Prosim o kontrolu logu

[REGE]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Radek at 2010-11-20 21:29:39
Systém Microsoft Windows XP Professional Service Pack 2
System drive H: has 1 GB (3%) free of 40 GB
Total RAM: 2046 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:29:45, on 20.11.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
H:\WINDOWS\vsnpstd.exe
H:\Program Files\Common Files\Real\Update_OB\realsched.exe
H:\Program Files\Java\jre6\bin\jusched.exe
H:\WINDOWS\system32\rundll32.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Aladdin\Aladdin SQL Server\AladdinSQL.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
H:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Fractalis Software\Display Stix 2.1.1\dstix.exe
H:\Program Files\Common Files\LightScribe\LSSrvc.exe
H:\Program Files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlservr.exe
H:\Documents and Settings\Radek\Local Settings\Data aplikací\Google\Update\1.2.183.39\GoogleCrashHandler.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\WINDOWS\system32\svchost.exe
C:\TECDOC_CD\2_2009\db\tbmux32.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\system32\wbem\wmiapsrv.exe
H:\Program Files\GIGABYTE\GEST\GSvr.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Java\jre6\bin\jucheck.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Downloads\RSIT.exe
H:\Program Files\trend micro\Radek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://193.179.208.98:8000/web/login.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - H:\Documents and Settings\Radek\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: OLE (Part 1 of 5) - - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - H:\Documents and Settings\Radek\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ISUSPM Startup] "H:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [GEST] H:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] H:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] H:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [GrooveMonitor] "H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [snpstd] H:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [RestartNeroSetup] "H:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" MODE="update"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [TkBellExe] "H:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Plus] "C:\Program Files\Real Spy Monitor\Plus.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [IR_SERVER] H:\Program Files\Realtek\REALTEK DTV USB DEVICE\IR_SERVER.exe
O4 - HKLM\..\Run: [eger] c:\program files\xoflnevbdulrtkbh\ifjbio.exe y
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Display Stix - System tray] C:\Program Files\Fractalis Software\Display Stix 2.1.1\dstix.exe
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Radek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [eger] c:\program files\xoflnevbdulrtkbh\ifjbio.exe y
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "c:\Program Files\WebcamMax\WebcamMax.exe" -a
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Obsah aplikace OneNote.onetoc2
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - c:\Program Files\QIP Infium\infium.exe (HKCU)
O10 - Unknown file in Winsock LSP: h:\windows\system32\nwprovau.dll
O16 - DPF: {8970206C-9776-44A3-AF8D-82DD7D46A2E6} (XViewer Control) - http://193.179.208.98:8000/XViewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBD753FA-F45D-430C-81AD-EAAA5FDDEDC4}: NameServer = 192.168.1.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - H:\Documents and Settings\All Users\Data aplikací\Norton\Norton2009Reset.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Aladdin SQL Server - Unknown owner - H:\Program Files\Aladdin\Aladdin SQL Server\AladdinSQL.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - H:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - H:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: Služba Google Update (gupdate1c9b1ffe149b250) (gupdate1c9b1ffe149b250) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - H:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Transbase TECDOC CD 2_2009 Service - Transaction Software, D 81829 Munich - C:\TECDOC_CD\2_2009\db\tbmux32.exe

