VIRY.CZ

Zdravím,
mám takový větší menší problém. Před nějakým časem se mi při přehrávání videa na internetu stávalo, že se mi na nějaký čas zasekal počítač a strašně se zpomalil, ale po pár minutách se zase rozjel. Nyní ale když si chci přehrát nějaké videjko tak se sekne úplně a cca po 10-15 sekundách se objeví modrá obrazovka s výpisem paměti RAM a všechno to svádí na soubor watchdog.sys. Nevíte jak z této šlamastiky?

Aplikaci Watchdog na zkoušku odinstalujte a přesvědčte se, zda se ještě nějaká BSOD objeví.

potřeboval bych vědět jak ji odinstalovat...predpokládám, že delete asi nepomůže...

Start>ovl. panely>přidat/ubrat programy.

já tenhle program nikdy neměl a neinstaloval jsem ho, soubor watchdog.sys mam v adresáři system32...nevím jak se tam dostal nebo s jakým jiným programem

OK, dejte log z RSIT: http://www.malwarebytes.org/mbam.php .

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5768

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

15.2.2011 21:46:52
mbam-log-2011-02-15 (21-46-46).txt

Typ kontroly: Rychlý test
Testované objekty: 199806
Uplynulý čas: 3 minut, 56 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 2
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 4
Infikované soubory: 15

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\Software\FLV Direct Player (Adware.FLVPlayer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FLV Direct Player (Adware.FLVPlayer) -> No action taken.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
c:\program files\flv direct player (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv (Adware.BHO.FL) -> No action taken.
c:\documents and settings\all users.windows\nabídka start\Programy\flv direct player (Adware.FLVPlayer) -> No action taken.

Infikované soubory:
c:\documents and settings\all users.windows\Plocha\flv direct player.lnk (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\downloading.swf (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\flvplayer.exe (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\player.swf (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\preload.swf (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\uninstall.exe (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\Button.bmp (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\Logo.bmp (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\skin.xml (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\sysclosebutton.bmp (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\sysmaxbutton.bmp (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\sysminbutton.bmp (Adware.BHO.FL) -> No action taken.
c:\program files\flv direct player\Skin\directflv\Window.bmp (Adware.BHO.FL) -> No action taken.
c:\documents and settings\all users.windows\nabídka start\Programy\flv direct player\flv direct player.lnk (Adware.FLVPlayer) -> No action taken.
c:\documents and settings\all users.windows\nabídka start\Programy\flv direct player\uninstall flv direct player.lnk (Adware.FLVPlayer) -> No action taken.

Promiňte, překlikl jsem se v odkazu. Nic nemažte. Dejte log z: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

Logfile of random's system information tool 1.08 (written by random/random)
Run by Giraffe at 2011-02-15 22:18:56
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 9 GB (22%) free of 40 GB
Total RAM: 2047 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:19:09, on 15.2.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Giraffe\Plocha\Downloads\RSIT.exe
C:\Program Files\trend micro\Giraffe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ivanovfamily.blogspot.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_2.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [UpdateReminder] C:\Program Files\Eset\UpdateReminder.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Kniha klipů HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Chytrý výběr - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 8253050390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8253026906
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F45541D-8104-4422-88FF-E451CE369FE6}: NameServer = 85.207.76.5,85.207.86.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wbsys.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: StyleXPService - Unknown owner - (no file)

