VIRY.CZ

Zdravím.
Prosím mrkněte na tenhle log. Po načtení systému se po jakékoliv aktivitě sekne systém nebo hodí mordé okno. Obnova systému k ničemu. Po ručním vypnutí se PC po chvíli samo spustí. Problém se vysktl ze dne na den. Předtím naprosto bez problémů. Log je z nouzového režimu.

Díky moc.

Logfile of random's system information tool 1.08 (written by random/random)
Run by madcat at 2010-11-12 18:47:13
Systém Microsoft Windows XP Professional Service Pack 2
System drive F: has 13 GB (6%) free of 238 GB
Total RAM: 2047 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:48:19, on 12.11.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\LogMeIn Hamachi\hamachi-2.exe
F:\WINDOWS\Explorer.EXE
F:\DOCUME~1\madcat\LOCALS~1\Temp\961.exe
F:\DOCUME~1\madcat\LOCALS~1\Temp\88606.exe
F:\WINDOWS\system32\ctfmon.exe
F:\prográmky\Mozilla Firefox2\Firefox\firefox.exe
F:\prográmky\Mozilla Firefox2\Firefox\plugin-container.exe
F:\Downloads\RSIT(2).exe
F:\Program Files\trend micro\madcat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
F2 - REG:system.ini: UserInit=F:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\prográmky\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\PROGRM~2\FlashGet\fgiebar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - F:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing)
O3 - Toolbar: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
O4 - HKLM\..\Run: [RaidTool] F:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [WheelMouse] F:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [reset] regedit /s reset.reg
O4 - HKLM\..\Run: [egui] "F:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NVIDIA driver monitor] F:\WINDOWS\nvsvc32.exe
O4 - HKLM\..\Run: [kozevam] F:\WINDOWS\system32\licywe.exe
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA driver monitor] F:\WINDOWS\nvsvc32.exe
O4 - HKCU\..\Run: [MSConfig] F:\Documents and Settings\madcat\xgv.exe \u
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://F:\prográmky\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Download Using &BitSpirit - F:\prográmky\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - F:\Documents and Settings\madcat\Data aplikací\DVDVideoSoftIEHelpers\youtubedownload.htm
O8 - Extra context menu item: Free YouTube to Mp3 Converter - F:\Documents and Settings\madcat\Data aplikací\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Save YouTube Video - res://F:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP4.htm
O8 - Extra context menu item: Save YouTube Video as MP3 - res://F:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
O8 - Extra context menu item: Stáhnout položku pomocí FlashGet - F:\prográmky\FlashGet\jc_link.htm
O8 - Extra context menu item: Stáhnout pomocí FlashGet - F:\prográmky\FlashGet\jc_link.htm
O8 - Extra context menu item: Stáhnout vše pomocí FlashGet - F:\prográmky\FlashGet\jc_all.htm
O8 - Extra context menu item: Stáhnout všechny položky pomocí FlashGet - F:\prográmky\FlashGet\jc_all.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRM~2\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRM~2\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://F:\prográmky\AutoCAD 2002 Cz\InstFred.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Ovládací prvek AcDcToday) - file://F:\prográmky\AutoCAD 2002 Cz\AcDcToday.ocx
O16 - DPF: {AE563723-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://F:\prográmky\AutoCAD 2002 Cz\InstBanr.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Prvek AcPreview) - file://F:\prográmky\AutoCAD 2002 Cz\AcPreview.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk Inc - F:\prográmky\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk Licensing Service - Autodesk - F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - F:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - F:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Software Updater (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - F:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Ati External Event Utility (hoouaoavroip1) - Unknown owner - F:\WINDOWS\system32\baquou.exe
O23 - Service: ICQ Service - Unknown owner - F:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - F:\prográmky\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - F:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8898 bytes

