Zasekávání prohlížeče Mozilla prosím o preventivní prohlídku

[vtmafian]

Dobrý den, mám problém s mozillou, když mám PC zapnutý delší dobu tak se MF začne zasekávat, sou to trhací okamžiky, ale nedělá to hned, až po delší době co ji mám zapnutou. Zkoušel sem přeinstalovat, což nepomohlo,starší verze sem nezkoušel, radši používám aktuální verze. Dřív sem používal operu, ta šla bez problémů, ale zase není kompatibilní se vším, a IE nepoužívám vůbec.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Karel at 2011-11-02 10:43:09
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 86 GB (43%) free of 200 GB
Total RAM: 2046 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:43:22, on 2.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\PixArt\PAP7501\GUCI_AVS.exe
C:\WINDOWS\PixArt\PAP7501\PACTray.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Karel\Plocha\RSIT.exe
C:\Program Files\trend micro\Karel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://search.centrum.cz/index.php?tool ... trum-1.0.0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/?utm_source=tbr_centrum
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.centrum.cz/index.php?tool ... trum-1.0.0
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Karel\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Karel\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [GUCI_AVS] C:\WINDOWS\PixArt\PAP7501\GUCI_AVS.exe
O4 - HKLM\..\Run: [PACTray] C:\WINDOWS\PixArt\PAP7501\PACTray.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_S851.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [California Fonts Loader] "C:\Program Files\California Font Manager\CaliforniaFonts.exe" /scanfolder
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1220945662-1500820517-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1220945662-1500820517-725345543-1006\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\Programy\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Přeložit - {230D1201-7607-4CF6-A11F-9E4BF0A333E0} - E:\Programy\Verdict Free\etnxp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {2C73F784-D2DE-4422-B070-2E3332FE5744} - E:\Programy\Verdict Free\etnxp.dll
O9 - Extra 'Tools' menuitem: Internetový překladač... - {2C73F784-D2DE-4422-B070-2E3332FE5744} - E:\Programy\Verdict Free\etnxp.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0255005765
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 10804 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Karel\Data aplikací\Mozilla\Firefox\Profiles\8a9975xm.default

