pro Motji - virus získaný ze zprávy z Facebooku

[Pavla Šnajdrová]

Odpoledne jsme si psaly ohledně viru získaného mým neuváženým otevřením souboru zaslaného zprávou přes Chat na Facebooku. Na Vaše doporučení jsem si stáhla doporučené programy a zasílám výsledky jak z Mbamu, tak log z Rsitu. Takže prosím o jejich kontrolu a doporučení dalšího postupu. Mnohokrát děkuji

Výsledek z Mbamu:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4974

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28.10.2010 17:23:18
mbam-log-2010-10-28 (17-23-18).txt

Typ skenu: Úplný sken (C:\|D:\|)
Skenované objekty: 255418
Uplynulý čas: 53 minuta(y), 45 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 2
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidia driver monitor (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidia driver monitor (Trojan.Agent) -> No action taken.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (Adware.Shopper) -> No action taken.
D:\Documents and Settings\Luděk Šnajdr\Dokumenty\Stažené soubory\P17535732.JPG-www.facebook.exe (Worm.Palevo) -> No action taken.
D:\WINDOWS\nvsvc32.exe (Trojan.Agent) -> No action taken.

A asi vidím, kde je problém - ve stažených souborech. Já ho tam hledala, ale pravděpodobně jde o skrytý soubor ( Ale ještě, že jsme provedli sken, jak koukám, máme někde v počítači schovaného pravděpodobně i Trojského koníčka!!!

