win 32/ Olmarik Trojan

[malicky77]

NOD mi hlásí tojana - V operační paměti nalezen trojský kůň Win32/Olmarik
Poradí prosím někdo jak na potvoru Olmarika?
vysledek s RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by malicky77 at 2010-10-23 12:42:29
Microsoft® Windows Vista™ Home Premium
System drive C: has 218 GB (71%) free of 305 GB
Total RAM: 3069 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:42:39 PM, on 10/23/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe
C:\Program Files\Steam\steam.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Spyware Doctor\Update.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\malicky77\Downloads\RSIT.exe
C:\Program Files\trend micro\malicky77.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.ask.com?o=15153&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [uTorrent] "C:\Users\malicky77\Downloads\utorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DELL Webcam Manager] "C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe" /s
O4 - HKCU\..\Run: [BSK91O3T6D] C:\Users\MALICK~1\AppData\Local\Temp\Oth.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [QEYTNAVSV] rundll32 "C:\Users\malicky77\AppData\Roaming\SLUIB.dll",iylohhvwgc
O4 - HKCU\..\Run: [dfrgsnapnt.exe] C:\Users\MALICK~1\AppData\Local\Temp\dfrgsnapnt.exe
O4 - HKCU\..\Run: [Antivirus] "C:\Users\malicky77\AppData\Roaming\AnVi\avt.exe" -noscan
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 8292 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Norton Security Scan for malicky77.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}]
PC Tools Browser Guard BHO - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll [2010-01-22 567248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{472734EA-242A-422B-ADF8-83D1E48CC825} - PC Tools Browser Guard - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll [2010-01-22 567248]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-02 1004136]
"NVHotkey"=C:\Windows\system32\nvHotkey.dll [2010-07-09 261736]
"SigmatelSysTrayApp"=C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2007-09-13 405504]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-08-10 202256]
"PAC207_Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-01 1164584]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2054360]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2010-10-23 1287120]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-08-03 1232896]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]
"uTorrent"=C:\Users\malicky77\Downloads\utorrent.exe [2010-08-02 327472]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
"DELL Webcam Manager"=C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe [2007-06-07 118784]
"BSK91O3T6D"=C:\Users\MALICK~1\AppData\Local\Temp\Oth.exe []
"Steam"=C:\Program Files\Steam\Steam.exe [2010-09-03 1242448]
"QEYTNAVSV"=rundll32 C:\Users\malicky77\AppData\Roaming\SLUIB.dll,iylohhvwgc []
"dfrgsnapnt.exe"=C:\Users\MALICK~1\AppData\Local\Temp\dfrgsnapnt.exe []
"Antivirus"=C:\Users\malicky77\AppData\Roaming\AnVi\avt.exe -noscan []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-10-23 12:42:30 ----D---- C:\Program Files\trend micro
2010-10-23 12:42:29 ----D---- C:\rsit
2010-10-23 10:28:25 ----A---- C:\Windows\BDTSupport.dll
2010-10-23 10:28:24 ----A---- C:\Windows\SGDetectionTool.dll
2010-10-23 10:28:24 ----A---- C:\Windows\PCTBDRes.dll
2010-10-23 10:28:24 ----A---- C:\Windows\PCTBDCore.dll
2010-10-23 10:24:55 ----A---- C:\Windows\system32\drivers\pctwfpfilter.sys
2010-10-23 10:24:55 ----A---- C:\Windows\system32\drivers\pctgntdi.sys
2010-10-23 10:24:50 ----A---- C:\Windows\system32\drivers\PCTCore.sys
2010-10-23 10:24:50 ----A---- C:\Windows\system32\drivers\PCTAppEvent.sys
2010-10-23 10:24:47 ----A---- C:\Windows\system32\drivers\pctplsg.sys
2010-10-23 10:24:43 ----D---- C:\Users\malicky77\AppData\Roaming\PC Tools
2010-10-23 10:24:43 ----D---- C:\ProgramData\PC Tools
2010-10-23 10:24:43 ----D---- C:\Program Files\Spyware Doctor
2010-10-23 10:24:43 ----D---- C:\Program Files\Common Files\PC Tools
2010-10-23 10:24:34 ----AD---- C:\ProgramData\TEMP
2010-10-23 10:07:57 ----D---- C:\Program Files\Common Files\Adobe
2010-10-23 10:07:57 ----D---- C:\Program Files\Adobe
2010-10-21 19:59:14 ----D---- C:\Users\malicky77\AppData\Roaming\ESET
2010-10-21 19:58:20 ----D---- C:\ProgramData\ESET
2010-10-21 19:58:20 ----D---- C:\Program Files\ESET
2010-10-21 19:13:36 ----RASH---- C:\MSDOS.SYS
2010-10-21 19:13:36 ----RASH---- C:\IO.SYS
2010-10-21 19:12:52 ----ASH---- C:\hiberfil.sys
2010-10-21 19:11:35 ----A---- C:\Windows\wininit.ini
2010-10-21 18:52:11 ----A---- C:\Windows\ntbtlog.txt
2010-10-21 17:54:22 ----D---- C:\Users\malicky77\AppData\Roaming\AnVi
2010-10-08 18:16:26 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-10-01 19:25:34 ----D---- C:\ProgramData\FLEXnet
2010-10-01 19:17:18 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-10-01 19:14:07 ----D---- C:\Users\malicky77\AppData\Roaming\Autodesk
2010-10-01 19:14:06 ----D---- C:\Program Files\AutoCAD Architecture 2010
2010-10-01 19:13:43 ----D---- C:\ProgramData\Autodesk
2010-10-01 19:07:58 ----D---- C:\Program Files\STEFISKO.com
2010-10-01 19:07:58 ----D---- C:\Program Files\Common Files\Autodesk Shared
2010-10-01 18:46:26 ----D---- C:\Users\malicky77\AppData\Roaming\dvdcss
2010-09-24 19:54:37 ----D---- C:\Users\malicky77\AppData\Roaming\Jpeg Resampler