--
End of file - 9219 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_printenhancer.dll [2007-03-02 1298024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-17 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C333CF63-767F-4831-94AC-E683D962C63C}]
CoTGT_BHO Class - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll [2005-11-30 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-17 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-17 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files\BS_Player\tbBS_2.dll [2010-10-18 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files\BS_Player\tbBS_2.dll [2010-10-18 3908192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"=C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe [2006-09-25 90112]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2010-11-11 949376]
"UpdateReminder"=C:\Program Files\Eset\UpdateReminder.exe [2010-11-30 434176]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-11-22 16858112]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActivControl]
C:\Program Files\Activ Software\Activdriver\ActivControl2.exe [2007-11-09 1003520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [2007-08-03 202024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\change!t]
C:\Program Files\changeit\changeit.exe [2007-11-14 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-16 1164584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe [2002-11-03 188416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ6.5\ICQ.exe [2010-11-16 172856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Nero\Nero8\InCD\InCD.exe [2007-08-04 1056552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe [2007-03-21 145496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2010-04-16 3872080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2007-04-27 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
C:\Program Files\Nero\Nero8\InCD\NBHGui.exe [2007-08-04 2043688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [2002-04-11 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe [2007-08-24 36640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2006-01-30 1363968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-17 136600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-01-15 1830128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HEWLET~1\DIGITA~1\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^MuchTV Remote.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Giraffe^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Giraffe^Nabídka Start^Programy^Po spuštění^Yahoo! Widget Engine.lnk]
[]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\wbsys.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-07-28 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB]
C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [2001-12-20 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\DC++\DCPlusPlus.exe"="C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe"="C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe:*:Enabled:Kerio Personal Firewall 4 - GUI"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Pinnacle\Studio 11\programs\RM.exe"="C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\Program Files\Pinnacle\Studio 11\programs\umi.exe"="C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:*:Enabled:umi"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"H:\Ftp files\Games playing\Delta Force Black Hawk Down\dfbhd.exe"="H:\Ftp files\Games playing\Delta Force Black Hawk Down\dfbhd.exe:*:Enabled:dfbhd"
"H:\Ftp files\Games playing\Valve\cstrike.exe"="H:\Ftp files\Games playing\Valve\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"H:\Ftp files\Games playing\World of Warcraft TBC\Launcher.exe"="H:\Ftp files\Games playing\World of Warcraft TBC\Launcher.exe:*:Enabled:Blizzard Launcher"
"H:\Ftp files\Games playing\World of Warcraft TBC\Repair.exe"="H:\Ftp files\Games playing\World of Warcraft TBC\Repair.exe:*:Enabled:Blizzard Repair Utility"
"H:\Ftp files\Games playing\wow tbc\WoW-BurningCrusade-enUS-Installer-downloader.exe"="H:\Ftp files\Games playing\wow tbc\WoW-BurningCrusade-enUS-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2011-02-15 22:18:57 ----D---- C:\Program Files\trend micro
2011-02-15 22:18:56 ----D---- C:\rsit
2011-02-15 21:40:21 ----D---- C:\Documents and Settings\Giraffe\Data aplikací\Malwarebytes
2011-02-15 21:39:19 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2011-02-15 21:39:19 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-02-15 21:39:15 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-02-15 21:39:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-02-15 16:19:00 ----A---- C:\ComboFix.txt
2011-02-15 16:12:49 ----SD---- C:\ComboFix
2011-02-14 21:11:56 ----ASH---- C:\pagefile.sys
2011-02-14 20:54:34 ----D---- C:\WINDOWS\Prefetch
2011-02-14 20:46:37 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2011-02-14 20:43:08 ----A---- C:\WINDOWS\system32\wshirda.dll
2011-02-14 20:43:08 ----A---- C:\WINDOWS\system32\irmon.dll
2011-02-14 20:43:08 ----A---- C:\WINDOWS\system32\irftp.exe
2011-02-14 20:43:08 ----A---- C:\WINDOWS\system32\drivers\irda.sys
2011-02-14 20:35:52 ----A---- C:\WINDOWS\pnplog.txt
2011-02-14 20:22:53 ----A---- C:\WINDOWS\system32\drivers\rasirda.sys
2011-02-14 20:19:47 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-02-14 20:19:47 ----A---- C:\WINDOWS\system32\irclass.dll
2011-02-14 20:19:35 ----RA---- C:\WINDOWS\SETE2.tmp
2011-02-14 20:19:33 ----RA---- C:\WINDOWS\SETD6.tmp
2011-02-14 20:19:31 ----RA---- C:\WINDOWS\SETD3.tmp
2011-02-14 19:52:36 ----A---- C:\WINDOWS\000001_.tmp