A zde je log z Rsitu:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Luděk Šnajdr at 2010-10-28 16:27:38
Systém Microsoft Windows XP Professional Service Pack 3
System drive D: has 7 GB (7%) free of 88 GB
Total RAM: 1919 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:27:54, on 28.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
D:\Program Files\GIL Virtual HDD\VHKTRAY.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Canon\MyPrinter\BJMyPrt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\CyberLink\Shared files\RichVideo.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\Program Files\Common Files\Java\Java Update\jucheck.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Temporary Internet Files\Content.IE5\URCRAP05\RSIT[1].exe
D:\Program Files\trend micro\Luděk Šnajdr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=data.plasy.cz:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - D:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: TSWLObj Class - {8A7B6C4E-282C-4000-8336-27859E0A38FF} - D:\Program Files\GIL Virtual HDD\tsweblock.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - D:\Program Files\Seznam.cz\listicka.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - D:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [VHKTRAY] D:\Program Files\GIL Virtual HDD\VHKTRAY.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "D:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [avast5] D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] D:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] D:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [NVIDIA driver monitor] D:\WINDOWS\nvsvc32.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Software Informer] "D:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [NVIDIA driver monitor] D:\WINDOWS\nvsvc32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 11285 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\AppleSoftwareUpdate.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
D:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-413027322-725345543-1003Core.job
D:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-413027322-725345543-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll [2005-04-22 328275]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-09-22 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - D:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-06-28 202144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A7B6C4E-282C-4000-8336-27859E0A38FF}]
TSWLObj Class - D:\Program Files\GIL Virtual HDD\tsweblock.dll [2003-10-08 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-29 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - D:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll [2010-09-01 842296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Lištička - D:\Program Files\Seznam.cz\listicka.dll [2010-05-05 1736472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll [2005-04-22 328275]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-29 278192]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - D:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-06-28 1615256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"VHKTRAY"=D:\Program Files\GIL Virtual HDD\VHKTRAY.exe [2004-02-18 786432]
"AppleSyncNotifier"=D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-09-08 47904]
"RemoteControl"=D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-12-07 30208]
"LanguageShortcut"=D:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-04-13 49152]
"avast5"=D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"nwiz"=nwiz.exe /installquiet []
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2010-04-03 110696]
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"RTHDCPL"=D:\WINDOWS\RTHDCPL.EXE [2009-12-08 18789920]
"SunJavaUpdateSched"=D:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"iTunesHelper"=D:\Program Files\iTunes\iTunesHelper.exe [2010-09-01 421160]
"QuickTime Task"=D:\Program Files\QuickTime\qttask.exe [2010-09-08 421888]
"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"CanonMyPrinter"=D:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-07-27 1983816]
"CanonSolutionMenu"=D:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]
"NVIDIA driver monitor"=D:\WINDOWS\nvsvc32.exe [2010-10-25 86016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-04-29 437584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"swg"=D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-03-17 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-09-13 139264]
"Software Informer"=D:\Program Files\Software Informer\softinfo.exe -autorun []
"Google Update"=D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-07-22 136176]
"NVIDIA driver monitor"=D:\WINDOWS\nvsvc32.exe [2010-10-25 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
D:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Bonjour\mDNSResponder.exe"="D:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"D:\Program Files\iTunes\iTunes.exe"="D:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"D:\Documents and Settings\Luděk Šnajdr\Dokumenty\Stažené soubory\P17535732.JPG-www.facebook.exe"="D:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-10-28 16:27:43 ----D---- D:\Program Files\trend micro
2010-10-28 16:27:38 ----D---- D:\rsit
2010-10-28 16:14:19 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Malwarebytes
2010-10-28 16:14:01 ----D---- D:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-10-28 16:14:01 ----A---- D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-28 16:14:00 ----D---- D:\Program Files\Malwarebytes' Anti-Malware
2010-10-28 16:14:00 ----A---- D:\WINDOWS\system32\drivers\mbam.sys
2010-10-25 15:43:32 ----RSH---- D:\WINDOWS\nvsvc32.exe
2010-10-13 09:00:51 ----HDC---- D:\WINDOWS\$NtUninstallKB2387149$
2010-10-13 09:00:47 ----HDC---- D:\WINDOWS\$NtUninstallKB2279986$
2010-10-13 09:00:43 ----HDC---- D:\WINDOWS\$NtUninstallKB2345886$
2010-10-13 09:00:40 ----HDC---- D:\WINDOWS\$NtUninstallKB2296011$
2010-10-13 09:00:33 ----HDC---- D:\WINDOWS\$NtUninstallKB2378111_WM9$
2010-10-13 09:00:29 ----HDC---- D:\WINDOWS\$NtUninstallKB982132$
2010-10-13 09:00:25 ----HDC---- D:\WINDOWS\$NtUninstallKB979687$
2010-10-13 08:59:07 ----HDC---- D:\WINDOWS\$NtUninstallKB981957$
2010-10-13 08:59:02 ----HDC---- D:\WINDOWS\$NtUninstallKB2360937$
2010-10-12 08:01:48 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJMyPrinter
2010-10-11 14:34:13 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJSolutionMenu
2010-10-11 14:22:32 ----D---- D:\Documents and Settings\All Users\Data aplikací\CanonIJ
2010-10-11 14:19:48 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJScan
2010-10-11 14:19:09 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Canon
2010-10-11 14:17:59 ----D---- D:\Documents and Settings\All Users\Data aplikací\CanonIJPLM
2010-10-11 14:14:02 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Canon Easy-WebPrint EX
2010-10-11 14:13:05 ----D---- D:\Program Files\Common Files\CANON
2010-10-11 14:08:55 ----HD---- D:\Program Files\CanonBJ
2010-10-11 14:07:48 ----D---- D:\Program Files\Canon
2010-10-11 13:05:13 ----HD---- D:\WINDOWS\system32\CanonIJ Uninstaller Information
2010-10-11 13:05:02 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonBJ
2010-10-11 13:04:56 ----RA---- D:\WINDOWS\system32\CNMIU9Z.DLL
2010-10-11 13:04:46 ----A---- D:\WINDOWS\system32\CNMLM9Z.DLL
2010-10-11 13:02:38 ----A---- D:\WINDOWS\system32\drivers\usbprint.sys
2010-10-11 13:02:20 ----RA---- D:\WINDOWS\system32\CNC550O.dll
2010-10-11 13:02:14 ----A---- D:\WINDOWS\system32\CNC550L.dll
2010-10-11 13:02:14 ----A---- D:\WINDOWS\system32\CNC550I.dll
2010-10-11 13:02:13 ----A---- D:\WINDOWS\system32\CNHMCA.dll
2010-10-11 13:02:13 ----A---- D:\WINDOWS\system32\CNC550U.dll
2010-10-11 13:02:13 ----A---- D:\WINDOWS\system32\CNC550C.dll
2010-10-11 13:02:11 ----A---- D:\WINDOWS\system32\drivers\usbscan.sys
2010-10-09 13:37:59 ----D---- D:\Program Files\Common Files\SWF Studio
2010-10-09 13:37:57 ----SHD---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\.#
2010-10-09 08:45:27 ----SHD---- D:\Config.Msi
2010-10-06 21:25:05 ----D---- D:\Documents and Settings\All Users\Data aplikací\McAfee
2010-09-29 22:25:02 ----HDC---- D:\WINDOWS\$NtUninstallKB2158563$