======List of files/folders modified in the last 1 months======

2010-10-23 12:42:30 ----RD---- C:\Program Files
2010-10-23 12:42:30 ----D---- C:\Windows\Temp
2010-10-23 12:42:27 ----D---- C:\Windows\Prefetch
2010-10-23 12:40:48 ----D---- C:\Windows\system32\drivers
2010-10-23 12:06:31 ----D---- C:\Users\malicky77\AppData\Roaming\Skype
2010-10-23 11:13:11 ----D---- C:\Windows\System32
2010-10-23 11:13:11 ----D---- C:\Windows\inf
2010-10-23 11:13:11 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-23 11:06:43 ----D---- C:\Users\malicky77\AppData\Roaming\uTorrent
2010-10-23 11:06:23 ----D---- C:\Program Files\Steam
2010-10-23 11:05:50 ----D---- C:\Windows
2010-10-23 10:58:29 ----SHD---- C:\Windows\Installer
2010-10-23 10:24:43 ----HD---- C:\ProgramData
2010-10-23 10:24:43 ----D---- C:\Program Files\Common Files
2010-10-23 10:08:04 ----D---- C:\ProgramData\Adobe
2010-10-22 19:13:04 ----D---- C:\Users\malicky77\AppData\Roaming\skypePM
2010-10-21 19:58:48 ----D---- C:\Windows\system32\catroot
2010-10-21 17:42:16 ----D---- C:\Program Files\Mozilla Firefox
2010-10-19 23:18:58 ----SHD---- C:\System Volume Information
2010-10-19 11:41:44 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-14 18:11:02 ----A---- C:\Windows\system32\mrt.exe
2010-10-08 17:39:28 ----D---- C:\Windows\system32\catroot2
2010-10-07 20:28:42 ----D---- C:\Users\malicky77\AppData\Roaming\vlc
2010-10-07 17:58:55 ----D---- C:\Program Files\Common Files\Steam
2010-10-02 16:33:11 ----D---- C:\ProgramData\Symantec
2010-10-01 19:32:47 ----SD---- C:\Users\malicky77\AppData\Roaming\Microsoft
2010-10-01 19:19:00 ----RSD---- C:\Windows\assembly
2010-10-01 19:19:00 ----D---- C:\Windows\Microsoft.NET
2010-10-01 19:18:55 ----SD---- C:\Windows\Downloaded Program Files
2010-10-01 19:18:44 ----D---- C:\Windows\Help
2010-10-01 19:15:29 ----RSD---- C:\Windows\Fonts
2010-10-01 19:12:59 ----D---- C:\Windows\winsxs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PCTCore;PCTools KDS; C:\Windows\system32\drivers\PCTCore.sys [2010-10-23 218592]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2009-09-11 55768]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-09-11 135048]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2010-08-03 19456]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2006-11-02 92160]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2010-08-03 29184]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-06-19 33096]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
R3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-07-09 11008040]
R3 PAC207;PC Camer@; C:\Windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2006-11-02 49664]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2010-08-03 220160]
S3 cpuz132;cpuz132; \??\C:\Users\MALICK~1\AppData\Local\Temp\cpuz132\cpuz132_x32.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 rootrepeal;rootrepeal; \??\C:\Windows\system32\drivers\rootrepeal.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-09-20 73728]
R2 Browser Defender Update Service;Browser Defender Update Service; C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe [2010-01-22 112592]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 129640]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2010-03-11 366840]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2010-03-15 1142224]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
R3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-10-06 411432]
S2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 20680]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-10-01 651720]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[stell]

Zdravim
No mas tam pekneho previta.
restart do nudzoveho rezimu s pracou v sieti.
:arrow:Stiahnes rkill
na plochu-spustis, ak dostanes hlasku ze je to vir, ignorovat je to falosna hlaska od malware, takto sa brani, cakat aby ukoncil Malware procesy.
Ked program prebehne otvori sa notepad, ze ukoncil malware procesy, mozes notepad zatvorit ,odteraz nesmies restartovat pocitac, nakolko malware procesy sa obnovia.
Ak program neprebehne, nechat hlasku na ploche a spusti RKILL-znova.
Stiahnes>>mbam-setup
Nainstalovat, aktualizovat, a spustit skan.
Spravit>> Uplny skan, <<co najde daj zmazat, ak bude treba restart, uz mozes povolit.
Log vloz sem.
Podrobny Navod:
http://www.viry.cz/forum/viewtopic.php?f=29&t=67229

Stiahnes na plochu TFC
zatvor vsetko co mas otvorene a spust-po skane restart.

Vypnut obnovu systemu, restart a zapnut spat.
PROSIM CITAJTE POZORNE NAVOD!!!,

Použij ComboFix podle tohoto návodu: http://www.bleepingcomputer.com/combofi ... t-combofix
Log znej vloz sem.

[malicky77]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4932

Windows 6.0.6000 (Safe Mode)
Internet Explorer 7.0.6000.16982

10/24/2010 11:00:48 AM
mbam-log-2010-10-24 (11-00-48).txt

Typ skenu: Úplný sken (C:\|E:\|)
Skenované objekty: 285625
Uplynulý èas: 47 minuta(y), 7 sekunda(y)

Infikované procesy v pamìti: 0
Infikované moduly v pamìti: 0
Infikované klíèe registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 5

Infikované procesy v pamìti:
(Žádné škodlivé položky nebyly zjištìny)

Infikované moduly v pamìti:
(Žádné škodlivé položky nebyly zjištìny)

Infikované klíèe registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištìny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištìny)

Infikované soubory:
C:\Users\malicky77\AppData\Roaming\AnVi\avtext.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\malicky77\AppData\Roaming\AnVi\avthook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
E:\programy\Cyberlink Power DVD\Power DVD 7.0\keygen.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
E:\programy\Windows Activator-for all version - SherrySingh\Win XP Activation WPA Kill ( Windows XP version (SP1, SP2, SP3) )\CRYPT.DLL (Hacktool) -> Quarantined and deleted successfully.
E:\zaloha\Downloads\PopularScreensaversSetup2.3.50.22.ZRfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.

[stell]

ok, pokracuj combofixom.

[malicky77]

ComboFix 10-10-23.01 - malicky77 10/24/2010 12:12:45.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3069.1838 [GMT 1:00]
Running from: c:\users\malicky77\Downloads\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 4.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Spyware Doctor *enabled* (Updated) {1C3EDD79-273E-46ac-99F8-EFA9E7CBC301}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-09-24 to 2010-10-24 )))))))))))))))))))))))))))))))
.

