recidivni viraky v PC, prosim o kontrolu logu

[Philloy]

Dobry den, prosim o kontrolu logu - porad mi Avira hlasi viraky v umisteni "System volume information" a to na vsech discich... uz po nekolik dnich to mazu, scanuju a furt se mrchy objevuji znova, vypadaji takhle: A0130125.exe A01xxxxx.exe atd... dneska, kdyz sem je smaznul tak chvili po tom se objevila chybova hlaska ze "avscan.exe" ma nakou chybu a ze je potreba uzavrit... nevim co s tim... Dal mi posledni dobou strasne zere CPU firefox..
diky za pomoc

log zde:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Philliboy at 2010-11-04 21:26:04
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 6 GB (17%) free of 33 GB
Total RAM: 3071 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:29:38, on 4.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\HDTUNE~1\HDTune.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Philliboy\Plocha\RSIT.exe
C:\Program Files\trend micro\Philliboy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Philliboy\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Philliboy\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuz1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GAMING~1\MouseElf.EXE
O4 - HKLM\..\Run: [HD Tune] C:\PROGRA~1\HDTUNE~1\HDTune.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [PrtScr by FireStarter] C:\Program Files\PrtScr\PrtScr.exe /Tray
O4 - HKCU\..\Run: [Centrum.cz Notifikátor] C:\Program Files\NetCentrum\Notifikator\Notifikator.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-602162358-1757981266-682003330-1003\..\Run: [PrtScr by FireStarter] C:\Program Files\PrtScr\PrtScr.exe /Tray (User '?')
O4 - HKUS\S-1-5-21-602162358-1757981266-682003330-1003\..\Run: [Centrum.cz Notifikátor] C:\Program Files\NetCentrum\Notifikator\Notifikator.exe (User '?')
O4 - HKUS\S-1-5-21-602162358-1757981266-682003330-1003\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User '?')
O4 - HKUS\S-1-5-21-602162358-1757981266-682003330-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-602162358-1757981266-682003330-1003 Startup: ATnotes.lnk (User '?')
O4 - S-1-5-18 Startup: ATnotes.lnk (User '?')
O4 - .DEFAULT Startup: ATnotes.lnk (User 'Default user')
O4 - Startup: ATnotes.lnk
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést vybrané vazby do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést vybrané vazby do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést výběr do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést výběr do existujícího PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

--
End of file - 11398 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\PandaUSBVaccine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2009-11-25 202080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Philliboy\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
Vuze Remote Toolbar - C:\Program Files\Vuze_Remote\tbVuz1.dll [2010-10-18 2735200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-09-15 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2009-11-25 1496408]
{ba14329e-9550-4989-b3f2-9732e92d17cc} - Vuze Remote Toolbar - C:\Program Files\Vuze_Remote\tbVuz1.dll [2010-10-18 2735200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-05-25 14477312]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-15 13680640]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-01-15 86016]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]
"mouseElf"=C:\PROGRA~1\GAMING~1\MouseElf.EXE [2005-07-15 208896]
"HD Tune"=C:\PROGRA~1\HDTUNE~1\HDTune.exe [2005-09-13 405504]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-09-10 2500552]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-01-27 185896]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PrtScr by FireStarter"=C:\Program Files\PrtScr\PrtScr.exe [2008-03-19 1375744]
"Centrum.cz Notifikátor"=C:\Program Files\NetCentrum\Notifikator\Notifikator.exe [2010-05-18 606720]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2010-10-28 2424560]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-07-27 1983816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Centrum.cz Notifikátor]
C:\Program Files\NetCentrum\Notifikator\Notifikator.exe [2010-05-18 606720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Philliboy\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-11-02 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
C:\WINDOWS\system32\oodtray.exe [2007-05-11 2512392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\supertintin_skype]
C:\Program Files\Supertintin for Skype\supertintin_skype.exe [2009-12-06 1043456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-01-27 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager]
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe [2009-06-26 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Speed Launcher.lnk]
C:\WINDOWS\INSTAL~1\{AC76B~1\SC_ACR~1.EXE [2009-11-04 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Philliboy^Nabídka Start^Programy^Po spuštění^TimeLeft.lnk]
C:\PROGRA~1\TIMELE~1\TimeLeft.exe [2010-03-08 2000112]