prefs.js - "browser.startup.homepage" - "http://mail.centrum.cz/"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852]
"Description"=RealMedia Plugin
"Path"=E:\Programy\Real Alternative\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=E:\Programy\Real Alternative\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662]
"Description"=RealPlayer Version Plugin
"Path"=E:\Programy\Real Alternative\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46]
"Description"=6.0.12.46
"Path"=E:\Programy\Real Alternative\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
DTToolbar@toolbarnet.com
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
nsJSRealPlayerPlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
NPOFF12.DLL
nppdf32.dll
nppl3260.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
nprpjplug.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Karel\Data aplikací\Mozilla\Firefox\Profiles\8a9975xm.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Documents and Settings\Karel\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2011-04-25 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-09-21 3853984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-10-18 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-10-18 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-22 368640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-05-01 843776]
"GUCI_AVS"=C:\WINDOWS\PixArt\PAP7501\GUCI_AVS.exe [2007-12-10 323584]
"PACTray"=C:\WINDOWS\PixArt\PAP7501\PACTray.exe [2008-11-14 319488]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-09-06 3722416]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2011-07-05 421888]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-10-08 16744256]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2011-10-08 1632360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EPSON Stylus DX8400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE [2007-04-12 182272]
"California Fonts Loader"=C:\Program Files\California Font Manager\CaliforniaFonts.exe [2011-04-02 631016]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableProfileQuota"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Programy\QIP\qip.exe"="E:\Programy\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"E:\Programy\flashget196en\flashget.exe"="E:\Programy\flashget196en\flashget.exe:*:Enabled:Flashget"
"G:\HRY\Quake 3 Arena\quake3.exe"="G:\HRY\Quake 3 Arena\quake3.exe:*:Enabled:quake3"
"E:\Programy\Opera\opera.exe"="E:\Programy\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"E:\Programy\totalcmd\TOTALCMD.EXE"="E:\Programy\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"G:\HRY\Unreal Tournament 3\Binaries\UT3.exe"="G:\HRY\Unreal Tournament 3\Binaries\UT3.exe:*:Enabled:UT3"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Ubisoft\Heroes 3 Complete\HEROES3.EXE"="C:\Program Files\Ubisoft\Heroes 3 Complete\HEROES3.EXE:*:Enabled:Heroes of Might and Magic® III"
"C:\Program Files\Ubisoft\Heroes 3 Complete\h3wog.exe"="C:\Program Files\Ubisoft\Heroes 3 Complete\h3wog.exe:*:Enabled:Heroes of Might and Magic® III"
"E:\Programy\Skype\Plugin Manager\skypePM.exe"="E:\Programy\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Documents and Settings\Karel\Plocha\UTILIITKY\Uploadery\Megarapid.eu\MegaRapidManager.exe"="C:\Documents and Settings\Karel\Plocha\UTILIITKY\Uploadery\Megarapid.eu\MegaRapidManager.exe:*:Enabled:MegaRapidManager"
"E:\Programy\QIP Infium\infium.exe"="E:\Programy\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"C:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"G:\HRY\Bid For Power\quake3.exe"="G:\HRY\Bid For Power\quake3.exe:*:Disabled:quake3"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"E:\Programy\Pinacle Studio 12\Programs\RM.exe"="E:\Programy\Pinacle Studio 12\Programs\RM.exe:*:Enabled:Render Manager"
"E:\Programy\Pinacle Studio 12\Programs\Studio.exe"="E:\Programy\Pinacle Studio 12\Programs\Studio.exe:*:Enabled:Studio"
"E:\Programy\Pinacle Studio 12\Programs\umi.exe"="E:\Programy\Pinacle Studio 12\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4SERVER.exe"="C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4SERVER.exe:127.0.0.1/255.255.255.255:Enabled:CNC4 emulator"
"C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.exe"="C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.exe:*:Enabled:Command & Conquer™ 4"
"C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game"="C:\Program Files\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game:*:Enabled:Command & Conquer™ 4"
"G:\HRY\Quake III Arena\quake3.exe"="G:\HRY\Quake III Arena\quake3.exe:*:Enabled:quake3"
"C:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe"="C:\Program Files\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe:*:Enabled:Need for Speed(TM) Hot Pursuit"
"C:\Program Files\Quake III Arena\quake3.exe"="C:\Program Files\Quake III Arena\quake3.exe:*:Enabled:quake3"
"E:\Programy\Cam Do\CamDo.exe"="E:\Programy\Cam Do\CamDo.exe:*:Enabled:River Past Cam Do"
"G:\HRY\quake3\quake3.exe"="G:\HRY\quake3\quake3.exe:*:Enabled:quake3"
"E:\INSTALAČKY\HRY\Quake 3 Arena image\Quake3\quake3.exe"="E:\INSTALAČKY\HRY\Quake 3 Arena image\Quake3\quake3.exe:*:Enabled:quake3"
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe"="C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe"="C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher"
"C:\Program Files\Ubisoft\Might & Magic Heroes VI\Might & Magic Heroes VI.exe"="C:\Program Files\Ubisoft\Might & Magic Heroes VI\Might & Magic Heroes VI.exe:*:Enabled:Might & Magic Heroes VI"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux6"=wdmaud.drv
"vidc.mjpg"=pvmjpg30.dll
"VIDC.WMV3"=wmv9vcm.dll
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"msacm.l3fhg"=mp3fhg.acm
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2011-11-02 10:43:10 ----D---- C:\Program Files\trend micro
2011-11-02 10:43:09 ----D---- C:\rsit
2011-10-31 10:01:14 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2011-10-25 11:13:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2011-10-24 23:16:14 ----D---- C:\Program Files\Common Files\Java
2011-10-24 23:15:53 ----A---- C:\WINDOWS\system32\javaws.exe
2011-10-24 23:15:53 ----A---- C:\WINDOWS\system32\javaw.exe
2011-10-24 23:15:53 ----A---- C:\WINDOWS\system32\java.exe
2011-10-13 21:12:24 ----D---- C:\Documents and Settings\Karel\Data aplikací\Might & Magic Heroes VI
2011-10-13 16:21:21 ----D---- C:\Program Files\Ubisoft
2011-10-04 14:39:08 ----D---- C:\Program Files\ESET