--
End of file - 10148 bytes

======Scheduled tasks folder======

H:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
H:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
H:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1972579041-839522115-1003Core.job
H:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1972579041-839522115-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - H:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - H:\Documents and Settings\Radek\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-10-05 150768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - H:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=H:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=H:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"ISUSPM Startup"=H:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-08-11 249856]
"ISUSScheduler"=H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]
"GEST"=H:\Program Files\GIGABYTE\GEST\RUN.exe [2007-12-14 236040]
"RTHDCPL"=H:\WINDOWS\RTHDCPL.EXE [2008-02-13 16857600]
"Alcmtr"=H:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"JMB36X IDE Setup"=H:\WINDOWS\RaidTool\xInsIDE.exe [2007-03-20 36864]
"36X Raid Configurer"=H:\WINDOWS\system32\xRaidSetup.exe [2007-08-29 1966080]
"GrooveMonitor"=H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"snpstd"=H:\WINDOWS\vsnpstd.exe [2003-12-31 40960]
"RestartNeroSetup"=H:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe MODE=update []
"HPDJ Taskbar Utility"=H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe [2002-12-10 188416]
"TkBellExe"=H:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-06-26 198160]
"Plus"=C:\Program Files\Real Spy Monitor\Plus.exe []
"SunJavaUpdateSched"=H:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"ArcSoft Connection Service"=H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-03-18 207360]
"IR_SERVER"=H:\Program Files\Realtek\REALTEK DTV USB DEVICE\IR_SERVER.exe []
"eger"=c:\program files\xoflnevbdulrtkbh\ifjbio.exe [2009-02-12 2031618]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=H:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"LightScribe Control Panel"=H:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"DAEMON Tools Lite"=H:\Program Files\DAEMON Tools Lite\daemon.exe [2008-04-01 486856]
"Display Stix - System tray"=C:\Program Files\Fractalis Software\Display Stix 2.1.1\dstix.exe [2004-01-12 241664]
"Google Update"=H:\Documents and Settings\Radek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
"eger"=c:\program files\xoflnevbdulrtkbh\ifjbio.exe [2009-02-12 2031618]
"WebcamMaxAutoRun"=c:\Program Files\WebcamMax\WebcamMax.exe [2010-08-03 6043888]