======List of files/folders modified in the last 1 months======

2010-10-28 16:27:43 ----RD---- D:\Program Files
2010-10-28 16:26:49 ----D---- D:\WINDOWS\Prefetch
2010-10-28 16:14:01 ----D---- D:\WINDOWS\system32\drivers
2010-10-28 14:14:04 ----D---- D:\WINDOWS\Temp
2010-10-28 13:58:06 ----D---- D:\WINDOWS
2010-10-28 10:09:51 ----A---- D:\WINDOWS\imsins.BAK
2010-10-28 10:09:19 ----D---- D:\WINDOWS\system32
2010-10-28 10:09:19 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2010-10-28 10:09:16 ----D---- D:\WINDOWS\system32\inetsrv
2010-10-28 10:09:14 ----D---- D:\WINDOWS\system32\CatRoot2
2010-10-27 21:18:59 ----A---- D:\WINDOWS\SchedLgU.Txt
2010-10-27 15:48:47 ----A---- D:\WINDOWS\win.ini
2010-10-21 09:04:54 ----D---- D:\Program Files\Mozilla Firefox
2010-10-19 20:21:18 ----SD---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Microsoft
2010-10-19 14:09:32 ----SHD---- D:\WINDOWS\Installer
2010-10-13 09:00:55 ----HD---- D:\WINDOWS\inf
2010-10-13 09:00:54 ----RSHDC---- D:\WINDOWS\system32\dllcache
2010-10-13 09:00:51 ----HD---- D:\WINDOWS\$hf_mig$
2010-10-13 09:00:41 ----D---- D:\WINDOWS\WinSxS
2010-10-13 09:00:19 ----D---- D:\Program Files\Internet Explorer
2010-10-13 09:00:11 ----D---- D:\WINDOWS\ie8updates
2010-10-13 08:59:13 ----A---- D:\WINDOWS\system32\MRT.exe
2010-10-11 14:13:05 ----D---- D:\Program Files\Common Files
2010-10-11 13:06:06 ----D---- D:\WINDOWS\system32\CatRoot
2010-10-11 13:02:15 ----D---- D:\WINDOWS\twain_32
2010-10-11 13:02:15 ----D---- D:\WINDOWS\Media
2010-10-09 10:12:45 ----D---- D:\WINDOWS\Microsoft.NET
2010-10-09 10:12:41 ----RSD---- D:\WINDOWS\assembly
2010-10-09 08:46:48 ----D---- D:\Program Files\Common Files\Adobe
2010-10-09 08:46:47 ----D---- D:\Documents and Settings\All Users\Data aplikací\Adobe
2010-10-04 09:50:58 ----D---- D:\Program Files\MediaCoder

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; D:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; D:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 AmdPPM;Ovladač procesoru HwPState AMD; D:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;aswSP; D:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; D:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 VHDDKEY;VHDDKEY; D:\WINDOWS\system32\drivers\VHDDKEY.sys [2003-12-18 7936]
R2 aswFsBlk;aswFsBlk; D:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;avast! Standard Shield Support; D:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R3 aswRdr;aswRdr; D:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; D:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-12-08 6017568]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\D:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; D:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2009-10-28 70272]
R3 nvnetbus;NVIDIA Network Bus Enumerator; D:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2009-10-28 13824]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; D:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S1 AmdK8;Ovladač procesoru AMD; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
S3 Ambfilt;Ambfilt; D:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 Arp1394;Protokol 1394 ARP Client; D:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; D:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
S3 Monfilt;Monfilt; D:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 NIC1394;1394 Net Driver; D:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBCCID;USB Smart Card reader; D:\WINDOWS\system32\DRIVERS\usbccid.sys [2006-06-14 29184]
S3 usbprint;Třída USB Printer; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; D:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK); D:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2007-06-25 500736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 avast! Antivirus;avast! Antivirus; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 Bonjour Service;Bonjour Service; D:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2009-02-10 116104]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2010-07-17 153376]
R2 nvsvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2010-04-03 154216]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); D:\Program Files\CyberLink\Shared files\RichVideo.exe [2005-08-08 167936]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 iPod Service;iPod Service; D:\Program Files\iPod\bin\iPodService.exe [2010-09-01 820008]
S2 gupdate;Služba Google Update (gupdate); D:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-29 135664]
S3 aspnet_state;Stavová služba ASP.NET; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-04 182768]
S3 idsvc;Služba Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-09-12 724992]
S3 ose;Office Source Engine; D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; D:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[motji]

Dobrý večer
V mbamu vše smažte a koukneme, jestli tam ještě něco nezůstalo

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

Kdyby jste si s něčím nevěděla rady, ptejte se .