C:\Documents and Settings\Philliboy\Nabídka Start\Programy\Po spuštění
ATnotes.lnk - C:\Program Files\ATnotes\ATnotes.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\ICQ\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"D:\~ el Philloydo ~\Programs\DC++\DCPlusPlus.exe"="D:\~ el Philloydo ~\Programs\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"D:\~ el Philloydo ~\Programs\DC++ strong\StrongDC.exe"="D:\~ el Philloydo ~\Programs\DC++ strong\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-11-04 21:22:49 ----D---- C:\rsit
2010-10-28 18:28:08 ----D---- C:\Program Files\Common Files\Control Panels
2010-10-28 17:45:04 ----A---- C:\WINDOWS\system32\drivers\d347prt.sys
2010-10-28 17:45:04 ----A---- C:\WINDOWS\system32\drivers\d347bus.sys
2010-10-28 17:45:02 ----D---- C:\Program Files\Daemon Tools
2010-10-25 10:39:14 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-10-25 10:39:14 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-10-25 10:39:13 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-10-25 10:35:12 ----HDC---- C:\WINDOWS\$NtUninstallKB942288-v3$
2010-10-25 10:33:54 ----D---- C:\Autodesk
2010-10-20 16:59:48 ----HD---- C:\VritualRoot
2010-10-20 02:37:06 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Avira
2010-10-20 02:33:55 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys
2010-10-20 02:33:54 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2010-10-20 02:33:54 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys
2010-10-20 02:33:54 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2010-10-20 02:33:54 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys
2010-10-20 02:33:51 ----D---- C:\Program Files\Avira
2010-10-19 20:19:38 ----SHD---- C:\RECYCLER
2010-10-19 20:15:53 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Malwarebytes
2010-10-19 20:15:44 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-19 20:15:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-10-19 20:15:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-19 20:15:39 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-10-18 20:26:37 ----D---- C:\WINDOWS\temp
2010-10-18 19:27:46 ----A---- C:\WINDOWS\system32\resetlog.txt
2010-10-17 17:54:43 ----D---- C:\Program Files\COMODO
2010-10-17 10:51:38 ----A---- C:\Boot.bak
2010-10-17 10:51:32 ----RASHD---- C:\cmdcons
2010-10-17 00:52:43 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\SUPERAntiSpyware.com
2010-10-17 00:52:43 ----D---- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2010-10-17 00:52:36 ----D---- C:\Program Files\SUPERAntiSpyware
2010-10-17 00:00:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Comodo
2010-10-16 23:58:24 ----D---- C:\WINDOWS\system32\Default
2010-10-16 23:53:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Avira
2010-10-16 23:34:12 ----D---- C:\Config.Msi
2010-10-16 21:55:15 ----D---- C:\Program Files\Common Files\Java
2010-10-16 21:51:46 ----A---- C:\WINDOWS\system32\javaws.exe
2010-10-16 21:51:46 ----A---- C:\WINDOWS\system32\javaw.exe
2010-10-16 21:51:46 ----A---- C:\WINDOWS\system32\java.exe
2010-10-16 02:46:18 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Mozilla
2010-10-14 00:07:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2387149$
2010-10-14 00:07:10 ----HDC---- C:\WINDOWS\$NtUninstallKB2279986$
2010-10-14 00:07:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2345886$
2010-10-14 00:06:59 ----HDC---- C:\WINDOWS\$NtUninstallKB2296011$
2010-10-14 00:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2010-10-14 00:06:46 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2010-10-14 00:06:40 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2010-10-14 00:03:36 ----HDC---- C:\WINDOWS\$NtUninstallKB981957$
2010-10-14 00:03:26 ----HDC---- C:\WINDOWS\$NtUninstallKB2360937$