======List of files/folders modified in the last 1 months======

2011-02-15 22:18:57 ----RD---- C:\Program Files
2011-02-15 22:11:02 ----D---- C:\WINDOWS\temp
2011-02-15 22:02:28 ----D---- C:\WINDOWS\system32
2011-02-15 22:02:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-02-15 21:59:13 ----D---- C:\WINDOWS
2011-02-15 21:39:19 ----D---- C:\WINDOWS\system32\drivers
2011-02-15 21:37:32 ----A---- C:\WINDOWS\WINCMD.INI
2011-02-15 20:23:10 ----A---- C:\WINDOWS\imsins.BAK
2011-02-15 16:19:02 ----D---- C:\Qoobox
2011-02-15 16:17:57 ----D---- C:\WINDOWS\system32\CatRoot2
2011-02-15 16:16:39 ----A---- C:\WINDOWS\system.ini
2011-02-15 16:14:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-02-15 16:07:33 ----D---- C:\Program Files\HijackThis
2011-02-15 08:12:58 ----SH---- C:\boot.ini
2011-02-15 08:12:58 ----A---- C:\WINDOWS\win.ini
2011-02-14 22:20:57 ----D---- C:\GEN
2011-02-14 21:16:02 ----D---- C:\WINDOWS\system32\Setup
2011-02-14 21:16:01 ----D---- C:\WINDOWS\Help
2011-02-14 21:15:55 ----D---- C:\WINDOWS\system32\usmt
2011-02-14 21:15:47 ----D---- C:\WINDOWS\AppPatch
2011-02-14 21:15:46 ----D---- C:\WINDOWS\ehome
2011-02-14 21:15:45 ----D---- C:\WINDOWS\ime
2011-02-14 21:15:44 ----RSD---- C:\WINDOWS\Fonts
2011-02-14 21:15:43 ----D---- C:\WINDOWS\Media
2011-02-14 21:15:41 ----D---- C:\WINDOWS\Minidump
2011-02-14 21:15:34 ----D---- C:\WINDOWS\PeerNet
2011-02-14 21:15:23 ----D---- C:\WINDOWS\system32\npp
2011-02-14 21:15:17 ----D---- C:\WINDOWS\msagent
2011-02-14 21:13:34 ----D---- C:\WINDOWS\system32\1029
2011-02-14 21:13:28 ----D---- C:\WINDOWS\twain_32
2011-02-14 21:13:16 ----D---- C:\WINDOWS\system32\icsxml
2011-02-14 21:12:54 ----D---- C:\WINDOWS\system32\ias
2011-02-14 21:12:49 ----D---- C:\WINDOWS\system32\1033
2011-02-14 21:11:57 ----D---- C:\WINDOWS\Driver Cache
2011-02-14 20:56:54 ----D---- C:\WINDOWS\Registration
2011-02-14 20:56:15 ----SHD---- C:\System Volume Information
2011-02-14 20:56:13 ----HD---- C:\WINDOWS\inf
2011-02-14 20:56:07 ----A---- C:\WINDOWS\setuplog.txt
2011-02-14 20:53:55 ----D---- C:\WINDOWS\system32\inetsrv
2011-02-14 20:53:55 ----D---- C:\WINDOWS\system32\config
2011-02-14 20:50:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-02-14 20:47:41 ----D---- C:\WINDOWS\security
2011-02-14 20:47:31 ----A---- C:\WINDOWS\OEWABLog.txt
2011-02-14 20:47:26 ----A---- C:\WINDOWS\ODBCINST.INI
2011-02-14 20:47:08 ----ASH---- C:\WINDOWS\fonts\desktop.ini
2011-02-14 20:46:39 ----RD---- C:\WINDOWS\Web
2011-02-14 20:46:31 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-02-14 20:46:14 ----D---- C:\WINDOWS\system32\oobe
2011-02-14 20:46:12 ----D---- C:\WINDOWS\srchasst
2011-02-14 20:46:10 ----D---- C:\Program Files\Windows Media Player
2011-02-14 20:46:05 ----D---- C:\Program Files\Movie Maker
2011-02-14 20:45:59 ----D---- C:\WINDOWS\system32\Restore
2011-02-14 20:45:57 ----D---- C:\Program Files\NetMeeting
2011-02-14 20:45:54 ----D---- C:\Program Files\Outlook Express
2011-02-14 20:45:53 ----D---- C:\Program Files\Common Files\System
2011-02-14 20:45:42 ----D---- C:\Program Files\Internet Explorer
2011-02-14 20:45:05 ----D---- C:\WINDOWS\system32\Com
2011-02-14 20:44:41 ----D---- C:\WINDOWS\system32\wbem
2011-02-14 20:44:39 ----D---- C:\Program Files\Windows NT
2011-02-14 20:34:52 ----D---- C:\WINDOWS\system32\RTCOM
2011-02-14 20:21:06 ----D---- C:\WINDOWS\system32\CatRoot
2011-02-14 20:19:47 ----D---- C:\WINDOWS\system
2011-02-14 20:19:39 ----ASH---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\desktop.ini
2011-02-14 19:54:12 ----D---- C:\Program Files\Messenger
2011-02-14 16:21:57 ----A---- C:\WINDOWS\UPGRADE.TXT
2011-02-14 16:17:05 ----D---- C:\Program Files\DC++
2011-02-06 21:16:11 ----D---- C:\Documents and Settings\Giraffe\Data aplikací\Skype
2011-02-06 19:34:39 ----D---- C:\Documents and Settings\Giraffe\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 d347bus;d347bus; C:\WINDOWS\system32\DRIVERS\d347bus.sys [2004-08-22 155136]
R0 d347prt;d347prt; C:\WINDOWS\System32\Drivers\d347prt.sys [2004-08-22 5248]
R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2007-08-08 11304]
R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2007-08-08 132904]
R0 nvgts;nvgts; C:\WINDOWS\system32\DRIVERS\nvgts.sys [2007-07-02 101888]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI NEC FireWarden; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2008-05-15 82380]
R1 fwdrv;Firewall Driver; C:\WINDOWS\system32\drivers\fwdrv.sys [2005-03-21 270336]
R1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-08-04 38952]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-08-04 40488]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R1 nltdi;nltdi; \??\C:\WINDOWS\system32\drivers\nltdi.sys []
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2010-11-11 15424]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 StyleXPHelper;StyleXPHelper; \??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe []
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2010-11-11 512096]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2004-08-03 87424]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-07-28 2371584]
R3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-11-27 4630016]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2007-01-04 171520]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-11-17 54016]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-11-17 22016]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-08-04 125224]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128]
S3 ActivHidSerMini;Promethean Serial Board Driver; C:\WINDOWS\system32\DRIVERS\activhidsermini.sys [2007-11-09 54656]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912]
S3 Cap7134;MuchTV Plus Capture; C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-03-07 348160]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-08 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-08 21568]
S3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-07-07 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-07-07 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-07-07 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-07-07 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-07-07 79488]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-03 51328]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-17 10880]
S3 PhTVTune;MuchTV Plus TVTuner; C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-03-07 24000]
S3 prmvmouse;Promethean HID Mouse Service; C:\WINDOWS\system32\DRIVERS\activmouse.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS []
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-07-28 483328]
R2 Capture Device Service;Capture Device Service; C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe [2006-08-11 200704]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2005-01-04 65536]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 InCDsrv;InCD Helper; C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe [2007-08-04 1440040]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-17 152984]
R2 KPF4;Kerio Personal Firewall 4; C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe [2005-03-23 1941504]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 nlsvc;NetLimiter; C:\Program Files\NetLimiter 2 Pro\nlsvc.exe [2007-03-21 516096]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2010-11-11 552064]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2005-05-11 225280]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 SiteAdvisor Service;SiteAdvisor Service; C:\Program Files\SiteAdvisor\6172\SAService.exe [2010-11-07 341280]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2005-01-04 1527893]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-12-20 520192]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-11-08 135664]
S2 PCLEPCI;PCLEPCI; C:\WINDOWS\system32\drivers\pclepci.sys [2005-02-09 14165]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-07-15 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-08-03 382248]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2007-08-22 147824]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Nikde není watchdog vidět. Zkusíme ho odstřelit ComboFixem:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Dejte log.