[Pavla Šnajdrová]

[Pavla Šnajdrová]

Dobré ráno,
provedla jsem test ComboFixem, zde je log, prosím o jeho kontrolu:


ComboFix 10-10-28.03 - Luděk Šnajdr 29.10.2010 8:19.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1919.1461 [GMT 2:00]
Spuštěný z: d:\documents and settings\Luděk Šnajdr\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\documents and settings\Luděk Šnajdr\Data aplikací\.#

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-29 )))))))))))))))))))))))))))))))
.

2010-10-28 14:27 . 2010-10-28 14:27 -------- d-----w- d:\program files\trend micro
2010-10-28 14:27 . 2010-10-28 14:27 -------- d-----w- D:\rsit
2010-10-28 14:14 . 2010-10-28 14:14 -------- d-----w- d:\documents and settings\Luděk Šnajdr\Data aplikací\Malwarebytes
2010-10-28 14:14 . 2010-10-28 14:14 -------- d-----w- d:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-10-28 14:14 . 2010-04-29 13:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-10-28 14:14 . 2010-10-28 14:14 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2010-10-28 14:14 . 2010-04-29 13:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-10-13 06:52 . 2010-09-18 06:53 974848 -c----w- d:\windows\system32\dllcache\mfc42.dll
2010-10-13 06:52 . 2010-09-18 06:53 953856 -c----w- d:\windows\system32\dllcache\mfc40u.dll
2010-10-13 06:52 . 2010-08-23 16:12 617472 -c----w- d:\windows\system32\dllcache\comctl32.dll
2010-10-11 12:22 . 2010-10-11 12:22 -------- d-----w- d:\documents and settings\All Users\Data aplikací\CanonIJ
2010-10-11 12:19 . 2010-10-11 12:19 -------- d-----w- d:\documents and settings\Luděk Šnajdr\Data aplikací\Canon
2010-10-11 12:14 . 2010-10-11 12:14 -------- d-----w- d:\documents and settings\Luděk Šnajdr\Data aplikací\Canon Easy-WebPrint EX
2010-10-11 12:13 . 2010-10-11 12:13 -------- d-----w- d:\program files\Common Files\CANON
2010-10-11 12:07 . 2010-10-11 12:18 -------- d-----w- d:\program files\Canon
2010-10-11 11:05 . 2010-10-11 11:05 -------- d--h--w- d:\windows\system32\CanonIJ Uninstaller Information
2010-10-11 11:05 . 2010-10-11 11:05 -------- d--h--w- d:\documents and settings\All Users\Data aplikací\CanonBJ
2010-10-11 11:04 . 2009-03-18 08:09 178176 ----a-r- d:\windows\system32\CNMIU9Z.DLL
2010-10-11 11:04 . 2009-03-24 03:00 70656 ----a-w- d:\windows\system32\Spool\prtprocs\w32x86\CNMPP9Z.DLL
2010-10-11 11:04 . 2009-03-24 03:00 27648 ----a-w- d:\windows\system32\Spool\prtprocs\w32x86\CNMPD9Z.DLL
2010-10-11 11:04 . 2009-03-24 03:00 272384 ----a-w- d:\windows\system32\CNMLM9Z.DLL
2010-10-11 11:02 . 2008-04-13 18:47 25856 -c--a-w- d:\windows\system32\dllcache\usbprint.sys
2010-10-11 11:02 . 2008-04-13 18:47 25856 ----a-w- d:\windows\system32\drivers\usbprint.sys
2010-10-11 11:02 . 2009-02-04 12:17 90112 ----a-r- d:\windows\system32\CNC550O.dll
2010-10-11 11:02 . 2009-04-03 13:59 110592 ----a-w- d:\windows\system32\CNC550I.dll
2010-10-11 11:02 . 2009-03-19 12:38 303104 ----a-w- d:\windows\system32\CNC550L.dll
2010-10-11 11:02 . 2009-04-03 14:00 1310720 ----a-w- d:\windows\system32\CNC550C.dll
2010-10-11 11:02 . 2009-04-03 13:57 106496 ----a-w- d:\windows\system32\CNC550U.dll
2010-10-11 11:02 . 2008-08-25 16:02 15872 ----a-w- d:\windows\system32\CNHMCA.dll
2010-10-11 11:02 . 2008-04-13 18:45 15104 -c--a-w- d:\windows\system32\dllcache\usbscan.sys
2010-10-11 11:02 . 2008-04-13 18:45 15104 ----a-w- d:\windows\system32\drivers\usbscan.sys
2010-10-09 19:44 . 2010-10-09 19:44 -------- d-----w- d:\documents and settings\LocalService\Data aplikací\McAfee
2010-10-09 19:44 . 2010-10-09 19:44 -------- d-sh--w- d:\documents and settings\LocalService\IETldCache
2010-10-09 11:37 . 2010-10-09 11:37 -------- d-----w- d:\program files\Common Files\SWF Studio
2010-10-06 19:25 . 2010-10-06 19:25 -------- d-----w- d:\documents and settings\All Users\Data aplikací\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 10:23 . 2004-08-17 14:49 974848 ----a-w- d:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-17 14:49 974848 ----a-w- d:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2001-10-25 12:00 954368 ----a-w- d:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2001-10-25 12:00 953856 ----a-w- d:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2004-08-17 14:49 916480 ----a-w- d:\windows\system32\wininet.dll
2010-09-10 05:52 . 2004-08-17 14:49 1469440 ------w- d:\windows\system32\inetcpl.cpl
2010-09-10 05:52 . 2004-08-17 14:49 43520 ----a-w- d:\windows\system32\licmgr10.dll
2010-09-08 09:17 . 2010-09-08 09:17 94208 ----a-w- d:\windows\system32\QuickTimeVR.qtx
2010-09-08 09:17 . 2010-09-08 09:17 69632 ----a-w- d:\windows\system32\QuickTime.qts
2010-09-07 15:12 . 2010-06-30 19:04 38848 ----a-w- d:\windows\avastSS.scr
2010-09-07 15:11 . 2009-03-14 14:55 167592 ----a-w- d:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2009-03-14 14:56 46672 ----a-w- d:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2009-03-14 14:56 165584 ----a-w- d:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2009-03-14 14:56 23376 ----a-w- d:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2009-03-14 14:56 100176 ----a-w- d:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2009-03-14 14:56 94544 ----a-w- d:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2009-03-14 14:56 17744 ----a-w- d:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2009-03-14 14:56 28880 ----a-w- d:\windows\system32\drivers\aavmker4.sys
2010-09-01 11:52 . 2004-08-17 14:48 285824 ----a-w- d:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2004-08-17 14:44 1852800 ----a-w- d:\windows\system32\win32k.sys
2010-08-27 08:03 . 2004-08-17 14:49 119808 ----a-w- d:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2004-08-17 14:49 99840 ----a-w- d:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 05:25 5632 ----a-w- d:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-03 22:14 357248 ----a-w- d:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-17 14:49 617472 ----a-w- d:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-17 14:49 58880 ----a-w- d:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-17 14:49 590848 ----a-w- d:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="d:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-17 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 139264]
"Google Update"="d:\documents and settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-07-22 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="d:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"VHKTRAY"="d:\program files\GIL Virtual HDD\VHKTRAY.exe" [2004-02-18 786432]
"AppleSyncNotifier"="d:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"RemoteControl"="d:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="d:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"avast5"="d:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-08 18789920]
"SunJavaUpdateSched"="d:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="d:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"CanonMyPrinter"="d:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="d:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [14.3.2009 16:56 165584]
R1 VHDDKEY;VHDDKEY;d:\windows\system32\drivers\VHDDKey.sys [18.12.2003 16:00 7936]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [14.3.2009 16:56 17744]
S2 gupdate;Služba Google Update (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [29.7.2010 9:04 135664]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys [16.6.2010 19:39 1691480]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK);d:\windows\system32\drivers\ZD1211BU.sys [12.6.2010 8:40 500736]
.
Obsah adresáře 'Naplánované úlohy'