======List of files/folders modified in the last 1 month======

2011-11-02 10:43:19 ----D---- C:\Documents and Settings\Karel\Data aplikací\Skype
2011-11-02 10:43:14 ----D---- C:\WINDOWS\Prefetch
2011-11-02 10:43:10 ----RD---- C:\Program Files
2011-11-02 10:00:13 ----D---- C:\WINDOWS\Temp
2011-11-01 21:10:42 ----RD---- C:\Filmy new
2011-11-01 09:49:04 ----D---- C:\WINDOWS\system32
2011-11-01 09:49:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-10-31 20:11:27 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-10-31 10:02:38 ----D---- C:\WINDOWS
2011-10-27 00:54:21 ----D---- C:\WINDOWS\system32\CatRoot2
2011-10-27 00:36:40 ----D---- C:\Program Files\SUPERAntiSpyware
2011-10-26 22:51:08 ----D---- C:\Documents and Settings\Karel\Data aplikací\DAEMON Tools Lite
2011-10-25 15:15:33 ----SHD---- C:\WINDOWS\Installer
2011-10-25 15:15:33 ----D---- C:\WINDOWS\Help
2011-10-25 15:15:00 ----D---- C:\Program Files\NVIDIA Corporation
2011-10-25 15:14:12 ----DC---- C:\WINDOWS\system32\dllcache
2011-10-25 15:14:06 ----D---- C:\WINDOWS\system32\drivers
2011-10-25 15:14:02 ----HD---- C:\WINDOWS\inf
2011-10-25 15:14:01 ----D---- C:\WINDOWS\system32\ReinstallBackups
2011-10-25 10:23:20 ----D---- C:\Program Files\Mozilla Firefox
2011-10-24 23:16:14 ----D---- C:\Program Files\Common Files
2011-10-24 23:15:48 ----D---- C:\Program Files\Java
2011-10-24 21:39:53 ----HD---- C:\Documents and Settings\Karel\Data aplikací\IFViewer
2011-10-24 18:56:06 ----A---- C:\WINDOWS\WTRAN32.INI
2011-10-24 17:32:46 ----D---- C:\Documents and Settings\Karel\Data aplikací\BSplayer
2011-10-23 15:04:53 ----A---- C:\WINDOWS\QIII.INI
2011-10-16 11:23:36 ----SD---- C:\Documents and Settings\Karel\Data aplikací\Microsoft
2011-10-16 00:03:34 ----D---- C:\Documents and Settings\Karel\Data aplikací\NVIDIA
2011-10-14 18:53:36 ----A---- C:\WINDOWS\wincmd.ini
2011-10-14 18:23:24 ----D---- C:\WINDOWS\Logs
2011-10-14 18:23:24 ----D---- C:\WINDOWS\Debug
2011-10-14 12:16:05 ----RSD---- C:\WINDOWS\assembly
2011-10-14 12:16:05 ----D---- C:\WINDOWS\Microsoft.NET
2011-10-14 11:32:59 ----D---- C:\Program Files\California Font Manager
2011-10-13 23:05:57 ----D---- C:\WINDOWS\WinSxS
2011-10-13 23:02:10 ----A---- C:\WINDOWS\system32\MRT.exe
2011-10-13 23:01:47 ----HD---- C:\WINDOWS\$hf_mig$
2011-10-13 23:01:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-10-13 22:59:45 ----D---- C:\Program Files\Internet Explorer
2011-10-13 22:59:28 ----D---- C:\WINDOWS\ie8updates
2011-10-13 21:10:46 ----D---- C:\WINDOWS\system32\DirectX
2011-10-13 21:00:38 ----HD---- C:\Program Files\InstallShield Installation Information
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\OpenCL.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvwddi.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrszht.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrszhc.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrstr.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsth.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrssv.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrssl.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrssk.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsru.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrspt.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrspl.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsno.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsko.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsja.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsit.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrshu.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrshe.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsfr.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrses.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrseng.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsel.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsde.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsda.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrscs.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvrsar.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvmctray.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvgenco32.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvdispco32.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcuda.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcpl.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvcolor.exe
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nvapi.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-10-08 05:50:00 ----A---- C:\WINDOWS\system32\easyupdatusapiu.dll
2011-10-07 07:16:12 ----D---- C:\Program Files\Google
2011-10-03 09:31:24 ----A---- C:\WINDOWS\system32\mshtml.dll
2011-10-03 04:06:03 ----A---- C:\WINDOWS\system32\deployJava1.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 Lbd;Lbd; C:\WINDOWS\system32\DRIVERS\Lbd.sys [2010-08-12 64288]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-30 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]
R1 hwinterface;hwinterface; C:\WINDOWS\System32\Drivers\hwinterface.sys [2010-04-04 3026]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-07-17 16877]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2006-05-22 230400]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-05-17 44544]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-09-14 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-10-08 12791488]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S1 glaide32;glaide32; \??\C:\WINDOWS\system32\drivers\glaide32.sys []
S1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
S3 a5rie4dr;a5rie4dr; C:\WINDOWS\system32\drivers\a5rie4dr.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 esihdrv;esihdrv; \??\C:\DOCUME~1\Karel\LOCALS~1\Temp\esihdrv.sys []
S3 GUCI_AVS;Canyon USB2.0 PC Camera; C:\WINDOWS\system32\DRIVERS\GUCI_AVS.sys [2008-12-05 580992]
S3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Ser2pl;MAT Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-07-16 43264]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-09-06 44768]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-10-03 153376]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2011-10-08 298304]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-08 2253120]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-29 136176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-04-30 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-29 136176]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Zdravím!
Vidím v systému rootkit. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[vtmafian]

