ MD5: E9634A7E73A30F0BD17F9B0C19BD211A
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] mscorsn.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
|_ MD5: 4C2BB0E88229D59C276D7EA31951EB5B
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] mscorlib.dll
|_ Cesta: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
|_ MD5: A162574C97BB7C3C6DBE32D8DBCA42C2
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)
|_ hpqimzone.exe (3792)

[?] accessibility.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
|_ MD5: A1B44C0A1AD71F86579A4521D5B1C024
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)

[?] system.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
|_ MD5: D4525BFFC6DE7DDD95E841104494704F
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)
|_ hpqimzone.exe (3792)

[?] system.drawing.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
|_ MD5: 5B8755429A40C7280FF9AD7B4194DF47
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)
|_ hpqimzone.exe (3792)

[?] system.windows.forms.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
|_ MD5: 02681152FE52FC6E91A812A8A9420D2F
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)
|_ hpqimzone.exe (3792)

[?] system.xml.dll
|_ Cesta: C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
|_ MD5: 4E0351EE76439F1FC14914B5BFF7C9AE
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ hpqimzone.exe (3792)
|_ hpqimzone.exe (3792)



================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

ComboFix 10-09-25.07 - Strnišťátka 2010-09-26 19:19:29.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.511.114 [GMT 2:00]
Spuštěný z: c:\documents and settings\Strnišťátka\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Chip.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-26 do 2010-09-26 )))))))))))))))))))))))))))))))
.

2010-09-26 13:11 . 2010-09-26 13:11 -------- d-----w- c:\program files\Ultimate Process Manager

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 11:43 . 2010-08-17 17:36 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-26 11:36 . 2009-05-26 16:01 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-09-26 11:36 . 2008-03-10 17:52 -------- d-----w- c:\program files\HP
2010-09-26 11:36 . 2008-03-09 10:53 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-09-26 11:36 . 2008-03-09 10:46 -------- d-----w- c:\program files\Translator
2010-09-07 15:12 . 2010-07-03 12:58 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2009-03-01 08:42 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2009-03-01 08:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2009-03-01 08:42 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2009-03-01 08:42 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2009-03-01 08:42 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2009-03-01 08:42 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2009-03-01 08:42 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2009-03-01 08:42 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-20 08:26 . 2008-03-09 10:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-20 08:11 . 2010-08-20 08:11 -------- d-----w- c:\program files\Adobe Media Player
2010-08-20 08:08 . 2010-08-20 08:08 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-19 08:23 . 2008-03-09 13:42 -------- d-----w- c:\program files\Google
2010-08-09 22:23 . 2010-08-09 19:12 -------- d-----w- c:\program files\PhotoScape
2010-07-30 11:02 . 2010-07-30 11:02 -------- d-----w- c:\program files\Ask.com
2010-07-30 10:21 . 2008-03-09 10:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-30 09:38 . 2010-07-30 09:31 112834 ----a-w- c:\windows\hpoins07.dat
2010-07-28 15:13 . 2001-10-25 12:00 83914 ----a-w- c:\windows\system32\perfc005.dat
2010-07-28 15:13 . 2001-10-25 12:00 440766 ----a-w- c:\windows\system32\perfh005.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 13:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-02-18 1086226]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-02-17 122880]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-16 148888]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Rychl‚ spuçtŘnˇ aplikace HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPopUpsOnBoot"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-03-01 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-01 17744]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2009-12-25 27632]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 135664]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-03-10 13224]
S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [2008-08-12 83496]
S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [2008-08-12 15016]
S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [2008-08-12 109992]
S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s916mgmt.sys [2008-08-12 103976]
S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\drivers\s916obex.sys [2008-08-12 100008]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-26 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-04-05 11:03]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 08:23]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 08:23]

2010-09-26 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 13:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator\WebIE.dll
FF - ProfilePath - c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q=
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=2&q=
FF - component: c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-OEXPRESS - (no file)
AddRemove-{d08d9f98-1c78-4704-87e6-368b0023d831} - c:\program files\RelevantKnowledge\rlvknlg.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 19:24
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(800)
c:\windows\system32\relog_ap.dll
.
Celkový čas: 2010-09-26 19:28:38
ComboFix-quarantined-files.txt 2010-09-26 17:28