======List of files/folders modified in the last 1 months======

2010-11-04 21:26:09 ----D---- C:\Program Files\trend micro
2010-11-04 21:23:06 ----D---- C:\WINDOWS\Prefetch
2010-11-04 20:56:41 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Azureus
2010-11-04 20:48:46 ----A---- C:\WINDOWS\NeroDigital.ini
2010-11-04 12:03:04 ----D---- C:\WINDOWS\system32\NtmsData
2010-11-04 11:03:52 ----D---- C:\WINDOWS\Registration
2010-11-04 07:07:43 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-04 05:42:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-04 00:00:02 ----D---- C:\Program Files\SpeedFan
2010-11-03 22:02:27 ----D---- C:\WINDOWS\system32\Lang
2010-11-03 21:29:19 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Skype
2010-11-03 21:25:35 ----SHD---- C:\WINDOWS\Installer
2010-11-03 18:02:28 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\skypePM
2010-11-02 21:00:09 ----D---- C:\WINDOWS\system32\oodag
2010-11-02 08:39:24 ----D---- C:\WINDOWS\system32
2010-11-01 14:07:18 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Adobe
2010-11-01 07:19:30 ----SD---- C:\Documents and Settings\Philliboy\Data aplikací\Microsoft
2010-10-31 21:04:19 ----A---- C:\WINDOWS\wincmd.ini
2010-10-31 15:23:03 ----D---- C:\WINDOWS
2010-10-31 15:22:58 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-30 02:40:39 ----D---- C:\Program Files\Mozilla Firefox
2010-10-28 20:20:12 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-10-28 18:28:08 ----D---- C:\Program Files\Common Files
2010-10-28 18:19:43 ----D---- C:\Program Files\Common Files\Adobe
2010-10-28 17:45:10 ----HD---- C:\WINDOWS\inf
2010-10-28 17:45:04 ----D---- C:\WINDOWS\system32\drivers
2010-10-28 17:45:02 ----RD---- C:\Program Files
2010-10-28 17:44:33 ----D---- C:\WINDOWS\Downloaded Installations
2010-10-25 10:42:17 ----RSD---- C:\WINDOWS\assembly
2010-10-25 10:41:23 ----D---- C:\WINDOWS\Microsoft.NET
2010-10-25 10:40:53 ----RSD---- C:\WINDOWS\Fonts
2010-10-25 10:40:53 ----D---- C:\Documents and Settings\Philliboy\Data aplikací\Autodesk
2010-10-25 10:40:49 ----D---- C:\Program Files\Common Files\Autodesk Shared
2010-10-25 10:39:53 ----D---- C:\Program Files\Autodesk
2010-10-25 10:39:15 ----D---- C:\WINDOWS\system32\DirectX
2010-10-25 10:35:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\Autodesk
2010-10-25 10:35:34 ----D---- C:\WINDOWS\system32\mui
2010-10-25 10:35:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-10-23 15:22:25 ----SHD---- C:\System Volume Information
2010-10-21 18:14:00 ----D---- C:\SLOVNIK
2010-10-20 02:38:41 ----D---- C:\Program Files\Google
2010-10-20 02:37:39 ----SD---- C:\WINDOWS\Tasks
2010-10-20 02:25:00 ----D---- C:\Program Files\Yahoo!
2010-10-19 21:48:42 ----HDC---- C:\WINDOWS\$NtUninstallKB974455_0$
2010-10-18 20:28:39 ----A---- C:\WINDOWS\system.ini
2010-10-18 20:28:19 ----D---- C:\WINDOWS\system32\drivers\etc
2010-10-18 20:26:52 ----D---- C:\WINDOWS\system32\config
2010-10-18 20:26:42 ----D---- C:\WINDOWS\ERDNT
2010-10-18 20:25:00 ----D---- C:\WINDOWS\AppPatch
2010-10-18 20:07:32 ----D---- C:\Program Files\Vuze_Remote
2010-10-17 14:23:29 ----A---- C:\WINDOWS\win.ini
2010-10-17 10:51:38 ----ASH---- C:\boot.ini
2010-10-17 10:31:56 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-10-17 10:30:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-10-17 10:30:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-10-17 02:15:46 ----D---- C:\WINDOWS\WinSxS
2010-10-16 23:55:31 ----D---- C:\WINDOWS\repair
2010-10-16 21:51:42 ----D---- C:\Program Files\Java
2010-10-16 17:52:03 ----D---- C:\Program Files\Vuze
2010-10-14 00:09:52 ----D---- C:\WINDOWS\Debug
2010-10-14 00:07:15 ----HD---- C:\WINDOWS\$hf_mig$
2010-10-14 00:06:24 ----D---- C:\Program Files\Internet Explorer
2010-10-14 00:03:44 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 d347bus;d347bus; C:\WINDOWS\system32\DRIVERS\d347bus.sys [2004-08-22 155136]
R0 d347prt;d347prt; C:\WINDOWS\System32\Drivers\d347prt.sys [2004-08-22 5248]
R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2010-09-10 91560]
R0 iteatapi;ITEATAPI_Service_Install; C:\WINDOWS\system32\DRIVERS\iteatapi.sys [2005-04-26 25424]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 speedfan;speedfan; C:\WINDOWS\system32\speedfan.sys [2006-09-24 5248]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-28 721904]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-09-10 239240]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2010-09-10 25240]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\WINDOWS\SYSTEM32\DRIVERS\WibuKey.sys [2006-11-22 72704]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-05-25 3134976]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-14 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-15 6301248]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2010-05-09 10368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-05-06 232064]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 Ad-Watch Real-Time Scanner;AW Real-Time Scanner; \??\C:\WINDOWS\system32\drivers\AWRTPD.sys []
S3 Ad-Watch Registry Filter;Ad-Watch Registry Kernel Filter; \??\C:\WINDOWS\system32\drivers\AWRTRD.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\PHILLI~1\LOCALS~1\Temp\catchme.sys []
S3 genmcmnUSB;USB Scroll Mouse Driver; C:\WINDOWS\system32\DRIVERS\gflmouhid.sys [2005-07-12 7808]
S3 gHidUsbF;USB Device Enhanced Function Driver; C:\WINDOWS\System32\Drivers\gHidUsbF.Sys [2005-07-11 12800]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-07-07 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-07-07 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-07-07 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-07-07 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-07-07 79488]
S3 mbr;mbr; \??\C:\DOCUME~1\PHILLI~1\LOCALS~1\Temp\mbr.sys []
S3 s117bus;Sony Ericsson Device 117 driver (WDM); C:\WINDOWS\system32\DRIVERS\s117bus.sys [2007-06-25 82984]
S3 s117mdfl;Sony Ericsson Device 117 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s117mdfl.sys [2007-06-25 14888]
S3 s117mdm;Sony Ericsson Device 117 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s117mdm.sys [2007-06-25 108456]
S3 s117mgmt;Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s117mgmt.sys [2007-06-25 100264]
S3 s117nd5;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS); C:\WINDOWS\system32\DRIVERS\s117nd5.sys [2007-06-25 22952]
S3 s117obex;Sony Ericsson Device 117 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s117obex.sys [2007-06-25 98344]
S3 s117unic;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM); C:\WINDOWS\system32\DRIVERS\s117unic.sys [2007-06-25 98856]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2007-01-31 96370]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-09-10 1901056]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-15 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-15 163908]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-05-11 1050120]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service; C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2009-06-26 102400]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-20 136176]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2010-06-15 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-03 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Roli]