ComboFix 11-02-15.01 - Giraffe 15.02.2011 22:31:57.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2047.1310 [GMT 1:00]
Spuštěný z: c:\documents and settings\Giraffe\Plocha\Downloads\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Kerio Personal Firewall *Disabled* {532EFE70-19BC-4F0F-8F50-D5F15C243133}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\FLV Direct Player
c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\FLV Direct Player\FLV Direct Player.lnk
c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\FLV Direct Player\Uninstall FLV Direct Player.lnk
c:\documents and settings\All Users.WINDOWS\Plocha\FLV Direct Player.lnk
c:\program files\FLV Direct Player
c:\program files\FLV Direct Player\downloading.swf
c:\program files\FLV Direct Player\FLVPlayer.exe
c:\program files\FLV Direct Player\player.swf
c:\program files\FLV Direct Player\preload.swf
c:\program files\FLV Direct Player\Skin\DirectFLV\Button.bmp
c:\program files\FLV Direct Player\Skin\DirectFLV\Logo.bmp
c:\program files\FLV Direct Player\Skin\DirectFLV\skin.xml
c:\program files\FLV Direct Player\Skin\DirectFLV\SysCloseButton.bmp
c:\program files\FLV Direct Player\Skin\DirectFLV\SysMaxButton.bmp
c:\program files\FLV Direct Player\Skin\DirectFLV\SysMinButton.bmp
c:\program files\FLV Direct Player\Skin\DirectFLV\Window.bmp
c:\program files\FLV Direct Player\uninstall.exe
c:\windows\daemon.dll
c:\windows\system32\kernel1.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2011-01-15 do 2011-02-15 )))))))))))))))))))))))))))))))
.