H:\Documents and Settings\Radek\Nabídka Start\Programy\Po spuštění
Obsah aplikace OneNote.onetoc2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=H:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"G:\NeroExpress\Installation\Setupx.exe"="G:\NeroExpress\Installation\Setupx.exe:*:Enabled:Nero ProductSetup"
"H:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="H:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"H:\Program Files\Codemasters\GRID\GRID.exe"="H:\Program Files\Codemasters\GRID\GRID.exe:*:Enabled:GRID"
"O:\hry\S.T.A.L.K.E.R. - Clear Sky - play\bin\xrEngine.exe"="O:\hry\S.T.A.L.K.E.R. - Clear Sky - play\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"O:\hry\S.T.A.L.K.E.R. - Clear Sky - play\bin\dedicated\xrEngine.exe"="O:\hry\S.T.A.L.K.E.R. - Clear Sky - play\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"O:\hry\TrackMania Nations ESWC\TmNationsESWC.exe"="O:\hry\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"O:\hry\TmNationsForever\TmForever.exe"="O:\hry\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"O:\hry\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe"="O:\hry\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"O:\hry\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe"="O:\hry\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"H:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="H:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"H:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="H:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"H:\Program Files\Winamp Remote\bin\Orb.exe"="H:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"H:\Program Files\Winamp Remote\bin\OrbTray.exe"="H:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"H:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="H:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe"="C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe"="C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"C:\Program Files\Ubisoft\Far Cry 2\bin\FarCry2.exe"="C:\Program Files\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2"
"C:\Program Files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="C:\Program Files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"
"C:\Program Files\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="C:\Program Files\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor"
"H:\WINDOWS\system32\PnkBstrA.exe"="H:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"H:\WINDOWS\system32\PnkBstrB.exe"="H:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\Program Files\manasNX\manasnx.exe"="C:\Program Files\manasNX\manasnx.exe:*:Enabled:manasnx"
"H:\Program Files\Skype\Plugin Manager\skypePM.exe"="H:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\IPView Pro\IPView Pro.exe"="C:\Program Files\IPView Pro\IPView Pro.exe:*:Enabled:IPView Pro"
"C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe"="C:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\hry\TmNationsForever\TmForever.exe"="C:\hry\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\hry\TrackMania Nations ESWC\TmNationsESWC.exe"="C:\hry\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"H:\Program Files\Skype\Phone\Skype.exe"="H:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.js - edit - "H:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"
.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-20 21:29:40 ----D---- H:\Program Files\trend micro
2010-11-20 21:29:39 ----D---- H:\rsit
2010-10-31 16:31:49 ----ASH---- H:\hiberfil.sys
2010-10-31 16:28:33 ----D---- H:\WINDOWS\CSC
2010-10-31 16:25:36 ----A---- H:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2010-11-20 21:29:40 ----RD---- H:\Program Files
2010-11-20 21:26:17 ----D---- H:\Documents and Settings\Radek\Data aplikací\Skype
2010-11-20 21:18:00 ----AD---- H:\Documents and Settings\All Users\Data aplikací\TEMP
2010-11-20 21:10:33 ----D---- H:\Documents and Settings\Radek\Data aplikací\skypePM
2010-11-20 21:09:49 ----D---- H:\WINDOWS\Prefetch
2010-11-20 14:51:40 ----D---- H:\Program Files\Mozilla Firefox
2010-11-20 08:42:00 ----A---- H:\WINDOWS\SchedLgU.Txt
2010-11-20 08:28:20 ----D---- H:\WINDOWS\Temp
2010-11-20 08:28:03 ----D---- H:\WINDOWS\system32\CatRoot2
2010-11-19 06:45:57 ----D---- H:\Program Files\Mozilla Thunderbird
2010-10-31 16:28:33 ----D---- H:\WINDOWS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 JRAID;JRAID; H:\WINDOWS\system32\DRIVERS\jraid.sys [2007-09-29 65024]
R0 PxHelp20;PxHelp20; H:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); H:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); H:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); H:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; H:\WINDOWS\System32\Drivers\sptd.sys [2008-11-01 717296]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; H:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-01-18 77696]
R1 appdrv01;Application Driver (01); H:\WINDOWS\System32\Drivers\appdrv01.sys [2008-11-12 2915944]
R1 intelppm;Řadič procesoru Intel; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 kbdhid;Ovladač klávesnice standardu HID; H:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R2 atksgt;atksgt; H:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-11-02 279712]
R2 lirsgt;lirsgt; H:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-11-02 25888]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; H:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2004-08-03 88448]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; H:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2001-10-25 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; H:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2001-10-25 55936]
R3 Afc;PPdus ASPI Shell; H:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
R3 ET5Drv;ET5Drv; \??\H:\WINDOWS\system32\Drivers\ET5Drv.sys []
R3 gdrv;gdrv; \??\H:\WINDOWS\gdrv.sys []
R3 hamachi;Hamachi Network Interface; H:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-11-04 25280]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; H:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-02-14 4676096]
R3 mouhid;Ovladač myši standardu HID; H:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NdisIP;Microsoft TV/Video Connection; H:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
R3 nv;nv; H:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 NWRDR;NetWare Rdr; H:\WINDOWS\system32\DRIVERS\nwrdr.sys [2004-08-03 163584]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; H:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 snpstd;TRUST 120 SPACEC@M; H:\WINDOWS\system32\DRIVERS\snpstd.sys [2004-02-19 299776]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; H:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S0 BTHidEnum;Bluetooth HID Enumerator; H:\WINDOWS\System32\Drivers\vbtenum.sys []
S0 BTHidMgr;Bluetooth HID Manager Service; H:\WINDOWS\System32\Drivers\BTHidMgr.sys []
S3 AODDriver;AODDriver; \??\H:\Program Files\GIGABYTE\ET6\i386\AODDriver.sys []
S3 aqgb3k8f;aqgb3k8f; H:\WINDOWS\system32\drivers\aqgb3k8f.sys []
S3 BlueletAudio;Bluetooth Audio Service; H:\WINDOWS\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; H:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; H:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; H:\WINDOWS\System32\Drivers\btcusb.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; H:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024]
S3 BTHMODEM;Ovladač komunikace modemu Bluetooth; H:\WINDOWS\system32\DRIVERS\bthmodem.sys [2004-08-03 38016]
S3 BthPan;Bluetooth Device (Personal Area Network); H:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Ovladač portu Bluetooth; H:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; H:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944]
S3 CCDECODE;Dekodér Closed Caption; H:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add; H:\WINDOWS\system32\DRIVERS\GcKernel.sys [2004-08-03 59136]
S3 GTwinUSB;GTwinUSB; H:\WINDOWS\System32\Drivers\GTwinUSB.sys [2004-06-28 61840]
S3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual; H:\WINDOWS\system32\DRIVERS\HIDSwvd.sys [2001-08-17 2688]
S3 CH341SER;CH341SER; H:\WINDOWS\System32\Drivers\CH341SER.SYS [2007-09-24 37488]
S3 MPE;Filtr MPE BDA; H:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; H:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; H:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 nmwcd;Nokia USB Phone Parent; H:\WINDOWS\system32\drivers\ccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; H:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-10-06 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; H:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); H:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; H:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver; H:\WINDOWS\system32\DRIVERS\RTL2832U_IRHID.sys [2009-07-13 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver; H:\WINDOWS\system32\drivers\RTL2832UBDA.sys [2009-07-06 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver; H:\WINDOWS\System32\Drivers\RTL2832UUSB.sys [2009-07-06 32800]
S3 SLIP;BDA Slip De-Framer; H:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; H:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 upperdev;upperdev; H:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-10-06 7936]
S3 usbprint;Třída USB Printer; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; H:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;USB Modem Driver; H:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; H:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-10-06 7936]
S3 VComm;Virtual Serial port driver; H:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; H:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 Wdf01000;Kernel Mode Driver Frameworks service; H:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; H:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; H:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; H:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 Aladdin SQL Server;Aladdin SQL Server; H:\Program Files\Aladdin\Aladdin SQL Server\AladdinSQL.exe [2010-09-27 136192]
R2 BthServ;Bluetooth Support Service; H:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; H:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; H:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 MSSQL$PROFIBANKA;MSSQL$PROFIBANKA; H:\Program Files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlservr.exe [2002-12-17 7520337]
R2 NVSvc;NVIDIA Display Driver Service; H:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 NWCWorkstation;Klient systému NetWare; H:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 PnkBstrA;PnkBstrA; H:\WINDOWS\system32\PnkBstrA.exe [2010-01-09 66872]
R2 Transbase TECDOC CD 2_2009 Service;Transbase TECDOC CD 2_2009 Service; C:\TECDOC_CD\2_2009\db\tbmux32.exe [2009-02-24 356352]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; H:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R3 GEST Service;GEST Service for program management.; H:\Program Files\GIGABYTE\GEST\GSvr.exe [2007-12-14 47624]
S2 .norton2009Reset;Norton 2009 Reset; H:\Documents and Settings\All Users\Data aplikací\Norton\Norton2009Reset.exe [2009-01-13 281625]
S2 appdrvrem01;Application Driver Auto Removal Service (01); H:\WINDOWS\System32\appdrvrem01.exe [2008-11-12 304528]
S2 gupdate1c9b1ffe149b250;Služba Google Update (gupdate1c9b1ffe149b250); H:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-31 133104]
S3 aspnet_state;ASP.NET State Service; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; H:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 getPlusHelper;getPlus(R) Helper; H:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
S3 hpqcxs08;hpqcxs08; H:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S3 IDriverT;InstallDriver Table Manager; H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; H:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MSSQLServerADHelper;MSSQLServerADHelper; H:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 NMIndexingService;NMIndexingService; H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 odserv;Microsoft Office Diagnostics Service; H:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; H:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 SQLAgent$PROFIBANKA;SQLAgent$PROFIBANKA; H:\Program Files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlagent.EXE [2002-12-17 311872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