Zdravím, tohle fixni v HJT :

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Philliboy\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Philliboy\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

HJT najdeš zde :

C:\Program Files\trend micro\Philliboy.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Šmejdy v System Volume Information odstraníš podle TOHOTO návodu.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Pak použij Mbam z mého podpisu a dej mi sem z něj log dříve než něco smažeš.

[Philloy]

HJTem fixnuto a CCleanerem proskenováno

log z MBAM:

Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verze databáze: 4883

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.11.2010 18:26:13
mbam-log-2010-11-10 (18-26-13).txt

Typ skenu: Rychlý sken
Skenované objekty: 138509
Uplynulý čas: 8 minuta(y), 28 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)


...vypada to ciste, mam jeste neco podniknout?

[Roli]

Jasně, použijeme větší kalibr tak že pozorně číst protože tenhle softík netoleruje chyby.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


P.S. nech prosím log v černé barvě, dík

[Philloy]

tak jsem stahl ComboFix, povypinal vse co se dalo a pri jeho spusteni na me vyskocila chybova hlaska: "system windows nema pristup k urcenemu zarizeni, ceste nebo souboru. k pristupu k polozce pravdepodobne nemate patricna opravneni" (pritom jako administrator jsem prihlasenej - jinej typ uctu nemam). Ani restart PC nepomohl. Jinak me zase antivirus nasel nakyho smejda v "system volume information". jak dal?