======Scheduled tasks folder======

F:\WINDOWS\tasks\AppleSoftwareUpdate.job
F:\WINDOWS\tasks\Google Software Updater.job
F:\WINDOWS\tasks\Norton Security Scan for madcat.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - F:\prográmky\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - F:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-02 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} - FlashGet Bar - F:\PROGRM~2\FlashGet\fgiebar.dll [2005-06-07 86016]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - F:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]
{F4D76F09-7896-458a-890F-E1F05C46069F} - Ask Toolbar - F:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL []
{872b5b88-9db5-4310-bdd0-ac189557e5f5}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"=F:\Program Files\VIA\RAID\raid_tool.exe [2006-01-04 1060864]
"WheelMouse"=F:\Program Files\A4Tech\Mouse\Amoumain.exe [2006-02-17 163840]
"NvCplDaemon"=F:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"NvMediaCenter"=F:\WINDOWS\system32\NvMcTray.dll [2010-04-03 110696]
"reset"=regedit /s reset.reg []
"egui"=F:\Program Files\ESET\ESET Smart Security\egui.exe [2009-02-06 2021400]
"NVIDIA driver monitor"=F:\WINDOWS\nvsvc32.exe [2010-10-30 90112]
"kozevam"=F:\WINDOWS\system32\licywe.exe [2010-11-12 201216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=F:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"NVIDIA driver monitor"=F:\WINDOWS\nvsvc32.exe [2010-10-30 90112]
"MSConfig"=F:\Documents and Settings\madcat\xgv.exe [2010-11-12 19456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
F:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2006-09-28 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
F:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
F:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
F:\Program Files\DAEMON Tools Pro\DTProAgent.exe [2007-09-06 136136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
F:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-16 1164584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
F:\Documents and Settings\madcat\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2008-09-06 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
F:\Program Files\ICQ6.5\ICQ.exe [2009-11-16 172792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
F:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2006-09-10 218032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [2006-09-10 218032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2006-09-10 86960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
F:\prográmky\iTunes\iTunesHelper.exe [2009-07-13 292128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
F:\WINDOWS\KHALMNPR.EXE [2007-09-21 55824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
F:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
F:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
F:\prográmky\NVIDIA Corporation\nTune\nTuneCmd.exe [2007-07-03 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
NvMCTray.dll,NvTaskbarInit []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
Rundll32 P17.dll,P17Helper []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PoivY]
F:\Program Files\PoivY.com\PoivY\PoivY.exe [2009-11-21 9189152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
F:\prográmky\PowerISO\PWRISOVM.EXE [2010-04-12 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
F:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ServiceHost]
F:\Program Files\Java\jre1.5.0_06\bin\svchost.exe [2006-08-09 147968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
F:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
F:\Program Files\Java\jre6\bin\jusched.exe [2009-03-24 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WDICT32]
F:\prográmky\TRANSLATOR 07\WDICT32.EXE [2006-11-26 2355200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
F:\PROGRM~2\ACROBA~1.0\Reader\READER~1.EXE [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
F:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [2006-03-05 11000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Enable Magic Keyboard program.lnk]
F:\PROGRM~2\MAGICK~1\Versato.exe [2004-10-07 245760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
F:\PROGRA~1\MICROS~2\Office\OSA9.EXE -b -l []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
F:\PROGRA~1\MICROS~2\Office\1029\OLFSNT40.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
F:\PROGRA~1\MI6841~1\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^madcat^Nabídka Start^Programy^Po spuštění^Registration .LNK]
F:\Hry\DARKME~2\DARKME~1\REGIST~1.EXE -d 802848 -l english -r 7 -g -c us -i 2897 -p F:\Hry\Dark Messiah\Dark Messiah of Might and Magic\bin.bin []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^madcat^Nabídka Start^Programy^Po spuštění^Warkeys Update.lnk]
F:\PROGRM~2\Warkeys\update\WARKEY~1.EXE [2006-08-03 225411]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ADSLAutoconnect"=2
"lanmanworkstation"=2
"MSSQLServerADHelper"=3
"SQLAgent$AUTODESKVAULT"=3
"MSSQL$AUTODESKVAULT"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
WRLogonNTF.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\britfdsw.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\britfdsw.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\prográmky\The All-Seeing Eye\eye.exe"="F:\prográmky\The All-Seeing Eye\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\Downloads\BitComet\BitComet.exe"="C:\Downloads\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"F:\Downloads\utorrent.exe"="F:\Downloads\utorrent.exe:*:Enabled:µTorrent"
"F:\prográmky\uTorrent\utorrent.exe"="F:\prográmky\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"F:\prográmky\iTunes\iTunes.exe"="F:\prográmky\iTunes\iTunes.exe:*:Enabled:iTunes"
"F:\prográmky\BitSpirit\BitSpirit.exe"="F:\prográmky\BitSpirit\BitSpirit.exe:*:Enabled:The powerful and easy-to-use BitTorrent Client"
"F:\Program Files\Bonjour\mDNSResponder.exe"="F:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"F:\Programy\uTorrent\uTorrent.exe"="F:\Programy\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"F:\Downloads\P17535732.JPG-www.facebook.exe"="F:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-11-12 18:09:21 ----A---- F:\WINDOWS\system32\wouko.exe
2010-11-12 18:08:04 ----D---- F:\WINDOWS\CSC
2010-11-12 17:50:45 ----A---- F:\WINDOWS\IE4 Error Log.txt
2010-11-12 17:44:52 ----A---- F:\WINDOWS\ntbtlog.txt
2010-11-12 16:31:10 ----A---- F:\WINDOWS\system32\drivers\britfdsw.sys
2010-11-12 16:07:36 ----A---- F:\WINDOWS\system32\baquou.exe
2010-11-12 16:06:36 ----A---- F:\WINDOWS\system32\licywe.exe
2010-11-12 15:12:23 ----RSH---- F:\Documents and Settings\madcat\Data aplikací\juzjf.exe
2010-10-30 20:00:05 ----D---- F:\Documents and Settings\madcat\Data aplikací\Pointstone
2010-10-30 19:43:03 ----D---- F:\Program Files\Common Files\Pointstone
2010-10-30 19:28:57 ----RSH---- F:\WINDOWS\nvsvc32.exe