[earl]

Zdravim,

mate nelegalni Norton,takze odinstalovat a nainstalovat free antivir - Antiviry

CTETE POZORNE NAVOD,TENTO SOFT NETOLERUJE CHYBY V POSTUPU APLIKOVANI!

Klidne si nasledujici radky vytisknete,at vite,co se bude na obrazovce odehravat.

Budte prihlasen na pc s administratorskymi pravy.

V operacnich systemech Windows Vista a Windows 7 je nutno spoustet aplikaci jako spravce (kliknutim pravym tlacitkem mysi na ikonu ComboFixu a klepnutim levym na volbu "Spustit jako spravce")

stahnete a ulozte nejlepe na plochu ComboFix

v pripade,ze nepujde stranka nacist-stahnete odtud download , popr. nepujde ComboFix spustit - prejmenujte jej na grinder.com a postupujte dale dle instrukci.

hned po startu se zobrazi Zreknuti se prava zaruky na funkcnost software, pokracujte kliknutim na tlacitko Ano:



pote muze nasledovat upozorneni na nainstalovane emulatory CD mechanik,typicky Daemon Tools nebo Alcohol 120



odklepnout OK

Souhlasit s instalaci Recovery console(Konzola pro zotaveni)-nutno funkcni internet

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: upozorneni: Vypnete rezidentni stit u antiviru a antispywaru a zakazte docasne firewall-ComboFix by nemusel fungovat korektne-pokud budete mit stity vypnute a Combofix zahlasi,ze nejsou,pokracujte dal a potvrdte.