2010-10-24 09:03 . 2010-10-24 09:03 -------- d-----w- c:\users\malicky77\AppData\Roaming\Malwarebytes
2010-10-24 09:01 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-24 09:01 . 2010-10-24 09:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-24 09:01 . 2010-10-24 09:01 -------- d-----w- c:\programdata\Malwarebytes
2010-10-24 09:01 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-23 11:42 . 2010-10-23 11:42 -------- d-----w- c:\program files\trend micro
2010-10-23 11:42 . 2010-10-23 12:07 -------- d-----w- C:\rsit
2010-10-23 09:24 . 2010-10-24 11:10 -------- d-----w- c:\program files\Spyware Doctor
2010-10-23 09:24 . 2010-10-24 11:10 -------- d-----w- c:\program files\Common Files\PC Tools
2010-10-23 09:07 . 2010-10-23 09:08 -------- d-----w- c:\program files\Common Files\Adobe
2010-10-22 14:22 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3828B867-4939-465F-B2E7-5C10A7B602F7}\mpengine.dll
2010-10-21 19:14 . 2010-10-21 19:14 -------- d-----w- c:\users\malicky77\AppData\Local\ESET
2010-10-21 18:58 . 2010-10-21 18:58 -------- d-----w- c:\program files\ESET
2010-10-21 16:54 . 2010-10-24 10:00 -------- d-----w- c:\users\malicky77\AppData\Roaming\AnVi
2010-10-08 17:16 . 2010-10-21 18:12 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-01 18:25 . 2010-10-01 18:25 -------- d-----w- c:\programdata\FLEXnet
2010-10-01 18:17 . 2010-10-01 18:17 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-10-01 18:14 . 2010-10-01 18:32 -------- d-----w- c:\users\malicky77\AppData\Roaming\Autodesk
2010-10-01 18:14 . 2010-10-01 18:19 -------- d-----w- c:\users\malicky77\AppData\Local\Autodesk
2010-10-01 18:14 . 2010-10-01 18:22 -------- d-----w- c:\program files\AutoCAD Architecture 2010
2010-10-01 18:13 . 2010-10-01 18:19 -------- d-----w- c:\programdata\Autodesk
2010-10-01 18:07 . 2010-10-01 18:19 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-10-01 18:07 . 2010-10-01 18:07 -------- d-----w- c:\program files\STEFISKO.com
2010-10-01 17:46 . 2010-10-01 17:46 -------- d-----w- c:\users\malicky77\AppData\Roaming\dvdcss
2010-09-24 18:54 . 2010-09-24 18:54 -------- d-----w- c:\users\malicky77\AppData\Roaming\Jpeg Resampler