======List of files/folders modified in the last 1 months======

2010-11-12 18:47:24 ----D---- F:\Program Files\trend micro
2010-11-12 18:46:41 ----D---- F:\Downloads
2010-11-12 18:09:47 ----D---- F:\WINDOWS\system32
2010-11-12 18:08:26 ----D---- F:\WINDOWS\system32\CatRoot2
2010-11-12 18:08:04 ----D---- F:\WINDOWS
2010-11-12 18:05:48 ----AD---- F:\WINDOWS\temp
2010-11-12 18:05:47 ----D---- F:\WINDOWS\system32\inetsrv
2010-11-12 18:05:43 ----SD---- F:\WINDOWS\Tasks
2010-11-12 18:00:00 ----D---- F:\WINDOWS\Registration
2010-11-12 16:42:22 ----A---- F:\WINDOWS\SchedLgU.Txt
2010-11-12 16:30:47 ----D---- F:\WINDOWS\Prefetch
2010-11-11 18:02:48 ----A---- F:\WINDOWS\WDICT32.INI
2010-11-09 21:42:46 ----D---- F:\borderlands
2010-11-09 21:08:03 ----D---- F:\Documents and Settings\madcat\Data aplikací\uTorrent
2010-11-08 17:28:05 ----D---- F:\Program Files\Common Files\Symantec Shared
2010-11-08 13:48:33 ----A---- F:\WINDOWS\win.ini
2010-11-08 13:48:33 ----A---- F:\WINDOWS\system.ini
2010-11-06 18:41:28 ----D---- F:\Program Files\Garena
2010-11-03 20:22:18 ----D---- F:\MP3-converted
2010-10-31 20:59:18 ----A---- F:\WINDOWS\system32\PerfStringBackup.INI
2010-10-30 20:11:30 ----RD---- F:\Program Files
2010-10-30 20:00:19 ----D---- F:\WINDOWS\system32\NtmsData
2010-10-30 20:00:19 ----D---- F:\WINDOWS\system32\config
2010-10-30 20:00:15 ----SHD---- F:\WINDOWS\Installer
2010-10-30 20:00:15 ----D---- F:\WINDOWS\Minidump
2010-10-30 20:00:15 ----D---- F:\WINDOWS\Logs
2010-10-30 20:00:15 ----D---- F:\WINDOWS\Internet Logs
2010-10-30 20:00:12 ----D---- F:\rsit
2010-10-30 20:00:11 ----D---- F:\prográmky
2010-10-30 20:00:10 ----D---- F:\Program Files\DAEMON Tools Pro
2010-10-30 20:00:09 ----D---- F:\hry
2010-10-30 19:43:03 ----D---- F:\Program Files\Common Files
2010-10-20 14:25:48 ----D---- F:\mačky