Před spuštěním: Volných bajtů: 10,257,612,800
Po spuštění: Volných bajtů: 10,323,222,528

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 72C32C8DBA97E9A63F2047744A34531B

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pustte. CF se spustí a vykoná příkazy ze skriptu.

provedla jsem a zde je výsledný log:

ComboFix 10-09-25.07 - Strnišťátka 2010-09-27 16:24:58.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.511.176 [GMT 2:00]
Spuštěný z: c:\documents and settings\Strnišťátka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Strnišťátka\Plocha\cfscript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_287.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-27 do 2010-09-27 )))))))))))))))))))))))))))))))
.

2010-09-26 13:11 . 2010-09-26 13:11 -------- d-----w- c:\program files\Ultimate Process Manager

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 11:43 . 2010-08-17 17:36 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-26 11:36 . 2009-05-26 16:01 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-09-26 11:36 . 2008-03-10 17:52 -------- d-----w- c:\program files\HP
2010-09-26 11:36 . 2008-03-09 10:53 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-09-26 11:36 . 2008-03-09 10:46 -------- d-----w- c:\program files\Translator
2010-09-07 15:12 . 2010-07-03 12:58 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2009-03-01 08:42 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2009-03-01 08:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2009-03-01 08:42 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2009-03-01 08:42 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2009-03-01 08:42 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2009-03-01 08:42 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2009-03-01 08:42 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2009-03-01 08:42 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-20 08:26 . 2008-03-09 10:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-20 08:11 . 2010-08-20 08:11 -------- d-----w- c:\program files\Adobe Media Player
2010-08-20 08:08 . 2010-08-20 08:08 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-19 08:23 . 2008-03-09 13:42 -------- d-----w- c:\program files\Google
2010-08-09 22:23 . 2010-08-09 19:12 -------- d-----w- c:\program files\PhotoScape
2010-07-30 10:21 . 2008-03-09 10:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-30 09:38 . 2010-07-30 09:31 112834 ----a-w- c:\windows\hpoins07.dat
2010-07-28 15:13 . 2001-10-25 12:00 83914 ----a-w- c:\windows\system32\perfc005.dat
2010-07-28 15:13 . 2001-10-25 12:00 440766 ----a-w- c:\windows\system32\perfh005.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-09-26_17.25.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-27 14:14 . 2010-09-27 14:14 16384 c:\windows\temp\Perflib_Perfdata_e0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-02-18 1086226]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-02-17 122880]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-16 148888]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Rychl‚ spuçtŘnˇ aplikace HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPopUpsOnBoot"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-03-01 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-01 17744]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2009-12-25 27632]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 135664]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-03-10 13224]
S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [2008-08-12 83496]
S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [2008-08-12 15016]
S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [2008-08-12 109992]
S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s916mgmt.sys [2008-08-12 103976]
S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\drivers\s916obex.sys [2008-08-12 100008]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-27 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-04-05 11:03]

2010-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 08:23]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 08:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\Translator\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\Translator\WebIE.dll
FF - ProfilePath - c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q=
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=2&q=
FF - component: c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Strnišťátka\Data aplikací\Mozilla\Firefox\Profiles\sl6etv08.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-27 16:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'lsass.exe'(800)
c:\windows\system32\relog_ap.dll
.
Celkový čas: 2010-09-27 16:33:20
ComboFix-quarantined-files.txt 2010-09-27 14:33
ComboFix2.txt 2010-09-26 17:28

Před spuštěním: Volných bajtů: 10,295,054,336
Po spuštění: Volných bajtů: 10,277,998,592

- - End Of File - - 474BAF7B41BE69A53FD3144F263069D9

Log již vypadá čistý. Nastala nějaká změna?

Ano nastala, pc již jede podstatně rychleji. Děkuji za pomoc a přeji hezký den

Hezký den i vám a nemáte zač!