2010-10-01 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-10-29 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-07-29 07:04]

2010-10-28 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-07-29 07:04]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.facebook.com/
uInternet Settings,ProxyServer = http=data.plasy.cz:80
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - d:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - d:\program files\Seznam.cz\listicka.dll
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
Trusted Zone: mojebanka.cz
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - d:\documents and settings\Luděk Šnajdr\Data aplikací\Mozilla\Firefox\Profiles\oxgsvm2w.default\
FF - prefs.js: browser.search.selectedEngine - Search the Web
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - component: d:\documents and settings\Luděk Šnajdr\Data aplikací\Mozilla\Firefox\Profiles\oxgsvm2w.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: d:\documents and settings\Luděk Šnajdr\Data aplikací\Mozilla\Firefox\Profiles\oxgsvm2w.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: d:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: d:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: d:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Software Informer - d:\program files\Software Informer\softinfo.exe
HKLM-Run-nwiz - nwiz.exe
Notify-AtiExtEvent - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-29 08:24
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@d:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="d:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3288)
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-10-29 08:25:38
ComboFix-quarantined-files.txt 2010-10-29 06:25

Před spuštěním: 6 624 722 944
Po spuštění: 7 850 622 976

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 60B9C9F54F83F616DE6A551B98888975

Díky moc!!!