2011-02-15 21:18 . 2011-02-15 21:19 -------- d-----w- c:\program files\trend micro
2011-02-15 21:18 . 2011-02-15 21:19 -------- d-----w- C:\rsit
2011-02-15 20:40 . 2011-02-15 20:40 -------- d-----w- c:\documents and settings\Giraffe\Data aplikací\Malwarebytes
2011-02-15 20:39 . 2011-02-15 20:39 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2011-02-15 20:39 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-15 20:39 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-15 20:39 . 2011-02-15 20:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-14 19:49 . 2001-10-24 11:25 26112 -c--a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-02-14 19:48 . 2001-10-25 14:00 13463552 -c--a-w- c:\windows\system32\dllcache\hwxjpn.dll
2011-02-14 19:47 . 2004-08-17 13:49 31232 -c--a-w- c:\windows\system32\dllcache\iisrstas.exe
2011-02-14 19:46 . 2001-10-25 14:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2011-02-14 19:46 . 2001-10-25 14:00 16384 ----a-w- c:\program files\Internet Explorer\Connection Wizard\isignup.exe
2011-02-14 19:43 . 2004-08-17 14:49 153088 ----a-w- c:\windows\system32\irftp.exe
2011-02-14 19:43 . 2004-08-17 14:49 8192 ----a-w- c:\windows\system32\wshirda.dll
2011-02-14 19:43 . 2004-08-17 14:49 26624 ----a-w- c:\windows\system32\irmon.dll
2011-02-14 19:43 . 2004-08-03 22:00 87424 ----a-w- c:\windows\system32\drivers\irda.sys
2011-02-14 19:22 . 2001-08-17 20:51 19584 ----a-w- c:\windows\system32\drivers\rasirda.sys
2011-02-14 19:19 . 2001-10-25 14:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2011-02-14 19:19 . 2001-10-25 14:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-02-14 19:19 . 2001-10-25 14:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2011-02-14 19:19 . 2001-10-25 14:00 13312 ----a-w- c:\windows\system32\irclass.dll
2011-02-14 19:19 . 2004-08-17 14:46 14043 ----a-r- c:\windows\SETE2.tmp
2011-02-14 19:19 . 2004-08-17 14:46 1086058 ----a-r- c:\windows\SETD6.tmp
2011-02-14 19:19 . 2004-08-17 14:50 1014483 ----a-r- c:\windows\SETD3.tmp
2011-02-14 18:54 . 2011-02-14 19:02 -------- d-----w- c:\windows\system32\wbem\Repository.001
2011-02-14 18:52 . 2006-12-28 23:31 19569 ----a-w- c:\windows\000001_.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-23 16:58 . 2010-12-23 16:58 1409 ----a-w- c:\windows\QTFont.for
.