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 britfdsw;britfdsw; F:\WINDOWS\System32\Drivers\britfdsw.sys [2010-11-12 40128]
R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; F:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2004-08-04 46464]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; F:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 PxHelp20;PxHelp20; F:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); F:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); F:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x); F:\WINDOWS\System32\drivers\sfsync03.sys [2005-12-06 35328]
R0 viamraid;viamraid; F:\WINDOWS\system32\drivers\viamraid.sys [2006-01-19 92672]
R0 videX32;videX32; F:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 9728]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; F:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-15 76544]
R1 epfwtdi;epfwtdi; F:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-02-06 56280]
R3 Amusbprt;A4Tech HID-compliant Mouse Driver; F:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2006-05-09 13312]
R3 ElbyCDFL;ElbyCDFL; F:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 Epfwndis;Eset Personal Firewall; F:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; F:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 hamachi;Hamachi Network Interface; F:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 hidusb;Ovladač třídy standardu HID; F:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 lgbusenum;LG Bluetooth Bus Enumerator; F:\WINDOWS\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; F:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-07-16 70400]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; F:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S0 kl1;kl1; F:\WINDOWS\System32\Drivers\kl1.sys []
S0 sptd;sptd; F:\WINDOWS\System32\Drivers\sptd.sys [2010-08-27 691696]
S1 AmdK8;Ovladač procesoru AMD; F:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
S1 Amfilter;A4Tech Mouse Filter Driver; F:\WINDOWS\system32\DRIVERS\Amfilter.sys [2006-01-11 8704]
S1 ehdrv;ehdrv; F:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S1 ElbyCDIO;ElbyCDIO Driver; F:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
S1 kbdhid;Ovladač klávesnice standardu HID; F:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S1 kbfilter;Keyboard Filter Driver; F:\WINDOWS\system32\drivers\kbfilter.sys [2004-05-24 12032]
S1 SCDEmu;SCDEmu; F:\WINDOWS\system32\drivers\SCDEmu.sys [2010-04-12 59388]
S2 atksgt;atksgt; F:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-10-26 278984]
S2 eamon;eamon; F:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
S2 epfw;epfw; F:\WINDOWS\system32\DRIVERS\epfw.sys [2009-02-06 130952]
S2 lirsgt;lirsgt; F:\WINDOWS\system32\DRIVERS\lirsgt.sys [2006-10-18 18048]
S2 PfModNT;PfModNT; \??\F:\WINDOWS\system32\drivers\PfModNT.sys []
S3 Arp1394;Protokol 1394 ARP Client; F:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
S3 catchme;catchme; \??\F:\DOCUME~1\madcat\LOCALS~1\Temp\catchme.sys []
S3 C-Dilla;C-Dilla; \??\F:\WINDOWS\system32\drivers\CDANT.SYS []
S3 ctsfm2k;Creative SoundFont Management Device Driver; F:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-12-08 142336]
S3 dtscsi;dtscsi; F:\WINDOWS\System32\Drivers\dtscsi.sys []
S3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); F:\WINDOWS\system32\drivers\es1371mp.sys [2001-08-17 40704]
S3 ezplay;VSO Software ezplay; F:\WINDOWS\System32\Drivers\ezplay.sys [2006-08-01 94080]
S3 GarenaPEngine;GarenaPEngine; \??\F:\DOCUME~1\madcat\LOCALS~1\Temp\NRU156.tmp []
S3 GGSAFERDriver;GGSAFER Driver; \??\F:\Program Files\Garena\plugins\UI\safedrv.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hamachi_oem;PlayLinc Adapter; F:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 10664]
S3 HwIOctl;HwIOctl; \??\F:\Program Files\Setup Files\MS-6702 v2.20\HwIOctl.sys []
S3 k750bus;Sony Ericsson 750 driver (WDM); F:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; F:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; F:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; F:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; F:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-02-11 79488]
S3 LgBttPort;LGE Bluetooth TransPort; F:\WINDOWS\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
S3 LGVMODEM;LGE Virtual Modem; F:\WINDOWS\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; F:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-09-21 35088]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; F:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-09-21 36240]
S3 Memctl;Memctl; \??\F:\Program Files\Setup Files\MS-6702 v2.20\Memctl.sys []
S3 mouhid;Ovladač myši standardu HID; F:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 NIC1394;1394 Net Driver; F:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