po restartu aplikace vytvori log, ulozeny na C:/Combofix.txt (pri opakovanem pouziti jsou logy oznaceny Combofix2.txt atd.), jeho obsah vlozte sem

[REGE]

ComboFix 10-11-20.03 - Radek 20.11.2010 22:27:43.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1327 [GMT 1:00]
Spuštěný z: c:\downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\xoflnevbdulrtkbh\ifjbio.exe
h:\documents and settings\All Users\Nabídka Start\Programy\Setup Wizard
h:\documents and settings\All Users\Nabídka Start\Programy\Setup Wizard\SetupWizard.lnk
h:\documents and settings\All Users\Nabídka Start\Programy\Setup Wizard\Uninstall Setup Wizard.lnk
h:\windows\system32\spool\prtprocs\w32x86\CNMPP5y.DLL

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_.norton2009Reset


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-20 do 2010-11-20 )))))))))))))))))))))))))))))))
.

2010-11-20 20:29 . 2010-11-20 20:29 -------- d-----w- h:\program files\trend micro
2010-11-20 20:29 . 2010-11-20 20:29 -------- d-----w- H:\rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-20 21:33 . 2008-10-31 15:05 16608 ----a-w- h:\windows\gdrv.sys
2004-12-03 09:03 . 2004-12-03 09:03 299008 -c--a-w- h:\program files\HDSECompression.dll
2009-10-05 17:34 . 2009-10-25 17:13 118000 -c--a-w- h:\program files\mozilla firefox\components\qippipe.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="h:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]
"DAEMON Tools Lite"="h:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Display Stix - System tray"="c:\program files\Fractalis Software\Display Stix 2.1.1\dstix.exe" [2004-01-12 241664]
"Google Update"="h:\documents and settings\Radek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-03-18 136176]
"WebcamMaxAutoRun"="c:\program files\WebcamMax\WebcamMax.exe" [2010-08-03 6043888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="h:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"ISUSPM Startup"="h:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"ISUSScheduler"="h:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"GEST"="h:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"JMB36X IDE Setup"="h:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="h:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080]
"GrooveMonitor"="h:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"snpstd"="h:\windows\vsnpstd.exe" [2003-12-31 40960]
"HPDJ Taskbar Utility"="h:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"TkBellExe"="h:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-26 198160]
"SunJavaUpdateSched"="h:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-17 110592]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

h:\documents and settings\Radek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Obsah aplikace OneNote.onetoc2 [2010-5-4 3656]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"h:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
"c:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\manasNX\\manasnx.exe"=
"h:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\IPView Pro\\IPView Pro.exe"=
"c:\\hry\\TmNationsForever\\TmForever.exe"=
"c:\\hry\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;h:\windows\system32\drivers\sptd.sys [1.11.2008 5:28 717296]
R1 appdrv01;Application Driver (01);h:\windows\system32\drivers\appdrv01.sys [12.11.2008 23:49 2915944]
R2 Aladdin SQL Server;Aladdin SQL Server;h:\program files\Aladdin\Aladdin SQL Server\AladdinSQL.exe [29.1.2009 22:55 136192]
R2 MSSQL$PROFIBANKA;MSSQL$PROFIBANKA;h:\program files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlservr.exe -sPROFIBANKA --> h:\program files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlservr.exe -sPROFIBANKA [?]
R2 Transbase TECDOC CD 2_2009 Service;Transbase TECDOC CD 2_2009 Service;c:\tecdoc_cd\2_2009\db\tbmux32.exe [24.2.2009 15:47 356352]
R3 GEST Service;GEST Service for program management.;h:\program files\GIGABYTE\GEST\GSvr.exe [31.10.2008 16:06 47624]
S2 appdrvrem01;Application Driver Auto Removal Service (01);h:\windows\System32\appdrvrem01.exe svc --> h:\windows\System32\appdrvrem01.exe svc [?]
S2 gupdate1c9b1ffe149b250;Služba Google Update (gupdate1c9b1ffe149b250);h:\program files\Google\Update\GoogleUpdate.exe [31.3.2009 13:54 133104]
S3 AODDriver;AODDriver;\??\h:\program files\GIGABYTE\ET6\i386\AODDriver.sys --> h:\program files\GIGABYTE\ET6\i386\AODDriver.sys [?]
S3 GTwinUSB;GTwinUSB;h:\windows\system32\drivers\GTwinUSB.sys [11.11.2008 10:38 61840]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;h:\windows\system32\drivers\RTL2832U_IRHID.sys [17.5.2010 19:59 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;h:\windows\system32\drivers\RTL2832UBDA.sys [17.5.2010 19:59 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;h:\windows\system32\drivers\RTL2832UUSB.sys [17.5.2010 19:59 32800]
S3 SQLAgent$PROFIBANKA;SQLAgent$PROFIBANKA;h:\program files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlagent.EXE -i PROFIBANKA --> h:\program files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlagent.EXE -i PROFIBANKA [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30 451872 -c--a-w- h:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-11-20 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-03-31 12:54]