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 10:41 . 2010-08-02 22:55 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-08-04 19:15 . 2010-08-04 19:15 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-08-04 19:13 . 2010-08-04 19:13 268800 ----a-w- c:\windows\system32\es.dll
2010-08-04 19:12 . 2010-08-04 19:12 36864 ----a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2010-08-03 00:27 . 2010-08-03 00:27 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-08-03 00:27 . 2010-08-03 00:27 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-08-03 00:27 . 2010-08-03 00:27 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-08-03 00:27 . 2010-08-03 00:27 24064 ----a-w- c:\windows\system32\lpk.dll
2010-08-03 00:27 . 2010-08-03 00:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-08-03 00:27 . 2010-08-03 00:27 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-08-03 00:26 . 2010-08-03 00:26 72704 ----a-w- c:\windows\system32\admparse.dll
2010-08-03 00:26 . 2010-08-03 00:26 832512 ----a-w- c:\windows\system32\wininet.dll
2010-08-03 00:26 . 2010-08-03 00:26 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2010-08-03 00:26 . 2010-08-03 00:26 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-08-03 00:26 . 2010-08-03 00:26 48128 ----a-w- c:\windows\system32\mshtmler.dll
2010-08-03 00:26 . 2010-08-03 00:26 389120 ----a-w- c:\windows\system32\html.iec
2010-08-03 00:26 . 2010-08-03 00:26 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2010-08-03 00:25 . 2010-08-03 00:25 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2010-08-03 00:25 . 2010-08-03 00:25 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-08-03 00:25 . 2010-08-03 00:25 56320 ----a-w- c:\windows\system32\iesetup.dll
2010-08-03 00:24 . 2010-08-03 00:24 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2010-08-03 00:24 . 2010-08-03 00:24 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-08-03 00:24 . 2010-08-03 00:24 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2010-08-03 00:24 . 2010-08-03 00:24 272896 ----a-w- c:\windows\system32\polstore.dll
2010-08-03 00:23 . 2010-08-03 00:23 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-08-03 00:23 . 2010-08-03 00:23 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-03 00:22 . 2010-08-03 00:22 87040 ----a-w- c:\windows\system32\msoert2.dll
2010-08-03 00:22 . 2010-08-03 00:22 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2010-08-03 00:22 . 2010-08-03 00:22 205824 ----a-w- c:\windows\system32\msoeacct.dll
2010-08-03 00:21 . 2010-08-03 00:21 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-08-03 00:21 . 2010-08-03 00:21 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-08-03 00:21 . 2010-08-03 00:21 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-08-03 00:21 . 2010-08-03 00:21 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-08-03 00:21 . 2010-08-03 00:21 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-08-03 00:21 . 2010-08-03 00:21 15360 ----a-w- c:\windows\system32\netevent.dll
2010-08-03 00:21 . 2010-08-03 00:21 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-08-03 00:21 . 2010-08-03 00:21 103936 ----a-w- c:\windows\system32\netiohlp.dll
2010-08-03 00:21 . 2010-08-03 00:21 10240 ----a-w- c:\windows\system32\finger.exe
2010-08-03 00:19 . 2010-08-03 00:19 194560 ----a-w- c:\windows\system32\WebClnt.dll
2010-08-03 00:19 . 2010-08-03 00:19 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2010-08-03 00:19 . 2010-08-03 00:19 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2010-08-03 00:19 . 2010-08-03 00:19 47104 ----a-w- c:\windows\system32\wlanapi.dll
2010-08-03 00:19 . 2010-08-03 00:19 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2010-08-03 00:19 . 2010-08-03 00:19 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2010-08-03 00:19 . 2010-08-03 00:19 502272 ----a-w- c:\windows\system32\wlansvc.dll
2010-08-03 00:19 . 2010-08-03 00:19 297984 ----a-w- c:\windows\system32\wlansec.dll
2010-08-03 00:18 . 2010-08-03 00:18 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-08-03 00:18 . 2010-08-03 00:18 1260032 ----a-w- c:\windows\system32\msxml3.dll
2010-08-03 00:18 . 2010-08-03 00:18 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-08-03 00:18 . 2010-08-03 00:18 1406464 ----a-w- c:\windows\system32\msxml6.dll
2010-08-03 00:17 . 2010-08-03 00:17 216576 ----a-w- c:\windows\system32\msv1_0.dll
2010-08-03 00:16 . 2010-08-03 00:16 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-08-03 00:16 . 2010-08-03 00:16 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-08-03 00:16 . 2010-08-03 00:16 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-08-03 00:15 . 2010-08-03 00:15 49664 ----a-w- c:\windows\system32\csrsrv.dll
2010-08-03 00:15 . 2010-08-03 00:15 376320 ----a-w- c:\windows\system32\winsrv.dll
2010-08-03 00:14 . 2010-08-03 00:14 2855424 ----a-w- c:\windows\system32\mf.dll
2010-08-03 00:14 . 2010-08-03 00:14 98816 ----a-w- c:\windows\system32\mfps.dll
2010-08-03 00:14 . 2010-08-03 00:14 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2010-08-03 00:14 . 2010-08-03 00:14 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-08-03 00:14 . 2010-08-03 00:14 2048 ----a-w- c:\windows\system32\mferror.dll
2010-08-03 00:13 . 2010-08-03 00:13 3502480 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-03 00:13 . 2010-08-03 00:13 3468168 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-03 00:10 . 2010-08-03 00:10 434176 ----a-w- c:\windows\system32\vbscript.dll
2010-08-03 00:09 . 2010-08-03 00:09 71680 ----a-w- c:\windows\system32\atl.dll
2010-08-03 00:08 . 2010-08-03 00:08 297472 ----a-w- c:\windows\system32\gdi32.dll
2010-08-03 00:06 . 2010-08-03 00:06 374456 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2010-08-03 00:06 . 2010-08-03 00:06 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2010-08-03 00:06 . 2010-08-03 00:06 30208 ----a-w- c:\windows\system32\xolehlp.dll
2010-08-03 00:05 . 2010-08-03 00:05 156160 ----a-w- c:\windows\system32\wkssvc.dll
2010-08-03 00:04 . 2010-08-03 00:04 116736 ----a-w- c:\windows\system32\aaclient.dll
2010-08-03 00:04 . 2010-08-03 00:04 36352 ----a-w- c:\windows\system32\tsgqec.dll
2010-08-03 00:04 . 2010-08-03 00:04 1871872 ----a-w- c:\windows\system32\mstscax.dll
2010-08-03 00:03 . 2010-08-03 00:03 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2010-08-03 00:01 . 2010-08-03 00:01 414208 ----a-w- c:\windows\system32\msscp.dll
2010-08-03 00:00 . 2010-08-03 00:00 392192 ----a-w- c:\windows\system32\FirewallAPI.dll
2010-08-03 00:00 . 2010-08-03 00:00 86016 ----a-w- c:\windows\system32\icfupgd.dll
2010-08-03 00:00 . 2010-08-03 00:00 63488 ----a-w- c:\windows\system32\drivers\mpsdrv.sys
2010-08-03 00:00 . 2010-08-03 00:00 61952 ----a-w- c:\windows\system32\cmifw.dll
2010-08-03 00:00 . 2010-08-03 00:00 396800 ----a-w- c:\windows\system32\MPSSVC.dll
2010-08-03 00:00 . 2010-08-03 00:00 16896 ----a-w- c:\windows\system32\wfapigp.dll
2010-08-02 23:55 . 2010-08-02 23:55 2048 ----a-w- c:\windows\system32\tzres.dll
2010-08-02 23:54 . 2010-08-02 23:54 696832 ----a-w- c:\windows\system32\localspl.dll
2010-08-02 23:53 . 2010-08-02 23:53 104448 ----a-w- c:\windows\system32\DWWIN.EXE
2010-08-02 23:52 . 2010-08-02 23:52 2923520 ----a-w- c:\windows\explorer.exe
2010-08-02 23:51 . 2010-08-02 23:51 494592 ----a-w- c:\windows\system32\kerberos.dll
2010-08-02 23:51 . 2010-08-02 23:51 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-08-02 23:51 . 2010-08-02 23:51 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-08-02 23:51 . 2010-08-02 23:51 7680 ----a-w- c:\windows\system32\lsass.exe
2010-08-02 23:51 . 2010-08-02 23:51 72704 ----a-w- c:\windows\system32\secur32.dll
2010-08-02 23:51 . 2010-08-02 23:51 272384 ----a-w- c:\windows\system32\schannel.dll
2010-08-02 23:51 . 2010-08-02 23:51 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2010-08-02 23:50 . 2010-08-02 23:50 24064 ----a-w- c:\windows\system32\netcfg.exe
2010-08-02 23:49 . 2010-08-02 23:49 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll
2010-08-02 23:49 . 2010-08-02 23:49 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll
2010-08-02 23:49 . 2010-08-02 23:49 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll
2010-08-02 23:49 . 2010-08-02 23:49 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll
2010-08-02 23:49 . 2010-08-02 23:49 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll
2010-08-02 23:49 . 2010-08-02 23:49 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll
2010-08-02 23:49 . 2010-08-02 23:49 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll
2006-06-15 19:33 . 2010-08-02 19:35 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 17:43 . 2010-08-02 19:35 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41 . 2010-08-02 19:35 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 12:10 . 2010-08-02 19:35 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19 . 2010-08-02 19:35 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35 . 2010-08-02 19:35 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10 . 2010-08-02 19:35 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42 . 2010-08-02 19:35 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22 . 2010-08-02 19:35 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21 . 2010-08-02 19:35 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-08-02 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"uTorrent"="c:\users\malicky77\Downloads\utorrent.exe" [2010-08-02 327472]
"DELL Webcam Manager"="c:\program files\DELL\DELL Webcam Manager\DellWMgr.exe" [2007-06-07 118784]
"Steam"="c:\program files\Steam\Steam.exe" [2010-09-03 1242448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-02 1004136]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-07-09 261736]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-10 202256]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]
S3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
S4 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [x]


--- Other Services/Drivers In Memory ---

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
Contents of the 'Scheduled Tasks' folder

2010-10-23 c:\windows\Tasks\Norton Security Scan for malicky77.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-09-23 09:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://uk.ask.com?o=15153&l=dis
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\malicky77\AppData\Roaming\Mozilla\Firefox\Profiles\nt4izvgk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-QEYTNAVSV - c:\users\malicky77\AppData\Roaming\SLUIB.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 12:18
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*]
@Class="Shell"

[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*\OpenWithList]
@Class="Shell"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-10-24 12:19:45
ComboFix-quarantined-files.txt 2010-10-24 11:19

Pre-Run: 228,057,538,560 bytes free
Post-Run: 228,005,351,424 bytes free

- - End Of File - - 3F5FDFA7426973DDDA1D600CC82E4542

[stell]

Tu urob poriadok:

SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Spyware Doctor *enabled* (Updated) {1C3EDD79-273E-46ac-99F8-EFA9E7CBC301}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

Moze zostat len 1-2-odinstalovat.,doporucujem spybot, a a este -1.
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
File::
c:\windows\Tasks\Norton Security Scan for malicky77.job
Folder::
c:\program files\Norton Security Scan
DDS::
uStart Page = hxxp://uk.ask.com?o=15153&l=dis
RegLock::
[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*]
[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*\OpenWithList]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts]
RegNull::
[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*]
[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*\OpenWithList]

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

[malicky77]

ComboFix 10-10-23.01 - malicky77 10/24/2010 15:54:53.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3069.1863 [GMT 1:00]
Running from: c:\users\malicky77\Downloads\ComboFix.exe
Command switches used :: c:\users\malicky77\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 4.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\Tasks\Norton Security Scan for malicky77.job"
.