S3 nm;Ovladač programu Sledování sítě; F:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 nmwcd;Nokia USB Phone Parent; F:\WINDOWS\system32\drivers\ccdcmb.sys [2007-11-29 16896]
S3 nmwcdc;Nokia USB Generic; F:\WINDOWS\system32\drivers\ccdcmbo.sys [2007-11-29 19328]
S3 NPF;NetGroup Packet Filter Driver; F:\WINDOWS\system32\drivers\npf.sys [2007-01-25 42000]
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 nv;nv; F:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
S3 NVR0Dev;NVR0Dev; \??\F:\WINDOWS\nvoclock.sys []
S3 ossrv;Creative OS Services Driver; F:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-12-08 114688]
S3 P17;Sound Blaster Audigy; F:\WINDOWS\system32\drivers\P17.sys [2006-03-17 1163264]
S3 p17filt;p17filt; F:\WINDOWS\system32\drivers\p17filt.sys [2006-03-20 1452032]
S3 pcouffin;VSO Software pcouffin; F:\WINDOWS\System32\Drivers\pcouffin.sys [2006-08-01 47360]
S3 Razerlow;Razerlow USB Filter Driver; F:\WINDOWS\System32\Drivers\Razerlow.sys [2005-04-24 13225]
S3 sbpci;SB PCI Family Audio Driver (WDM); F:\WINDOWS\system32\drivers\sbpci.sys [2002-10-22 668160]
S3 UnlockerDriver4;UnlockerDriver4 Driver; \??\F:\Program Files\Unlocker\UnlockerDriver4.sys []
S3 usbbus;LGE Mobile Composite USB Device; F:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2010-01-21 13056]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; F:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 UsbDiag;LGE Mobile USB Serial Port; F:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2010-01-21 20864]
S3 UsbFltr;WayTech USB Filter Driver; F:\WINDOWS\System32\Drivers\UsbFltr.sys [2004-05-21 8704]
S3 USBModem;LGE Mobile USB Modem; F:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2010-01-21 24960]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 vaxscsi;vaxscsi; F:\WINDOWS\System32\Drivers\vaxscsi.sys [2006-11-05 223128]
S3 Wdf01000;Wdf01000; F:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; F:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; F:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; F:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; F:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 Apple Mobile Device;Apple Mobile Device; F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712]
S2 Autodesk Data Management Job Dispatch;Autodesk Data Management Job Dispatch; F:\prográmky\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe [2006-03-09 40960]
S2 Bonjour Service;Bonjour Service; F:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S2 C-DillaSrv;C-DillaSrv; F:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE [2006-06-04 32256]
S2 ekrn;ESET Service; F:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-02-06 727720]
S2 gusvc;Google Software Updater; F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-02 190448]
S2 hoouaoavroip1;Ati External Event Utility; F:\WINDOWS\system32\baquou.exe [2010-11-12 201216]
S2 ICQ Service;ICQ Service; F:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-10-19 222456]
S2 IISADMIN;Správa služby IIS; F:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-17 15872]
S2 JavaQuickStarterService;Java Quick Starter; F:\Program Files\Java\jre6\bin\jqs.exe [2009-03-24 152984]
S2 MDM;Machine Debug Manager; F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S2 MSFtpsvc;Publikování FTP; F:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-17 15872]
S2 nTuneService;nTune Service; F:\prográmky\NVIDIA Corporation\nTune\nTuneService.exe [2007-07-03 131072]
S2 NVSvc;NVIDIA Display Driver Service; F:\WINDOWS\system32\nvsvc32.exe [2010-04-03 154216]
S2 PnkBstrA;PnkBstrA; F:\WINDOWS\system32\PnkBstrA.exe [2010-02-12 75064]
S2 W3SVC;Publikování na webu; F:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-17 15872]
S2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; F:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S3 aspnet_state;ASP.NET State Service; F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2006-11-28 72704]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; F:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-02-06 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; F:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; F:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; F:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
S3 ose;Office Source Engine; F:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); F:\Program Files\WinPcap\rpcapd.exe [2007-01-25 93048]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; F:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT; F:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe [2005-05-04 9150464]
S4 MSSQLServerADHelper;MSSQLServerADHelper; F:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2005-05-03 73728]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; F:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT; F:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE [2005-05-03 323584]