2010-11-20 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-03-31 12:54]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://193.179.208.98:8000/web/login.asp
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovat do aplikace Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {FBD753FA-F45D-430C-81AD-EAAA5FDDEDC4} = 192.168.1.2
DPF: {8970206C-9776-44A3-AF8D-82DD7D46A2E6} - hxxp://193.179.208.98:8000/XViewer.cab
FF - ProfilePath - h:\documents and settings\Radek\Data aplikací\Mozilla\Firefox\Profiles\lniwt6yy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: h:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: h:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npfiller.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npwachk.dll

---- NASTAVENÍ FIREFOXU ----
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
h:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
h:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
h:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-eger - c:\program files\xoflnevbdulrtkbh\ifjbio.exe
HKLM-Run-RestartNeroSetup - h:\program files\Common Files\Ahead\Nero Web\SetupX.exe
HKLM-Run-Plus - c:\program files\Real Spy Monitor\Plus.exe
HKLM-Run-IR_SERVER - h:\program files\Realtek\REALTEK DTV USB DEVICE\IR_SERVER.exe
HKLM-Run-eger - c:\program files\xoflnevbdulrtkbh\ifjbio.exe
AddRemove-BSPlayer1 - c:\program files\Webteh\BSplayer\uninstall.exe
AddRemove-PRO100_is1 - h:\program files\PRO100 Demo\setup\unins000.exe
AddRemove-TmNationsForever_is1 - o:\hry\TmNationsForever\unins000.exe
AddRemove-TmNations_is1_is1 - o:\hry\TrackMania Nations ESWC\unins000.exe
AddRemove-QIP Infium - c:\program files\QIP Infium\unins001.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-20 22:32
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Plus = "c:\program files\Real Spy Monitor\Plus.exe"????i?v?e?r?y???????????F?o?r? ?o?p?t?i?m?a

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2160)
h:\windows\system32\themeui.dll
h:\windows\system32\msi.dll
h:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\windows\System32\SCardSvr.exe
h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
h:\windows\system32\RUNDLL32.EXE
h:\windows\RTHDCPL.EXE
h:\program files\Java\jre6\bin\jqs.exe
h:\windows\system32\rundll32.exe
h:\program files\Common Files\LightScribe\LSSrvc.exe
h:\documents and settings\Radek\Local Settings\Data aplikací\Google\Update\1.2.183.39\GoogleCrashHandler.exe
h:\program files\profibanka\System\BinnMSSQL$PROFIBANKA\Binn\sqlservr.exe
h:\windows\system32\nvsvc32.exe
h:\windows\system32\PnkBstrA.exe
h:\windows\system32\wbem\wmiapsrv.exe
h:\windows\system32\wscntfy.exe
c:\documents and settings\Radek\Dokumenty\Winamp\winamp.exe
.
**************************************************************************
.
Celkový čas: 2010-11-20 22:35:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-20 21:35

Před spuštěním: 1 052 975 104
Po spuštění: 1 282 871 296

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 47A25C2A706A833E62CFB3CD0154A65E

[earl]

c:\program files\Real Spy Monitor

Tento soft se vam spousti po startu s vasim vedomim?

Pokud ne - odinstalovat.

Domovskou stranku v Internet Expolreru mate nastavenou umyslne?

Nevidim nikde ten antivir,takze - stahnete a nainstalujte bud Avast nebo Aviru (Avira neobsahuje mailovy skener,Avast ano)

Stahnete RSIT ,

spustte, kliknete na continue, po dokonceni by se mel otevrit textovy soubor - pokud se tak

nestane, nachazi se zde: C:\rsit\log.txt.Obsah logu vlozte sem.V pripade nejasnosti navod

zde