((((((((((((((((((((((((((((( SnapShot@2011-02-15_15.16.38 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-26 16:19 . 2011-02-15 07:15 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-26 16:19 . 2011-02-15 21:37 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-15 21:37 . 2011-02-15 21:37 16384 c:\windows\temp\Perflib_Perfdata_2c4.dat
- 2011-02-15 07:10 . 2011-02-15 07:15 32768 c:\windows\temp\History\History.IE5\MSHist012011021520110216\index.dat
+ 2011-02-15 07:10 . 2011-02-15 21:37 32768 c:\windows\temp\History\History.IE5\MSHist012011021520110216\index.dat
- 2009-07-26 16:19 . 2011-02-15 07:15 49152 c:\windows\temp\History\History.IE5\index.dat
+ 2009-07-26 16:19 . 2011-02-15 21:37 49152 c:\windows\temp\History\History.IE5\index.dat
+ 2009-07-26 16:19 . 2011-02-15 21:37 16384 c:\windows\temp\Cookies\index.dat
- 2009-07-26 16:19 . 2011-02-15 07:15 16384 c:\windows\temp\Cookies\index.dat
+ 2001-10-25 14:00 . 2011-02-15 21:02 79918 c:\windows\system32\perfc009.dat
- 2001-10-25 14:00 . 2011-02-15 07:19 79918 c:\windows\system32\perfc009.dat
+ 2001-10-25 14:00 . 2011-02-15 21:02 92798 c:\windows\system32\perfc005.dat
- 2001-10-25 14:00 . 2011-02-15 07:19 92798 c:\windows\system32\perfc005.dat
+ 2009-07-26 15:50 . 2004-08-17 13:49 82944 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 24576 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 89088 c:\windows\system32\dllcache\cache\rasauto.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 33792 c:\windows\system32\dllcache\cache\msgsvc.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 22016 c:\windows\system32\dllcache\cache\lpk.dll
+ 2009-07-26 15:50 . 2004-08-17 13:45 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-07-26 15:50 . 2004-08-03 21:00 29056 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-07-26 15:50 . 2004-08-17 13:49 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-07-26 15:50 . 2001-10-25 14:00 11776 c:\windows\system32\dllcache\cache\acpiec.sys
+ 2009-07-26 15:50 . 2004-08-17 13:49 5120 c:\windows\system32\dllcache\cache\sfc.dll
+ 2009-07-26 15:50 . 2001-10-25 14:00 2944 c:\windows\system32\dllcache\cache\null.sys
+ 2009-07-26 15:50 . 2001-10-25 14:00 4224 c:\windows\system32\dllcache\cache\beep.sys
+ 2001-10-25 14:00 . 2011-02-15 21:02 483904 c:\windows\system32\perfh009.dat
- 2001-10-25 14:00 . 2011-02-15 07:19 483904 c:\windows\system32\perfh009.dat
+ 2001-10-25 14:00 . 2011-02-15 21:02 479454 c:\windows\system32\perfh005.dat
- 2001-10-25 14:00 . 2011-02-15 07:19 479454 c:\windows\system32\perfh005.dat
+ 2009-07-26 15:50 . 2004-08-17 13:49 111104 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 502272 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 657408 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 577024 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 295936 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-07-26 15:50 . 2004-08-03 21:14 359040 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-07-26 15:50 . 2004-08-17 13:49 170496 c:\windows\system32\dllcache\cache\srsvc.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 108544 c:\windows\system32\dllcache\cache\services.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 395776 c:\windows\system32\dllcache\cache\rpcss.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 435712 c:\windows\system32\dllcache\cache\ntmssvc.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 407040 c:\windows\system32\dllcache\cache\netlogon.dll
+ 2009-07-26 15:50 . 2004-08-03 21:14 182912 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-07-26 15:50 . 2001-10-25 14:00 924432 c:\windows\system32\dllcache\cache\mfc40u.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 982016 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 806912 c:\windows\system32\dllcache\cache\comres.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 611328 c:\windows\system32\dllcache\cache\comctl32.dll
+ 2009-07-26 15:50 . 2004-08-17 13:49 171008 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-07-26 15:50 . 2004-08-17 13:57 142464 c:\windows\system32\dllcache\cache\aec.sys
+ 2009-07-26 15:50 . 2004-08-17 13:49 1548288 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-07-26 15:50 . 2004-08-17 13:45 2183168 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-07-26 15:50 . 2004-08-17 13:57 2059008 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-07-26 15:50 . 2004-08-17 13:49 1032704 c:\windows\system32\dllcache\cache\explorer.exe
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\BS_Player\tbBS_2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-11-11 949376]
"UpdateReminder"="c:\program files\Eset\UpdateReminder.exe" [2010-11-30 434176]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-22 16858112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-17 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 22:34 24576 ----a-w- c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0sprestrt