-----------------EOF-----------------

Slušně zapleveleno a možná je i poškozen systém. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

ComboFix 10-11-12.01 - madcat 12.11.2010 19:40:09.6.1 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1556 [GMT 1:00]
Spuštěný z: f:\documents and settings\madcat\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

f:\documents and settings\madcat\secupdat.dat
f:\documents and settings\madcat\xgv.exe
f:\windows\nvsvc32.exe
f:\windows\system32\Drivers\britfdsw.sys
f:\windows\system32\secupdat.dat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_britfdsw
-------\Service_britfdsw


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-12 do 2010-11-12 )))))))))))))))))))))))))))))))
.

2010-11-12 17:09 . 2010-11-12 17:09 201216 ----a-w- f:\windows\system32\wouko.exe
2010-11-12 15:07 . 2010-11-12 17:09 201216 ----a-w- f:\windows\system32\baquou.exe
2010-11-12 15:06 . 2010-11-12 17:09 201216 ----a-w- f:\windows\system32\licywe.exe
2010-11-12 14:12 . 2010-11-12 14:12 91136 --sh--r- f:\documents and settings\madcat\Data aplikací\juzjf.exe
2010-10-30 19:00 . 2010-10-30 19:00 -------- d-----w- f:\documents and settings\madcat\Data aplikací\Pointstone
2010-10-30 18:43 . 2010-10-31 13:29 -------- d-----w- f:\program files\Common Files\Pointstone

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-05 16:20 . 2007-08-24 19:49 139904 ----a-w- f:\windows\system32\drivers\PnkBstrK.sys
2010-10-05 16:19 . 2009-03-13 21:54 189744 ----a-w- f:\windows\system32\PnkBstrB.xtr
2010-10-05 16:19 . 2007-08-24 19:49 189744 ----a-w- f:\windows\system32\PnkBstrB.exe
2010-08-27 13:11 . 2006-04-27 14:00 691696 ----a-w- f:\windows\system32\drivers\sptd.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"reset"="regedit" [X]
"RaidTool"="f:\program files\VIA\RAID\raid_tool.exe" [2006-01-04 1060864]
"WheelMouse"="f:\program files\A4Tech\Mouse\Amoumain.exe" [2006-02-17 163840]
"NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"egui"="f:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]
"kozevam"="f:\windows\system32\licywe.exe" [2010-11-12 201216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="f:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=f:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
backup=f:\windows\pss\Akcelerátor spuštění AutoCADu.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Enable Magic Keyboard program.lnk]
backup=f:\windows\pss\Enable Magic Keyboard program.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
backup=f:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
backup=f:\windows\pss\Port pro program Symantec Fax Starter Edition.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
backup=f:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\F:^Documents and Settings^madcat^Nabídka Start^Programy^Po spuštění^Registration .LNK]
backup=f:\windows\pss\Registration .LNKStartup

[HKLM\~\startupfolder\F:^Documents and Settings^madcat^Nabídka Start^Programy^Po spuštění^Warkeys Update.lnk]
backup=f:\windows\pss\Warkeys Update.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2006-09-28 19:21 57344 ----a-w- f:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-17 13:49 15360 ----a-w- f:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
2007-09-06 13:08 136136 ----a-w- f:\program files\DAEMON Tools Pro\DTProAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 ----a-w- f:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-06 17:15 133104 ----atw- f:\documents and settings\madcat\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-11-16 15:36 172792 ----a-w- f:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-10 20:56 218032 ----a-w- f:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2006-09-10 20:56 218032 ----a-w- f:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-09-10 20:56 86960 ----a-w- f:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-07-13 12:03 292128 ----a-w- f:\prográmky\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2007-09-21 02:10 55824 ----a-w- f:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- f:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50 155648 ----a-w- f:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2007-07-03 10:32 81920 ----a-w- f:\prográmky\NVIDIA Corporation\nTune\nTuneCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-04-03 17:23 110696 ----a-w- f:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
2006-03-17 15:11 81408 ----a-w- f:\windows\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PoivY]
2009-11-21 17:23 9189152 ----a-w- f:\program files\PoivY.com\PoivY\poivy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 ----a-w- f:\prográmky\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18 413696 ----a-w- f:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ServiceHost]
2006-08-09 14:01 147968 ----a-w- f:\program files\Java\jre1.5.0_06\bin\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- f:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-24 19:04 148888 ----a-w- f:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-02 12:59 39408 ----a-w- f:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WDICT32]
2006-11-26 12:03 2355200 ----a-w- f:\prográmky\TRANSLATOR 07\WDICT32.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ADSLAutoconnect"=2 (0x2)
"lanmanworkstation"=2 (0x2)
"MSSQLServerADHelper"=3 (0x3)
"SQLAgent$AUTODESKVAULT"=3 (0x3)
"MSSQL$AUTODESKVAULT"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"f:\\prográmky\\The All-Seeing Eye\\eye.exe"=
"c:\\Downloads\\BitComet\\BitComet.exe"=
"f:\\Downloads\\utorrent.exe"=
"f:\\prográmky\\uTorrent\\utorrent.exe"=
"f:\\prográmky\\iTunes\\iTunes.exe"=
"f:\\prográmky\\BitSpirit\\BitSpirit.exe"=
"f:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Programy\\uTorrent\\uTorrent.exe"=
"f:\\Downloads\\P17535732.JPG-www.facebook.exe"= f:\\WINDOWS\\nvsvc32.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7486:TCP"= 7486:TCP:BitComet 7486 TCP
"7486:UDP"= 7486:UDP:BitComet 7486 UDP