[motji]

Fajn, už tam nic nevidím, jak to vypadá s počítačem?

[Pavla Šnajdrová]

Internet funguje, zatím jsem připojená přes Google. Vyzkouším ještě ostatní prohlížeče. V poslední době byl celkem problém s rychlostí připojení, ale ta je, zdá se, také v pořádku!!!

[Pavla Šnajdrová]

Ostatní prohlížeče také fungují. Pravděpodobně se nám podařilo odstranit i problém, který byl v počítači už nějakou dobu Díky moc!!!
Mohu ještě jeden dotaz? Na disku C: mám několik složek se šílenými názvy (např. 1ad154a5c1252dd1b05320), které obsahují vždy jen jednu prázdnou složku update a nejde s nimi nic dělat (počítač odepírá přístup) - rádi bychom je smazali - je to možné?
Pro dnešek už musím končit, ale připojím se zítra večer - za všechny rady a pomoc mockrát děkuji

[motji]

Otestujte na http://www.virustotal.com

d:\windows\system32\drivers\VHDDKey.sys

-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.


Ty složky tam nechte, patří k aktualizacím. zavazí Vám tam nějak?


Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?

[Pavla Šnajdrová]

Dobrý den,
konečně jsem se dostala k počítači... Malá má od včerejška chřipku, tak máme trochu jiné starosti
Provedla jsem vše podle Vašich instrukcí a zasílám vyžádané informace:

Takže, zde je link z virustotal:
http://www.virustotal.com/file-scan/rep ... 1288517607