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Nabídka Start^Programy^Po spuštění^MuchTV Remote.lnk]
backup=c:\windows\pss\MuchTV Remote.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Giraffe^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Giraffe^Nabídka Start^Programy^Po spuštění^Yahoo! Widget Engine.lnk]
backup=c:\windows\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActivControl]
2007-11-09 09:25 1003520 ----a-w- c:\program files\Activ Software\Activdriver\ActivControl2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 21:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-08-03 11:51 202024 ----a-w- c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\change!t]
2007-11-14 19:32 131072 ----a-w- c:\program files\changeit\changeit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-11 20:34 49152 ----a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-11-03 19:53 188416 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-11-16 12:27 172856 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2007-08-04 08:29 1056552 ----a-w- c:\program files\Nero\Nero8\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
2007-03-21 14:41 145496 ----a-w- c:\program files\Pinnacle\Studio 11\LaunchList2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-04-27 07:41 282624 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
2007-08-04 08:30 2043688 ----a-w- c:\program files\Nero\Nero8\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-11 02:19 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
2007-08-24 21:57 36640 ----a-w- c:\program files\SiteAdvisor\6172\SiteAdv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
2006-01-30 16:23 1363968 ----a-w- c:\program files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-01-17 17:27 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-01-15 15:17 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"h:\\Ftp files\\Games playing\\Delta Force Black Hawk Down\\dfbhd.exe"=
"h:\\Ftp files\\Games playing\\Valve\\cstrike.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"h:\\Ftp files\\Games playing\\World of Warcraft TBC\\Launcher.exe"=
"h:\\Ftp files\\Games playing\\World of Warcraft TBC\\Repair.exe"=
"h:\\Ftp files\\Games playing\\wow tbc\\WoW-BurningCrusade-enUS-Installer-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [5.3.2008 19:00 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [5.3.2008 19:00 5248]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [21.3.2005 14:39 270336]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [23.4.2007 12:03 82200]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [11.11.2010 23:45 15424]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [15.1.2009 16:17 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [15.1.2009 16:17 55024]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8.11.2010 23:55 135664]
S3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\system32\drivers\activhidsermini.sys [9.11.2007 9:22 54656]
S3 PhTVTune;MuchTV Plus TVTuner;c:\windows\system32\drivers\PhTVTune.sys [5.3.2008 18:55 24000]
S3 prmvmouse;Promethean HID Mouse Service;c:\windows\system32\DRIVERS\activmouse.sys --> c:\windows\system32\DRIVERS\activmouse.sys [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [27.6.2009 23:02 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [27.6.2009 23:08 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [27.6.2009 23:08 120744]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2.8.2009 19:07 25512]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2.8.2009 18:56 115752]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [15.1.2009 16:17 7408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2011-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 22:54]