...tak nakonec jsem zjistil, ze (z me zahadnych duvodu) to blokoval Comodo Firewall i kdyz byl v tu dobu neaktivni. Kdyz sem ho zapl a pak zkusil spustit ComboFix tak se me zeptal jak postupovat s timto *.exe souborem - pridal jsem vyjimku a pak mi ComboFix scan normalne uz sel. Jo jinak mi Comodo ted hlasilo ze naslo podezrely soubor umisteni v C:\program files\combofix\mbr.cfxxe a to nejakej @suspicious. nebo nak tak, je oznacenej firewallem jako nebezpecny, dalsi kroky jsem zatim nepodnikal.

p.s: proc se mi u teto odpovedi nezalamuji radky a pismo utika nekam do pryc do strany? jak se toho zbavit?

Tady je log:

ComboFix 10-11-10.01 - Philliboy 11.11.2010 9:21.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3071.2467 [GMT 1:00]
Spuštěný z: c:\documents and settings\Philliboy\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\daemon.dll
c:\windows\system32\ammppg.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-10-11 do 2010-11-11 )))))))))))))))))))))))))))))))
.

2010-11-04 22:40 . 2010-11-04 22:40 388096 ----a-r- c:\documents and settings\Philliboy\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-11-04 21:34 . 2010-11-04 21:34 -------- d-----w- c:\program files\Audacity
2010-11-04 20:22 . 2010-11-04 20:24 -------- d-----w- C:\rsit
2010-10-30 19:39 . 2010-10-30 19:39 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Avira
2010-10-30 18:35 . 2010-10-30 18:35 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2010-10-28 17:28 . 2010-10-28 17:28 -------- d-----w- c:\program files\Common Files\Control Panels
2010-10-28 16:45 . 2004-08-22 14:31 5248 ----a-w- c:\windows\system32\drivers\d347prt.sys
2010-10-28 16:45 . 2004-08-22 14:31 155136 ----a-w- c:\windows\system32\drivers\d347bus.sys
2010-10-28 16:45 . 2010-10-28 16:45 -------- d-----w- c:\program files\Daemon Tools
2010-10-25 09:39 . 2009-03-09 13:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
2010-10-25 09:39 . 2009-03-09 13:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
2010-10-25 09:39 . 2009-03-09 13:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
2010-10-25 09:33 . 2010-10-25 09:33 -------- d-----w- C:\Autodesk
2010-10-20 15:59 . 2010-10-20 15:59 -------- d-----w- C:\VritualRoot
2010-10-20 01:42 . 2010-10-20 01:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2010-10-20 01:37 . 2010-10-20 01:37 -------- d-----w- c:\documents and settings\Philliboy\Data aplikací\Avira
2010-10-20 01:33 . 2010-11-04 20:50 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-20 01:33 . 2010-11-04 20:50 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-10-20 01:33 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-10-20 01:33 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-10-20 01:33 . 2010-10-20 01:33 -------- d-----w- c:\program files\Avira
2010-10-19 19:15 . 2010-10-19 19:15 -------- d-----w- c:\documents and settings\Philliboy\Data aplikací\Malwarebytes
2010-10-19 19:15 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-19 19:15 . 2010-10-19 19:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-10-19 19:15 . 2010-10-19 19:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-19 19:15 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-17 16:54 . 2010-10-17 17:11 -------- d-----w- c:\program files\COMODO
2010-10-17 01:37 . 2010-10-17 01:37 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2010-10-16 23:52 . 2010-10-16 23:52 -------- d-----w- c:\documents and settings\Philliboy\Data aplikací\SUPERAntiSpyware.com
2010-10-16 23:52 . 2010-10-16 23:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2010-10-16 23:52 . 2010-10-28 16:34 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-10-16 23:05 . 2010-10-16 23:05 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-10-16 23:00 . 2010-10-17 17:11 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Comodo
2010-10-16 22:58 . 2010-10-17 09:09 -------- d-----w- c:\windows\system32\Default
2010-10-16 22:53 . 2010-10-20 01:33 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Avira
2010-10-16 20:55 . 2010-10-16 20:55 -------- d-----w- c:\program files\Common Files\Java
2010-10-16 01:55 . 2010-10-30 01:40 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2010-10-16 01:55 . 2010-10-30 01:40 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2010-10-13 13:09 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-13 13:09 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-13 13:09 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-28 16:17 . 2010-03-27 19:56 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 10:23 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ------w- c:\windows\system32\mfc40u.dll
2010-09-15 02:50 . 2010-06-15 08:01 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 00:29 . 2009-11-10 01:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-10 21:41 . 2010-09-10 21:41 285480 ----a-w- c:\windows\system32\guard32.dll
2010-09-10 21:40 . 2010-09-10 21:40 91560 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-09-10 21:40 . 2010-09-10 21:40 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-09-10 21:40 . 2010-09-10 21:40 239240 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-09-10 21:40 . 2010-09-10 21:40 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-09-10 05:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2004-08-18 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2004-08-18 12:00 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2004-08-18 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-18 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-18 12:00 617472 ------w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-18 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-18 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2010-10-18 19:07 2735200 ----a-w- c:\program files\Vuze_Remote\tbVuz1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuz1.dll" [2010-10-18 2735200]