A zde log z Rsitu:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Luděk Šnajdr at 2010-10-31 11:34:33
Systém Microsoft Windows XP Professional Service Pack 3
System drive D: has 16 GB (18%) free of 88 GB
Total RAM: 1919 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:34:35, on 31.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\GIL Virtual HDD\VHKTRAY.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\CyberLink\Shared files\RichVideo.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Program Files\Canon\MyPrinter\BJMyPrt.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\iTunes\iTunes.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
D:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Documents and Settings\Luděk Šnajdr\Dokumenty\Downloads\RSIT.exe
D:\Program Files\trend micro\Luděk Šnajdr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=data.plasy.cz:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - D:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: TSWLObj Class - {8A7B6C4E-282C-4000-8336-27859E0A38FF} - D:\Program Files\GIL Virtual HDD\tsweblock.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - D:\Program Files\Seznam.cz\listicka.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - D:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [VHKTRAY] D:\Program Files\GIL Virtual HDD\VHKTRAY.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "D:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [avast5] D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] D:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] D:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - D:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 10477 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\AppleSoftwareUpdate.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll [2005-04-22 328275]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-09-22 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - D:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2010-06-28 202144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A7B6C4E-282C-4000-8336-27859E0A38FF}]
TSWLObj Class - D:\Program Files\GIL Virtual HDD\tsweblock.dll [2003-10-08 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-29 297648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - D:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll [2010-10-29 843832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Lištička - D:\Program Files\Seznam.cz\listicka.dll [2010-05-05 1736472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll [2005-04-22 328275]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - D:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2010-06-28 1615256]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-29 297648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"VHKTRAY"=D:\Program Files\GIL Virtual HDD\VHKTRAY.exe [2004-02-18 786432]
"AppleSyncNotifier"=D:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-09-08 47904]
"RemoteControl"=D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-12-07 30208]
"LanguageShortcut"=D:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-04-13 49152]
"avast5"=D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2010-04-03 110696]
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"RTHDCPL"=D:\WINDOWS\RTHDCPL.EXE [2009-12-08 18789920]
"SunJavaUpdateSched"=D:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"iTunesHelper"=D:\Program Files\iTunes\iTunesHelper.exe [2010-09-01 421160]
"QuickTime Task"=D:\Program Files\QuickTime\qttask.exe [2010-09-08 421888]
"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"CanonMyPrinter"=D:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-07-27 1983816]
"CanonSolutionMenu"=D:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-03-17 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-09-13 139264]
"Google Update"=D:\Documents and Settings\Luděk Šnajdr\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-07-22 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
D:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Bonjour\mDNSResponder.exe"="D:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"D:\Program Files\iTunes\iTunes.exe"="D:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-10-31 11:34:33 ----D---- D:\rsit
2010-10-31 10:50:55 ----D---- D:\Program Files\CCleaner
2010-10-29 08:27:05 ----SHD---- D:\RECYCLER
2010-10-28 15:27:43 ----D---- D:\Program Files\trend micro
2010-10-28 15:14:19 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Malwarebytes
2010-10-28 15:14:01 ----D---- D:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-10-28 15:14:01 ----A---- D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-28 15:14:00 ----D---- D:\Program Files\Malwarebytes' Anti-Malware
2010-10-28 15:14:00 ----A---- D:\WINDOWS\system32\drivers\mbam.sys
2010-10-13 08:00:51 ----HDC---- D:\WINDOWS\$NtUninstallKB2387149$
2010-10-13 08:00:47 ----HDC---- D:\WINDOWS\$NtUninstallKB2279986$
2010-10-13 08:00:43 ----HDC---- D:\WINDOWS\$NtUninstallKB2345886$
2010-10-13 08:00:40 ----HDC---- D:\WINDOWS\$NtUninstallKB2296011$
2010-10-13 08:00:33 ----HDC---- D:\WINDOWS\$NtUninstallKB2378111_WM9$
2010-10-13 08:00:29 ----HDC---- D:\WINDOWS\$NtUninstallKB982132$
2010-10-13 08:00:25 ----HDC---- D:\WINDOWS\$NtUninstallKB979687$
2010-10-13 07:59:07 ----HDC---- D:\WINDOWS\$NtUninstallKB981957$
2010-10-13 07:59:02 ----HDC---- D:\WINDOWS\$NtUninstallKB2360937$
2010-10-12 07:01:48 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJMyPrinter
2010-10-11 13:34:13 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJSolutionMenu
2010-10-11 13:22:32 ----D---- D:\Documents and Settings\All Users\Data aplikací\CanonIJ
2010-10-11 13:19:48 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonIJScan
2010-10-11 13:19:09 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Canon
2010-10-11 13:17:59 ----D---- D:\Documents and Settings\All Users\Data aplikací\CanonIJPLM
2010-10-11 13:14:02 ----D---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Canon Easy-WebPrint EX
2010-10-11 13:13:05 ----D---- D:\Program Files\Common Files\CANON
2010-10-11 13:08:55 ----HD---- D:\Program Files\CanonBJ
2010-10-11 13:07:48 ----D---- D:\Program Files\Canon
2010-10-11 12:05:13 ----HD---- D:\WINDOWS\system32\CanonIJ Uninstaller Information
2010-10-11 12:05:02 ----HD---- D:\Documents and Settings\All Users\Data aplikací\CanonBJ
2010-10-11 12:04:56 ----RA---- D:\WINDOWS\system32\CNMIU9Z.DLL
2010-10-11 12:04:46 ----A---- D:\WINDOWS\system32\CNMLM9Z.DLL
2010-10-11 12:02:38 ----A---- D:\WINDOWS\system32\drivers\usbprint.sys
2010-10-11 12:02:20 ----RA---- D:\WINDOWS\system32\CNC550O.dll
2010-10-11 12:02:14 ----A---- D:\WINDOWS\system32\CNC550L.dll
2010-10-11 12:02:14 ----A---- D:\WINDOWS\system32\CNC550I.dll
2010-10-11 12:02:13 ----A---- D:\WINDOWS\system32\CNHMCA.dll
2010-10-11 12:02:13 ----A---- D:\WINDOWS\system32\CNC550U.dll
2010-10-11 12:02:13 ----A---- D:\WINDOWS\system32\CNC550C.dll
2010-10-11 12:02:11 ----A---- D:\WINDOWS\system32\drivers\usbscan.sys
2010-10-09 12:37:59 ----D---- D:\Program Files\Common Files\SWF Studio
2010-10-09 07:45:27 ----D---- D:\Config.Msi
2010-10-06 20:25:05 ----D---- D:\Documents and Settings\All Users\Data aplikací\McAfee