((((((((((((((((((((((((( Files Created from 2010-09-24 to 2010-10-24 )))))))))))))))))))))))))))))))
.

2010-10-24 14:58 . 2010-10-24 15:02 -------- d-----w- c:\users\malicky77\AppData\Local\temp
2010-10-24 14:58 . 2010-10-24 14:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-24 11:40 . 2010-10-24 11:40 -------- d-----w- c:\program files\Skype
2010-10-24 11:40 . 2010-10-24 11:40 -------- d-----w- c:\program files\Common Files\Skype
2010-10-24 09:03 . 2010-10-24 09:03 -------- d-----w- c:\users\malicky77\AppData\Roaming\Malwarebytes
2010-10-24 09:01 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-24 09:01 . 2010-10-24 09:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-24 09:01 . 2010-10-24 09:01 -------- d-----w- c:\programdata\Malwarebytes
2010-10-24 09:01 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-23 11:42 . 2010-10-23 11:42 -------- d-----w- c:\program files\trend micro
2010-10-23 11:42 . 2010-10-24 11:45 -------- d-----w- C:\rsit
2010-10-23 09:07 . 2010-10-23 09:08 -------- d-----w- c:\program files\Common Files\Adobe
2010-10-22 14:22 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3828B867-4939-465F-B2E7-5C10A7B602F7}\mpengine.dll
2010-10-21 19:14 . 2010-10-21 19:14 -------- d-----w- c:\users\malicky77\AppData\Local\ESET
2010-10-21 18:58 . 2010-10-21 18:58 -------- d-----w- c:\program files\ESET
2010-10-21 16:54 . 2010-10-24 10:00 -------- d-----w- c:\users\malicky77\AppData\Roaming\AnVi
2010-10-08 17:16 . 2010-10-21 18:12 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-10-01 18:25 . 2010-10-01 18:25 -------- d-----w- c:\programdata\FLEXnet
2010-10-01 18:17 . 2010-10-01 18:17 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-10-01 18:14 . 2010-10-01 18:32 -------- d-----w- c:\users\malicky77\AppData\Roaming\Autodesk
2010-10-01 18:14 . 2010-10-01 18:19 -------- d-----w- c:\users\malicky77\AppData\Local\Autodesk
2010-10-01 18:14 . 2010-10-01 18:22 -------- d-----w- c:\program files\AutoCAD Architecture 2010
2010-10-01 18:13 . 2010-10-01 18:19 -------- d-----w- c:\programdata\Autodesk
2010-10-01 18:07 . 2010-10-01 18:19 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-10-01 18:07 . 2010-10-01 18:07 -------- d-----w- c:\program files\STEFISKO.com
2010-10-01 17:46 . 2010-10-01 17:46 -------- d-----w- c:\users\malicky77\AppData\Roaming\dvdcss
2010-09-24 18:54 . 2010-09-24 18:54 -------- d-----w- c:\users\malicky77\AppData\Roaming\Jpeg Resampler