2011-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 22:54]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://ivanovfamily.blogspot.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {4F45541D-8104-4422-88FF-E451CE369FE6} = 85.207.76.5,85.207.86.5
FF - ProfilePath - c:\documents and settings\Giraffe\Data aplikací\Mozilla\Firefox\Profiles\l18ua8qo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: FaceMod Dislike Button: {64e8cc5b-20db-4212-8320-178fc5ae71f7} - %profile%\extensions\{64e8cc5b-20db-4212-8320-178fc5ae71f7}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - %profile%\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Abuse for Windows - Full - c:\abuse\uninst.isu
AddRemove-Delta Force - Black Hawk Down - d:\ftp files\games playing\delta force black hawk down\Uninst.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-15 22:38
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-842925246-1336601894-725345543-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="343C99292AFAB2D7DE1FF23AD99836F6427794BE5055A0E8A6AE8656994DC9A04466FCA7F2A04ADB4406A37D89ADD520C59B82254F991B877B1067A3D8263F5C54226ABCD7DCE386393BF1451306BB4BD00D5DC705F1AF4F6384AA7AF2919D823D89FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CC038D530D6EB3452FEBC9E127BECC74C11AD7A8EFC9FDF2316E881117C3215E0D58B9A4A1D5F90DDB9EA137BA5ACB0A986D88A77FD4E99168D9B1C38E3841FF664AC8C48B443BD3539560A7B3EB7A72B309085F82D8ADB5751B6928FFB05D3DD048F56E2FEF7BBD7A49F0FE1757B3E731BCAA20FB5775FE38FCFC397E0066526250623BFA71BD38A4AF334192601F69B1736F90A442B7E4B3A31F1262F49A5737996FDDAE0BA71A640B8EDE1B24876533A338C8F8B31B7AF08D7C5E50B088EFC79FB57815B5EA619DC8695CF7F42865B5DD43A983F09AD4973F5C9D31A6EBA91DFA404584F7E28643DA5E9CA7454168B9EE4CBF19A2428E1B9EFED43089B6A8F2BB3BBD379884E9B42188B0FFED9B6CC5DE069BA5B6C91D9DDDF05D7822400EB207F9CC0995B16690F127EAA8E1F1E1E407623EA43B978A4A413478BBC8F86ADC312A4BC71CE210B0BF72E8219E82690B08CEA48955D90C91A0C502E6DDAA773E22AB8BACA2BB3D1E4E7E7CE16E94CCC5ABA17F09F98B0E38BFE1EDFCE75B3EB0BB9A282EFACB7228930DB9B83CE330BAF4E62D52CA3D2A18AD51596A0449E5C91688E2DB08438F6B0D52047E034A01A64476A3A0FA996486DAEFC1CA31E819B8C100B2B61D7675CCF0FAD07B32CFDDC7359B1B99B493F2DCEDA000F20CE961656BE0F3ED8401B7323476261843ED949186D9F3EAC15B23C0DDEAE60DF17BD4E8EB8F17CF24A49722C9D7FB25FE266E855A17D0A2115FCF3C9767C55B1AB7BD51AF26E53107612212FE7AAAAD50978DBEEC4F932D8C34CE9EB0D3F88693378571D18A77E14BA35DEB22B6C4DFA110BD1EE5CA79E398F72431D4434E8DB4AFE0D8507A092E4FE951B032434F169D23A13A2A0FD0CADDCE8BBCA737935E38101487F524276EFA23F5CB2C2D0453C98CA781A7D558B2302C8A3A7A29306615C116C02C058E3A373DD3B14A9F9C5941E9F72AB936D038A49D15D2A0F6944B652E57341CC13EA74B8C1653EB0C6489818C4806FB8E8A959F166608CAAC5ACC9D0DDE738A4086CD92B601B8F63B6746E2A673C43F34D0C0CB00D374C1CD85206B6F7EA29AA2EA04F7752B3A681A9C4C4F059CCC702058C1CAA7181ACBBB59A5A58D7B093F4E21253BED49668FD668B4A7890F1E253DEDE8E7C62743297533F38FCC302C1CF669FEB16C8C17D0195E9B5C226FCBD0E0E8B67B25254A8EF0F4E1662"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\imon.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Nero\Nero8\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Kerio\Personal Firewall 4\kpf4ss.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\program files\NetLimiter 2 Pro\nlsvc.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\oodag.exe
c:\program files\SiteAdvisor\6172\SAService.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\program files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\windows\system32\wscntfy.exe
c:\program files\NetLimiter 2 Pro\NLClient.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Celkový čas: 2011-02-15 22:43:30 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-15 21:43
ComboFix2.txt 2011-02-15 15:19
ComboFix3.txt 2009-07-26 16:24
ComboFix4.txt 2009-07-26 15:51

Před spuštěním: 9 392 812 032
Po spuštění: 9 332 826 112

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 616030A9E5A1740F277B087F97A6D781

Žádný log mi ho neukázal. Pokud mi prozradíte, v kterém adresáři se nachází (cestu k souboru), napíšu skript, kterým ho CF smaže.

c:\windows\system32\watchdog.sys

Otevřte poznámkový blok a zkopírujte do něj:

File::
c:\windows\system32\watchdog.sys

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkaz ze skriptu.

provedl jsem, vyzkoušel jsem spustit nějaké video na netu a opět modrá obrazovka...viz. obrázek http://tinypic.com/r/rigmy0/7