======List of files/folders modified in the last 1 months======

2010-10-31 11:33:42 ----D---- D:\WINDOWS\Prefetch
2010-10-31 11:33:01 ----D---- D:\WINDOWS\Temp
2010-10-31 11:32:40 ----D---- D:\WINDOWS
2010-10-31 11:30:24 ----A---- D:\WINDOWS\SchedLgU.Txt
2010-10-31 11:30:23 ----D---- D:\WINDOWS\system32\CatRoot2
2010-10-31 10:53:59 ----D---- D:\WINDOWS\Debug
2010-10-31 10:50:55 ----RD---- D:\Program Files
2010-10-30 20:16:02 ----SHD---- D:\System Volume Information
2010-10-30 20:16:02 ----D---- D:\WINDOWS\system32\Restore
2010-10-29 08:26:25 ----D---- D:\Program Files\Mozilla Firefox
2010-10-29 08:15:18 ----SHD---- D:\WINDOWS\Installer
2010-10-29 07:25:12 ----SD---- D:\WINDOWS\Tasks
2010-10-29 07:24:28 ----A---- D:\WINDOWS\system.ini
2010-10-29 07:20:59 ----D---- D:\WINDOWS\system32\drivers
2010-10-29 07:20:59 ----D---- D:\WINDOWS\system32
2010-10-29 07:20:59 ----D---- D:\WINDOWS\AppPatch
2010-10-29 07:20:56 ----D---- D:\Program Files\Common Files
2010-10-28 20:09:01 ----HDC---- D:\WINDOWS\$NtUninstallKB961501$
2010-10-28 09:09:19 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI
2010-10-28 09:09:16 ----D---- D:\WINDOWS\system32\inetsrv
2010-10-27 14:48:47 ----A---- D:\WINDOWS\win.ini
2010-10-19 19:21:18 ----SD---- D:\Documents and Settings\Luděk Šnajdr\Data aplikací\Microsoft
2010-10-13 08:00:55 ----HD---- D:\WINDOWS\inf
2010-10-13 08:00:54 ----RSHDC---- D:\WINDOWS\system32\dllcache
2010-10-13 08:00:51 ----HD---- D:\WINDOWS\$hf_mig$
2010-10-13 08:00:41 ----D---- D:\WINDOWS\WinSxS
2010-10-13 08:00:19 ----D---- D:\Program Files\Internet Explorer
2010-10-13 08:00:11 ----D---- D:\WINDOWS\ie8updates
2010-10-13 07:59:13 ----A---- D:\WINDOWS\system32\MRT.exe
2010-10-11 12:06:06 ----D---- D:\WINDOWS\system32\CatRoot
2010-10-11 12:02:15 ----D---- D:\WINDOWS\twain_32
2010-10-11 12:02:15 ----D---- D:\WINDOWS\Media
2010-10-09 09:12:45 ----D---- D:\WINDOWS\Microsoft.NET
2010-10-09 09:12:41 ----RSD---- D:\WINDOWS\assembly
2010-10-09 07:46:48 ----D---- D:\Program Files\Common Files\Adobe
2010-10-09 07:46:47 ----D---- D:\Documents and Settings\All Users\Data aplikací\Adobe
2010-10-04 08:50:58 ----D---- D:\Program Files\MediaCoder

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; D:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; D:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 AmdPPM;Ovladač procesoru HwPState AMD; D:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 aswSP;aswSP; D:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; D:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 VHDDKEY;VHDDKEY; D:\WINDOWS\system32\drivers\VHDDKEY.sys [2003-12-18 7936]
R2 aswFsBlk;aswFsBlk; D:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;avast! Standard Shield Support; D:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R3 aswRdr;aswRdr; D:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; D:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-12-08 6017568]
R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; D:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2009-10-28 70272]
R3 nvnetbus;NVIDIA Network Bus Enumerator; D:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2009-10-28 13824]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; D:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S1 AmdK8;Ovladač procesoru AMD; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
S3 Ambfilt;Ambfilt; D:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 Arp1394;Protokol 1394 ARP Client; D:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; D:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
S3 Monfilt;Monfilt; D:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 NIC1394;1394 Net Driver; D:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBCCID;USB Smart Card reader; D:\WINDOWS\system32\DRIVERS\usbccid.sys [2006-06-14 29184]
S3 usbprint;Třída USB Printer; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; D:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 ZD1211BU(TP-LINK);TP-LINK Wireless USB Adapter Driver(TP-LINK); D:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2007-06-25 500736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 avast! Antivirus;avast! Antivirus; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 Bonjour Service;Bonjour Service; D:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; D:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2009-02-10 116104]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2010-07-17 153376]
R2 nvsvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2010-04-03 154216]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); D:\Program Files\CyberLink\Shared files\RichVideo.exe [2005-08-08 167936]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; D:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 iPod Service;iPod Service; D:\Program Files\iPod\bin\iPodService.exe [2010-09-01 820008]
S2 gupdate;Služba Google Update (gupdate); D:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-29 135664]
S3 aspnet_state;Stavová služba ASP.NET; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-04 182768]
S3 idsvc;Služba Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-09-12 724992]
S3 ose;Office Source Engine; D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; D:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


Počítač se zatím stále tváří tak, že je vše v pořádku - což je naprosto SUPER!!! Děkujeme

[motji]

Log je také v pořádku
Doporučuji doinstalovat nějaký firewall, např. Zone alarm.
Pokud nejsou problémy, je to vše . Ať se malá brzy uzdraví .

[Pavla Šnajdrová]

Díky!!!!!

[motji]

Není zač