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 10:41 . 2010-08-02 22:55 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-08-04 19:15 . 2010-08-04 19:15 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-08-04 19:13 . 2010-08-04 19:13 268800 ----a-w- c:\windows\system32\es.dll
2010-08-04 19:12 . 2010-08-04 19:12 36864 ----a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2010-08-03 00:27 . 2010-08-03 00:27 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-08-03 00:27 . 2010-08-03 00:27 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-08-03 00:27 . 2010-08-03 00:27 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-08-03 00:27 . 2010-08-03 00:27 24064 ----a-w- c:\windows\system32\lpk.dll
2010-08-03 00:27 . 2010-08-03 00:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-08-03 00:27 . 2010-08-03 00:27 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-08-03 00:26 . 2010-08-03 00:26 72704 ----a-w- c:\windows\system32\admparse.dll
2010-08-03 00:26 . 2010-08-03 00:26 832512 ----a-w- c:\windows\system32\wininet.dll
2010-08-03 00:26 . 2010-08-03 00:26 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2010-08-03 00:26 . 2010-08-03 00:26 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-08-03 00:26 . 2010-08-03 00:26 48128 ----a-w- c:\windows\system32\mshtmler.dll
2010-08-03 00:26 . 2010-08-03 00:26 389120 ----a-w- c:\windows\system32\html.iec
2010-08-03 00:26 . 2010-08-03 00:26 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2010-08-03 00:25 . 2010-08-03 00:25 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2010-08-03 00:25 . 2010-08-03 00:25 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-08-03 00:25 . 2010-08-03 00:25 56320 ----a-w- c:\windows\system32\iesetup.dll
2010-08-03 00:24 . 2010-08-03 00:24 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2010-08-03 00:24 . 2010-08-03 00:24 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-08-03 00:24 . 2010-08-03 00:24 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2010-08-03 00:24 . 2010-08-03 00:24 272896 ----a-w- c:\windows\system32\polstore.dll
2010-08-03 00:23 . 2010-08-03 00:23 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-08-03 00:23 . 2010-08-03 00:23 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-03 00:22 . 2010-08-03 00:22 87040 ----a-w- c:\windows\system32\msoert2.dll
2010-08-03 00:22 . 2010-08-03 00:22 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2010-08-03 00:22 . 2010-08-03 00:22 205824 ----a-w- c:\windows\system32\msoeacct.dll
2010-08-03 00:21 . 2010-08-03 00:21 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-08-03 00:21 . 2010-08-03 00:21 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-08-03 00:21 . 2010-08-03 00:21 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-08-03 00:21 . 2010-08-03 00:21 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-08-03 00:21 . 2010-08-03 00:21 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-08-03 00:21 . 2010-08-03 00:21 15360 ----a-w- c:\windows\system32\netevent.dll
2010-08-03 00:21 . 2010-08-03 00:21 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-08-03 00:21 . 2010-08-03 00:21 103936 ----a-w- c:\windows\system32\netiohlp.dll
2010-08-03 00:21 . 2010-08-03 00:21 10240 ----a-w- c:\windows\system32\finger.exe
2010-08-03 00:19 . 2010-08-03 00:19 194560 ----a-w- c:\windows\system32\WebClnt.dll
2010-08-03 00:19 . 2010-08-03 00:19 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2010-08-03 00:19 . 2010-08-03 00:19 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2010-08-03 00:19 . 2010-08-03 00:19 47104 ----a-w- c:\windows\system32\wlanapi.dll
2010-08-03 00:19 . 2010-08-03 00:19 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2010-08-03 00:19 . 2010-08-03 00:19 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2010-08-03 00:19 . 2010-08-03 00:19 502272 ----a-w- c:\windows\system32\wlansvc.dll
2010-08-03 00:19 . 2010-08-03 00:19 297984 ----a-w- c:\windows\system32\wlansec.dll
2010-08-03 00:18 . 2010-08-03 00:18 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-08-03 00:18 . 2010-08-03 00:18 1260032 ----a-w- c:\windows\system32\msxml3.dll
2010-08-03 00:18 . 2010-08-03 00:18 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-08-03 00:18 . 2010-08-03 00:18 1406464 ----a-w- c:\windows\system32\msxml6.dll
2010-08-03 00:17 . 2010-08-03 00:17 216576 ----a-w- c:\windows\system32\msv1_0.dll
2010-08-03 00:16 . 2010-08-03 00:16 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-08-03 00:16 . 2010-08-03 00:16 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-08-03 00:16 . 2010-08-03 00:16 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-08-03 00:15 . 2010-08-03 00:15 49664 ----a-w- c:\windows\system32\csrsrv.dll
2010-08-03 00:15 . 2010-08-03 00:15 376320 ----a-w- c:\windows\system32\winsrv.dll
2010-08-03 00:14 . 2010-08-03 00:14 2855424 ----a-w- c:\windows\system32\mf.dll
2010-08-03 00:14 . 2010-08-03 00:14 98816 ----a-w- c:\windows\system32\mfps.dll
2010-08-03 00:14 . 2010-08-03 00:14 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2010-08-03 00:14 . 2010-08-03 00:14 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-08-03 00:14 . 2010-08-03 00:14 2048 ----a-w- c:\windows\system32\mferror.dll
2010-08-03 00:13 . 2010-08-03 00:13 3502480 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-03 00:13 . 2010-08-03 00:13 3468168 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-03 00:10 . 2010-08-03 00:10 434176 ----a-w- c:\windows\system32\vbscript.dll
2010-08-03 00:09 . 2010-08-03 00:09 71680 ----a-w- c:\windows\system32\atl.dll
2010-08-03 00:08 . 2010-08-03 00:08 297472 ----a-w- c:\windows\system32\gdi32.dll
2010-08-03 00:06 . 2010-08-03 00:06 374456 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2010-08-03 00:06 . 2010-08-03 00:06 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2010-08-03 00:06 . 2010-08-03 00:06 30208 ----a-w- c:\windows\system32\xolehlp.dll
2010-08-03 00:05 . 2010-08-03 00:05 156160 ----a-w- c:\windows\system32\wkssvc.dll
2010-08-03 00:04 . 2010-08-03 00:04 116736 ----a-w- c:\windows\system32\aaclient.dll
2010-08-03 00:04 . 2010-08-03 00:04 36352 ----a-w- c:\windows\system32\tsgqec.dll
2010-08-03 00:04 . 2010-08-03 00:04 1871872 ----a-w- c:\windows\system32\mstscax.dll
2010-08-03 00:03 . 2010-08-03 00:03 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2010-08-03 00:01 . 2010-08-03 00:01 414208 ----a-w- c:\windows\system32\msscp.dll
2010-08-03 00:00 . 2010-08-03 00:00 392192 ----a-w- c:\windows\system32\FirewallAPI.dll
2010-08-03 00:00 . 2010-08-03 00:00 86016 ----a-w- c:\windows\system32\icfupgd.dll
2010-08-03 00:00 . 2010-08-03 00:00 63488 ----a-w- c:\windows\system32\drivers\mpsdrv.sys
2010-08-03 00:00 . 2010-08-03 00:00 61952 ----a-w- c:\windows\system32\cmifw.dll
2010-08-03 00:00 . 2010-08-03 00:00 396800 ----a-w- c:\windows\system32\MPSSVC.dll
2010-08-03 00:00 . 2010-08-03 00:00 16896 ----a-w- c:\windows\system32\wfapigp.dll
2010-08-02 23:55 . 2010-08-02 23:55 2048 ----a-w- c:\windows\system32\tzres.dll
2010-08-02 23:54 . 2010-08-02 23:54 696832 ----a-w- c:\windows\system32\localspl.dll
2010-08-02 23:53 . 2010-08-02 23:53 104448 ----a-w- c:\windows\system32\DWWIN.EXE
2010-08-02 23:52 . 2010-08-02 23:52 2923520 ----a-w- c:\windows\explorer.exe
2010-08-02 23:51 . 2010-08-02 23:51 494592 ----a-w- c:\windows\system32\kerberos.dll
2010-08-02 23:51 . 2010-08-02 23:51 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-08-02 23:51 . 2010-08-02 23:51 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-08-02 23:51 . 2010-08-02 23:51 7680 ----a-w- c:\windows\system32\lsass.exe
2010-08-02 23:51 . 2010-08-02 23:51 72704 ----a-w- c:\windows\system32\secur32.dll
2010-08-02 23:51 . 2010-08-02 23:51 272384 ----a-w- c:\windows\system32\schannel.dll
2010-08-02 23:51 . 2010-08-02 23:51 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2010-08-02 23:50 . 2010-08-02 23:50 24064 ----a-w- c:\windows\system32\netcfg.exe
2010-08-02 23:49 . 2010-08-02 23:49 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll
2010-08-02 23:49 . 2010-08-02 23:49 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll
2010-08-02 23:49 . 2010-08-02 23:49 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll
2010-08-02 23:49 . 2010-08-02 23:49 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll
2010-08-02 23:49 . 2010-08-02 23:49 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll
2010-08-02 23:49 . 2010-08-02 23:49 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll
2010-08-02 23:49 . 2010-08-02 23:49 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll
2006-06-15 19:33 . 2010-08-02 19:35 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 17:43 . 2010-08-02 19:35 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41 . 2010-08-02 19:35 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 12:10 . 2010-08-02 19:35 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19 . 2010-08-02 19:35 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35 . 2010-08-02 19:35 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10 . 2010-08-02 19:35 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42 . 2010-08-02 19:35 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22 . 2010-08-02 19:35 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21 . 2010-08-02 19:35 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-08-02 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"uTorrent"="c:\users\malicky77\Downloads\utorrent.exe" [2010-08-02 327472]
"DELL Webcam Manager"="c:\program files\DELL\DELL Webcam Manager\DellWMgr.exe" [2007-06-07 118784]
"Steam"="c:\program files\Steam\Steam.exe" [2010-09-03 1242448]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-02 1004136]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-07-09 261736]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-10 202256]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\malicky77\AppData\Roaming\Mozilla\Firefox\Profiles\nt4izvgk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 16:02
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*]
@Class="Shell"