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);f:\windows\system32\drivers\sfsync03.sys [6.12.2005 16:11 35328]
R0 sptd;sptd;f:\windows\system32\drivers\sptd.sys [27.4.2006 15:00 691696]
R1 ehdrv;ehdrv;f:\windows\system32\drivers\ehdrv.sys [6.2.2009 13:23 106208]
R1 kbfilter;Keyboard Filter Driver;f:\windows\system32\drivers\kbfilter.sys [13.9.2006 18:21 12032]
R2 ekrn;ESET Service;f:\program files\ESET\ESET Smart Security\ekrn.exe [6.2.2009 13:23 727720]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;f:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 10:16 1107336]
R2 hoouaoavroip1;Ati External Event Utility;f:\windows\system32\baquou.exe [12.11.2010 16:07 201216]
R2 ICQ Service;ICQ Service;f:\program files\ICQ6Toolbar\ICQ Service.exe [5.1.2009 18:39 222456]
R3 LgBttPort;LGE Bluetooth TransPort;f:\windows\system32\drivers\lgbtport.sys [29.9.2009 8:11 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;f:\windows\system32\drivers\lgbtbus.sys [29.9.2009 8:11 10496]
R3 LGVMODEM;LGE Virtual Modem;f:\windows\system32\drivers\lgvmodem.sys [29.9.2009 8:11 12928]
R3 p17filt;p17filt;f:\windows\system32\drivers\p17filt.sys [20.3.2006 18:34 1452032]
S3 GarenaPEngine;GarenaPEngine;\??\f:\docume~1\madcat\LOCALS~1\Temp\NRU156.tmp --> f:\docume~1\madcat\LOCALS~1\Temp\NRU156.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\f:\program files\Garena\plugins\UI\safedrv.sys --> f:\program files\Garena\plugins\UI\safedrv.sys [?]
S3 hamachi_oem;PlayLinc Adapter;f:\windows\system32\drivers\gan_adapter.sys [28.8.2006 23:54 10664]
S3 HwIOctl;HwIOctl;\??\f:\program files\Setup Files\MS-6702 v2.20\HwIOctl.sys --> f:\program files\Setup Files\MS-6702 v2.20\HwIOctl.sys [?]
S3 NPF;NetGroup Packet Filter Driver;f:\windows\system32\drivers\npf.sys [25.1.2007 18:31 42000]
S3 Razerlow;Razerlow USB Filter Driver;f:\windows\system32\drivers\Razerlow.sys [26.4.2006 18:07 13225]
S3 UnlockerDriver4;UnlockerDriver4 Driver;\??\f:\program files\Unlocker\UnlockerDriver4.sys --> f:\program files\Unlocker\UnlockerDriver4.sys [?]
S3 UsbFltr;WayTech USB Filter Driver;f:\windows\system32\drivers\UsbFltr.sys [25.9.2006 18:24 8704]
S3 vaxscsi;vaxscsi;f:\windows\system32\drivers\vaxscsi.sys [10.7.2006 14:33 223128]
S4 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;f:\program files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE [3.5.2005 21:42 323584]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-08 f:\windows\Tasks\AppleSoftwareUpdate.job
- f:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-11-12 f:\windows\Tasks\Google Software Updater.job
- f:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-02 12:59]