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\tbVuz1.dll" [2010-10-18 2735200]

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PrtScr by FireStarter"="c:\program files\PrtScr\PrtScr.exe" [2008-03-19 1375744]
"Centrum.cz Notifikátor"="c:\program files\NetCentrum\Notifikator\Notifikator.exe" [2010-05-18 606720]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-10-28 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-05-25 14477312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"nwiz"="nwiz.exe" [2009-01-15 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"mouseElf"="c:\progra~1\GAMING~1\MouseElf.EXE" [2005-07-15 208896]
"HD Tune"="c:\progra~1\HDTUNE~1\HDTune.exe" [2005-09-12 405504]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-09-10 2500552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Philliboy\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ATnotes.lnk - c:\program files\ATnotes\ATnotes.exe [2003-11-10 1069056]

c:\documents and settings\Philliboy\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ATnotes.lnk - c:\program files\ATnotes\ATnotes.exe [2003-11-10 1069056]

c:\documents and settings\Philliboy\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ATnotes.lnk - c:\program files\ATnotes\ATnotes.exe [2003-11-10 1069056]

c:\documents and settings\Philliboy\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ATnotes.lnk - c:\program files\ATnotes\ATnotes.exe [2003-11-10 1069056]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Philliboy^Nabídka Start^Programy^Po spuštění^TimeLeft.lnk]
path=c:\documents and settings\Philliboy\Nabídka Start\Programy\Po spuštění\TimeLeft.lnk
backup=c:\windows\pss\TimeLeft.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 10:12 483328 ----a-w- c:\program files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-07-27 02:10 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Centrum.cz Notifikátor]
2010-05-18 11:49 606720 ----a-w- c:\program files\NetCentrum\Notifikator\Notifikator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-02 01:10 133104 ----atw- c:\documents and settings\Philliboy\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 14:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2007-05-11 01:08 2512392 ----a-w- c:\windows\system32\oodtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\supertintin_skype]
2009-12-06 20:46 1043456 ----a-w- c:\program files\Supertintin for Skype\supertintin_skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-01-27 14:59 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager]
2009-06-26 14:56 450560 ----a-w- c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [28.10.2010 17:45 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [28.10.2010 17:45 5248]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27.3.2010 20:56 721904]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [10.9.2010 22:40 239240]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [10.9.2010 22:40 25240]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10.5.2010 19:41 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [20.10.2010 2:33 135336]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [26.6.2009 15:56 102400]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20.10.2010 2:37 136176]
S3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [18.4.2010 9:56 7808]
S3 gHidUsbF;USB Device Enhanced Function Driver;c:\windows\system32\drivers\gHidUsbF.sys [18.4.2010 9:56 12800]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-20 01:37]

2010-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-20 01:37]