[HKEY_USERS\S-1-5-21-3338976698-3248693182-171048153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*4%*~*\OpenWithList]
@Class="Shell"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\STacSV.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2010-10-24 16:04:08 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-24 15:04
ComboFix2.txt 2010-10-24 11:19

Pre-Run: 228,573,638,656 bytes free
Post-Run: 228,453,429,248 bytes free

- - End Of File - - 527B36E67DF25A21380EACE13B0CCCDB

[stell]

ok, ako sa chova pc??

[malicky77]

Je to v poriadku ESET nic nehlasi ani po celkovej kontrole ktoru som urobil nakoniec
Dakujem velmi pekne za pomoc budem urcite odporucat tuto stranku moji priatelom

Ste proste profici dik este raz

[stell]

odintaluj combofi-start-spustit-vloz prikaz combofix /uninstall
Bonus
Stiahnes>>OTMoveIt3 by OldTimer >.podla navodu vloz text a klik-Moveit>>log po restarte vloz sem

Kód: Vybrat vše

:processes
explorer.exe

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s

:Commands
[emptytemp]
[start explorer]
[Reboot]

Nemas zaco.

[malicky77]

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DF2.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP81A.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE752.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPEEF0.tmp folder moved successfully.
C:\WINDOWS\Installer\MSI1D85.tmp moved successfully.
C:\WINDOWS\Installer\MSIFDFE.tmp moved successfully.
C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\Temp\RAC743.tmp moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: malicky77
->Temp folder emptied: 219616 bytes
->Temporary Internet Files folder emptied: 159062 bytes
->FireFox cache emptied: 45368270 bytes
->Flash cache emptied: 1525 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33664 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 44.00 mb


OTM by OldTimer - Version 3.1.17.1 log created on 10242010_203702

Files moved on Reboot...





Tak hadam je to vsetko v poriadku

[stell]

Jasne ,ok, spust OTM-klik CLEANUP-yes,yes, nastroj sa zmaze.
Tot vse
Nemas zaco.

[Slappy]

Zdravím mám ten istý problém snažím sa o to zmazať ho ale nejak sa mi nedarí...

RSIT log
Logfile of random's system information tool 1.08 (written by random/random)
Run by User at 2011-06-14 09:12:07
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 11 GB (11%) free of 100 GB
Total RAM: 3071 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:12:15, on 14.6.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\apache2triad\bin\httpd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\apache2triad\bin\httpd.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\apache2triad\mysql\bin\mysqld.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\apache2triad\mail\bin\XMail.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\MDM.EXE
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\Documents and Settings\User\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\User.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.co.uk/ie
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\1104262109\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\prxtbSof0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Softonic English - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\prxtbSof0.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\prxtbSof0.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\1104262109\ICQToolBar.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Orezávač obrazovky a spúšťač programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1311A519-E112-4F6D-9347-4A81698F1C7E}: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CCS\Services\Tcpip\..\{904AB8CD-5BF2-4DE3-B96B-426CD1CFD779}: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CS1\Services\Tcpip\..\{1311A519-E112-4F6D-9347-4A81698F1C7E}: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CS2\Services\Tcpip\..\{1311A519-E112-4F6D-9347-4A81698F1C7E}: NameServer = 93.188.163.185,93.188.166.185
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.163.185,93.188.166.185
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apache2Triad Apache2 Service (Apache2) - Apache Software Foundation - C:\apache2triad\bin\httpd.exe
O23 - Service: Apache2Triad Apache2 Service with SSL (Apache2SSL) - Apache Software Foundation - C:\apache2triad\bin\httpd.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Apache2Triad MySql Service (MySql) - Unknown owner - C:\apache2triad\mysql\bin\mysqld.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache2Triad PostgreSQL Service (PgSql) - PostgreSQL Global Development Group - C:\apache2triad\pgsql\bin\pg_ctl.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Apache2Triad Xmail Service (XMail) - Unknown owner - C:\apache2triad\mail\bin\XMail.exe