2010-11-11 f:\windows\Tasks\Norton Security Scan for madcat.job
- f:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-02 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://fullarticles.net
uInternet Settings,ProxyOverride = *.local
IE: &ICQ Toolbar Search - f:\prográmky\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: Download Using &BitSpirit - f:\prográmky\BitSpirit\bsurl.htm
IE: E&xport to Microsoft Excel - f:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - f:\documents and settings\madcat\Data aplikací\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - f:\documents and settings\madcat\Data aplikací\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Save YouTube Video - f:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP4.htm
IE: Save YouTube Video as MP3 - f:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Stáhnout položku pomocí FlashGet - f:\prográmky\FlashGet\jc_link.htm
IE: Stáhnout pomocí FlashGet - f:\prográmky\FlashGet\jc_link.htm
IE: Stáhnout vše pomocí FlashGet - f:\prográmky\FlashGet\jc_all.htm
IE: Stáhnout všechny položky pomocí FlashGet - f:\prográmky\FlashGet\jc_all.htm
IE: ÓñČĚŘľ«ÁéĎÂÔŘ(&B)
DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} - file://f:\prográmky\AutoCAD 2002 Cz\InstFred.ocx
DPF: {AE563723-B4F5-11D4-A415-00108302FDFD} - file://f:\prográmky\AutoCAD 2002 Cz\InstBanr.ocx
FF - ProfilePath - f:\documents and settings\madcat\Data aplikací\Mozilla\Firefox\Profiles\2te5xswo.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: f:\documents and settings\madcat\Data aplikací\Mozilla\Firefox\Profiles\2te5xswo.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: f:\documents and settings\madcat\Data aplikací\Mozilla\Firefox\Profiles\2te5xswo.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - component: f:\program files\Common Files\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - component: f:\prográmky\Mozilla Firefox2\Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: f:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: f:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: f:\program files\OnLive\FirefoxPlugin\npolgdet.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - f:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
f:\progr mky\Mozilla Firefox2\Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
f:\progr mky\Mozilla Firefox2\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
f:\progr mky\Mozilla Firefox2\Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
Toolbar-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
SafeBoot-britfdsw.sys
MSConfigStartUp-DAEMON Tools Lite - f:\program files\DAEMON Tools Lite\DTLite.exe
AddRemove-YouTube Downloader_is1 - f:\youtube downloader\YouTube Downloader\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-12 19:49
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GarenaPEngine]
"ImagePath"="\??\f:\docume~1\madcat\LOCALS~1\Temp\NRU156.tmp"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3492)
f:\prográmky\iTunes\iTunesMiniPlayer.dll
f:\prográmky\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
f:\prográmky\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
f:\windows\system32\WPDShServiceObj.dll
f:\windows\system32\PortableDeviceTypes.dll
f:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
f:\windows\system32\nvsvc32.exe
f:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
f:\prográmky\Autodesk\Data Management Server 5\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
f:\program files\Bonjour\mDNSResponder.exe
f:\windows\system32\DRIVERS\CDANTSRV.EXE
f:\windows\system32\RUNDLL32.EXE
f:\windows\system32\inetsrv\inetinfo.exe
f:\program files\Java\jre6\bin\jqs.exe
f:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
f:\prográmky\NVIDIA Corporation\nTune\nTuneService.exe
f:\windows\system32\PnkBstrA.exe
f:\windows\system32\wscntfy.exe
f:\windows\system32\dllhost.exe
f:\windows\system32\DllHost.exe
f:\\?\f:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
f:\windows\system32\rundll32.exe
f:\windows\system32\inetsrv\DavCData.exe
.
**************************************************************************
.
Celkový čas: 2010-11-12 19:57:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-12 18:57
ComboFix2.txt 2010-07-11 12:08
ComboFix3.txt 2010-07-11 10:01
ComboFix4.txt 2010-07-10 14:18
ComboFix5.txt 2010-11-12 18:28

Před spuštěním: Volných bajtů: 13 998 325 760
Po spuštění: Volných bajtů: 14 913 769 472

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

- - End Of File - - D64C22FA5B607F0380BD1C7BECF4D575

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
f:\windows\system32\wouko.exe
f:\windows\system32\baquou.exe
f:\windows\system32\licywe.exe
f:\documents and settings\madcat\Data aplikací\juzjf.exe

Driver::
hoouaoavroip1

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kozevam"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

problém vyřešen, díky moc!

Nemáte zač!