2010-11-11 c:\windows\Tasks\PandaUSBVaccine.job
- c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2010-03-08 15:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Převést cíl vazby do Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést cíl vazby do existujícího PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést do Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést do existujícího PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Převést vybrané vazby do Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Převést vybrané vazby do existujícího PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Převést výběr do Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Převést výběr do existujícího PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: {B0E2D7F1-2A65-48EF-A2DA-384C6CDA22FD} = 147.32.110.2,147.32.1.20
FF - ProfilePath - c:\documents and settings\Philliboy\Data aplikací\Mozilla\Firefox\Profiles\qm1l15m6.profil\
FF - prefs.js: browser.startup.homepage - http://www.centrum.cz
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\DivXplayer\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\program files\DivXplayer\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="AFF91DBDD2393E54F331286DA8031DA89FAEB0C66DC396C96D49B05E597FA1BA88C760E16347A00F829E82A9993CDA0208B50BD1431FC1996F49896FD6F48B5D974D6C4B3DBA1C2312EC1230E7A3BC5BA193284936F0A10104065A942350C8090F8F58DBD4CF9D6FA23BA0FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA9C6AECB7A5D1407C038D530D6EB3452D2B699138BC585C758410BD59E2C5D4C0855DA5C4D56B8B45777553F6E6D19F4F01459E33A7BB008B706CFA6D85999C1D469ACD472E79CF0D04200F0D720134CC9EC1A4FB66C49372BE4407D665881CF025CE77B388AF6CFD41A923F5E91FD3A19B228936702A9E3AD8E6F3F3FE189B9E9B78CF8C6E3F468BD0615B77E76E1CB5B0CB2C2B69DD12C7D64D6A05D234BD12FBC7A4B4B0F67652DC2713CB2F4E89E54D1CD42941364C51F7DD22D40BD8383B45FF6407599C50589C17480FE28626688126FCC712B2CF6D7A223C36EC5134BA3C4AC7BFA05A9197A27538DE720C06AC38D736FC4A0131F35D4ED166C4600BA66CA28F414475087EECAA240765E9B8692B9998B0AA32AAB0446B82D47B97077AE7FDA797DCB1CCB16B95DC939DBAEA8494086D7BF582422D85BF2E18E9233396F281A27F66F93F366B4E12EC201D6557B7FBE5DE7575A1B8BB06AE3D6B43A4EE13A9FF3C685DEA098307246A6AE18A38408B07A892C47C23515553636FA971881628825B5D1CC8AAAD43540003898BE839F295F30D70B5936884AAE48B0860C0F0056588E104F7A5BFEB49AEBE225E5D840DD94674C69B1324448782E9762B30FA66EFC236EFCCE33BEDFAB0C6BA9ECAB16E471C5734CB68E322E128A642EAAC79D1AD6C70D8EF9F8D8889A06803C39E685B925DFA9BCE2F86F3FCE05C00DA3C760087D55846382BA46E5E604C391C737A0BA31D03CEC465ECF26D5C9CA48E3DC9F475C28DDFA82C833115FB3CD85288E33AD6BB6F130857259EDA10810CB441D3D4E33A195FDA8B8008A29C529177C243AB8FCB4827C5A2D47878073982AB2DED2F796A62035B5E4C1B13D705568FC7267E6E3F018708E49874715C35C183040A87FED1EE20D81E8C0CF68EDC440F3B62028F117D4CA04C53C655635496DD0A0C0877475361AF526F88CCB7B5E8AC0737D51CDD44BEF2FE4BBFE8F073E283FA34E95BB9EE99091421C79DAD9FCD5D76E4C96705D846597309213DFFB9369B831B892250CBECA66A58D075FCFF0D4BFB29015A767FB5A59EFFC86385D8E740E779BCAE939EC46997F668B7626FB5E930EFD4C942DA19E2636EE22E175EE33A3E3C57195201BA567BD724210ABD4ED8212FDA02FEC5923C0548E93F494E433752D3C9B08426B2E9D1833C7F1B1A8A151152FD6BE6B"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(784)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL

- - - - - - - > 'lsass.exe'(840)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
Celkový čas: 2010-11-11 09:29:47
ComboFix-quarantined-files.txt 2010-11-11 08:29

Před spuštěním: 6 631 665 664
Po spuštění: 7 143 202 816

Current=4 Default=4 Failed=3 LastKnownGood=2 Sets=1,2,3,4
- - End Of File - - A1B41AD61822D61FE40A81AC5B1E6FE9

[Roli]

To co ti hlásí COMODO Firewall patří ComboFixu.

Proč ti fórum nezalamuje řádky netuším.

Šmejdy v System Volume Information víš jak odstranit ale vždy to nemusí být šmejd.

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

[Philloy]

ok, tak jsem vše vyčistil podle instrukci a teď už to vypadá čistý... díky za pomoc!

[Roli]

Není zač.