--
End of file - 13200 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-839522115-1003UA.job
C:\WINDOWS\tasks\Install_NSS.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2010-12-08 3123072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll [2010-12-08 3123072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
Softonic English Toolbar - C:\Program Files\Softonic_English\prxtbSof0.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-02-09 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{930f1200-f5f1-4870-bac6-e233ec8e7023} - Softonic English Toolbar - C:\Program Files\Softonic_English\prxtbSof0.dll [2011-01-17 175912]
{D4027C7F-154A-4066-A1AD-4243D8127440} -
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\1104262109\ICQToolBar.dll [2010-11-21 1054520]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-01-17 175912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-16 13594624]
"DivX Download Manager"=C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe [2010-12-08 63360]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-11-04 2219184]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-01-31 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-03-21 1230704]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Google Update"=C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-10 136176]
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2010-07-04 95576]
"KiesHelper"=C:\Program Files\Samsung\Kies\KiesHelper.exe [2011-05-11 934800]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [2011-05-11 3373968]
"KiesPDLR"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2011-05-11 19856]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Documents and Settings\User\Start Menu\Programs\Startup
Orezávač obrazovky a spúšťač programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForever.exe"="C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForever.exe:*:Enabled:TrackMania Nations Forever"
"C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForeverLauncher.exe"="C:\Program Files\Valve\Steam\SteamApps\common\trackmania nations forever\TmForeverLauncher.exe:*:Enabled:TrackMania Nations Forever"
"C:\Program Files\HLSW\hlsw.exe"="C:\Program Files\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"C:\Program Files\Valve\NS\hl.exe"="C:\Program Files\Valve\NS\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Valve\NS\hlds.exe"="C:\Program Files\Valve\NS\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Program Files\Valve\NS\hltv.exe"="C:\Program Files\Valve\NS\hltv.exe:*:Enabled:HLTV Launcher"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Valve\Steam\SteamApps\patopato9\day of defeat\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\patopato9\day of defeat\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MP.exe:*:Enabled:Wolfenstein(TM)"
"C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe"="C:\Program Files\Activision\Wolfenstein\MP\Wolf2MPLite.exe:*:Enabled:Wolfenstein(TM)"
"C:\Program Files\Valve\Steam\Steam.exe"="C:\Program Files\Valve\Steam\Steam.exe:*:Enabled:Steam 732897"
"C:\Program Files\WinSCP\WinSCP.exe"="C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:SFTP, FTP and SCP client"
"C:\Program Files\W3\war3.exe"="C:\Program Files\W3\war3.exe:*:Enabled:Warcraft III"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Soldat\Soldat.exe"="C:\Soldat\Soldat.exe:*:Enabled:http://soldat.pl"
"C:\Documents and Settings\User\My Documents\solserver\soldatserver.exe"="C:\Documents and Settings\User\My Documents\solserver\soldatserver.exe:*:Enabled:soldatserver"
"F:\VirtualBox\Portable-VirtualBox\app32\VirtualBox.exe"="F:\VirtualBox\Portable-VirtualBox\app32\VirtualBox.exe:*:Enabled:VirtualBox GUI"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\Steam\SteamApps\patopato9\day of defeat source\hl2.exe"="C:\Program Files\Valve\Steam\SteamApps\patopato9\day of defeat source\hl2.exe:*:Enabled:Day of Defeat: Source"
"C:\Program Files\Valve\Steam\SteamApps\patopato9\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\patopato9\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\Documents and Settings\User\Desktop\Skype.exe"="C:\Documents and Settings\User\Desktop\Skype.exe:*:Enabled:Skype"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"
"C:\WINDOWS\system32\spoolsv.exe"="C:\WINDOWS\system32\spoolsv.exe:*:Enabled:spoolsv.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.5\ICQ.exe"="C:\Program Files\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5"

======List of files/folders created in the last 1 months======

2011-06-14 09:12:08 ----D---- C:\Program Files\trend micro
2011-06-14 09:12:07 ----D---- C:\rsit
2011-05-22 10:06:03 ----D---- C:\Temp
2011-05-18 18:49:54 ----D---- C:\Program Files\CDex

======List of files/folders modified in the last 1 months======

2011-06-14 09:12:14 ----D---- C:\WINDOWS\Temp
2011-06-14 09:12:08 ----D---- C:\Program Files
2011-06-14 00:59:07 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-06-13 22:36:08 ----D---- C:\WINDOWS\Prefetch
2011-06-13 21:09:11 ----D---- C:\Program Files\WinRAR
2011-06-13 11:51:05 ----D---- C:\Documents and Settings\User\Application Data\ICQ
2011-05-24 22:41:14 ----D---- C:\WINDOWS
2011-05-24 22:39:08 ----D---- C:\Documents and Settings\User\Application Data\Adobe
2011-05-22 11:22:30 ----D---- C:\WINDOWS\system32\drivers
2011-05-22 10:05:14 ----D---- C:\WINDOWS\system32\CatRoot2
2011-05-22 10:05:12 ----HD---- C:\WINDOWS\inf
2011-05-19 18:37:11 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-05-18 18:51:51 ----SHD---- C:\WINDOWS\Installer
2011-05-18 18:51:39 ----D---- C:\WINDOWS\WinSxS
2011-05-18 18:38:58 ----SD---- C:\WINDOWS\Tasks
2011-05-17 19:48:43 ----D---- C:\Robota

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2007-02-23 61312]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-31 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-08-03 95896]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2007-02-23 36096]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-08-04 140752]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2008-02-15 46592]
R2 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2007-02-23 62336]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2008-04-08 1309504]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-02-23 60800]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2008-04-15 534440]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-02-04 37160]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-04-15 990632]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-09-20 156392]
R3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-03-10 57384]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-03-27 47272]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2007-02-23 138752]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-02-03 5030912]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-02-23 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-16 6247680]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2008-09-25 41376]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2008-08-11 1752704]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-02-23 20608]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
S3 a3zxc357;a3zxc357; C:\WINDOWS\system32\drivers\a3zxc357.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\WINDOWS\system32\DRIVERS\athr.sys [2008-04-27 909824]
S3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024]
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2004-08-03 38016]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-03 274304]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 dgderdrv;dgderdrv; C:\WINDOWS\System32\drivers\dgderdrv.sys [2011-01-29 20032]
S3 FlashUSB;FlashUSB; C:\WINDOWS\system32\DRIVERS\FlashUSB.sys [2010-12-21 16896]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-12-12 15440]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\WINDOWS\system32\DRIVERS\hidbth.sys [2004-08-03 25600]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648]
S3 RTL8169;Realtek 8169 NT Driver; C:\WINDOWS\system32\DRIVERS\Rtlh86.sys [2008-08-06 124928]
S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-04 11136]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-04 10240]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2010-04-27 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2010-04-27 123648]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2010-04-27 104448]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2010-04-27 14848]
S3 ssm_mdm;SAMSUNG Mobile USB Port II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2010-04-27 132608]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2005-07-30 121856]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apache2;Apache2Triad Apache2 Service; C:\apache2triad\bin\httpd.exe [2009-05-08 17408]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-04-14 342624]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-11-04 810144]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2010-07-04 238952]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
R2 MySql;Apache2Triad MySql Service; C:\apache2triad\mysql\bin\mysqld.exe [2009-05-08 3960832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-16 168004]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-12-30 75064]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2006-10-01 167936]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-12-15 604488]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 XMail;Apache2Triad Xmail Service; C:\apache2triad\mail\bin\XMail.exe [2009-05-08 339968]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 Apache2SSL;Apache2Triad Apache2 Service with SSL; C:\apache2triad\bin\httpd.exe [2009-05-08 17408]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-11-04 33584]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-05-09 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PgSql;Apache2Triad PostgreSQL Service; C:\apache2triad\pgsql\bin\pg_ctl.exe [2009-05-08 75207]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-12-15 361288]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[vyosek]

Zdravim Slappy a vitam vas u nas na foru

Omlouvam se kolegovi za vstup

Slappy, prectete si prosim pravidla fora, zalozte si sve nove tema - u nas plati jeden uzivatel - jedno PC -jeden problem. Pak se to mota a je neprehledne.

Dekuji za pochopeni, zde