Zdravím

log combofixu

ComboFix 11-11-03.01 - Karel 03.11.2011 10:18:59.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1447 [GMT 1:00]
Spuštěný z: c:\documents and settings\Karel\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Karel\WINDOWS
c:\windows\XSxS
.
c:\windows\system32\proquota.exe chyběl.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\proquota.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_glaide32
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-03 do 2011-11-03 )))))))))))))))))))))))))))))))
.
.
2011-11-03 09:31 . 2008-04-14 03:22 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2011-11-03 09:31 . 2008-04-14 03:22 50176 ----a-w- c:\windows\system32\proquota.exe
2011-11-02 09:43 . 2011-11-02 09:43 -------- d-----w- c:\program files\trend micro
2011-10-25 10:13 . 2011-10-25 10:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2011-10-24 22:16 . 2011-10-24 22:16 -------- d-----w- c:\program files\Common Files\Java
2011-10-19 06:56 . 2011-10-19 06:56 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-10-16 10:23 . 2011-10-16 10:23 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Identities
2011-10-15 23:59 . 2011-10-15 23:59 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Temp
2011-10-13 20:12 . 2011-11-02 18:16 -------- d-----w- c:\documents and settings\Karel\Data aplikací\Might & Magic Heroes VI
2011-10-13 15:50 . 2011-10-13 16:37 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Ubisoft Game Launcher
2011-10-13 15:21 . 2011-10-17 21:17 -------- d-----w- c:\program files\Ubisoft
2011-10-04 13:39 . 2011-10-04 13:39 -------- d-----w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-13 08:27 . 2011-08-30 10:30 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-08 04:50 . 2011-09-19 13:26 602432 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-10-08 04:50 . 2011-09-19 13:25 919872 ----a-w- c:\windows\system32\nvdispco32.dll
2011-10-08 04:50 . 2011-09-19 13:25 877376 ----a-w- c:\windows\system32\nvgenco32.dll
2011-10-08 04:50 . 2011-09-19 13:25 65536 ----a-w- c:\windows\system32\OpenCL.dll
2011-10-08 04:50 . 2011-09-19 13:25 2398016 ----a-w- c:\windows\system32\nvcuvid.dll
2011-10-08 04:50 . 2011-09-19 13:25 2099520 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-10-08 04:50 . 2011-09-19 13:25 17240064 ----a-w- c:\windows\system32\nvcompiler.dll
2011-10-08 04:50 . 2009-04-20 19:06 54272 ----a-w- c:\windows\system32\nvwddi.dll
2011-10-08 04:50 . 2009-04-20 19:06 298304 ----a-w- c:\windows\system32\nvsvc32.exe
2011-10-08 04:50 . 2009-04-20 19:06 203072 ----a-w- c:\windows\system32\nvmctray.dll
2011-10-08 04:50 . 2009-04-20 19:06 17956864 ----a-w- c:\windows\system32\nvoglnt.dll
2011-10-08 04:50 . 2009-04-20 19:06 5595136 ----a-w- c:\windows\system32\nvcuda.dll
2011-10-08 04:50 . 2009-04-20 19:06 2449408 ----a-w- c:\windows\system32\nvapi.dll
2011-10-08 04:50 . 2009-04-20 19:06 220992 ----a-w- c:\windows\system32\nvcolor.exe
2011-10-08 04:50 . 2009-04-20 19:06 16744256 ----a-w- c:\windows\system32\nvcpl.dll
2011-10-08 04:50 . 2009-04-20 19:06 4226688 ----a-w- c:\windows\system32\nv4_disp.dll
2011-10-08 04:50 . 2009-04-20 19:06 12791488 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-10-08 04:50 . 2007-09-17 06:07 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-10-08 04:50 . 2007-09-17 06:07 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-10-08 04:50 . 2007-09-17 06:07 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-10-08 04:50 . 2007-09-17 06:07 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-10-08 04:50 . 2007-09-17 06:07 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-10-08 04:50 . 2007-09-17 06:07 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-10-08 04:50 . 2007-09-17 06:07 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-10-08 04:50 . 2007-09-17 06:07 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-10-08 04:50 . 2007-09-17 06:07 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-10-08 04:50 . 2007-09-17 06:07 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-10-08 04:50 . 2007-09-17 06:07 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-10-08 04:50 . 2007-09-17 06:07 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-10-08 04:50 . 2007-09-17 06:07 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-10-08 04:50 . 2007-09-17 06:07 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-10-08 04:50 . 2007-09-17 06:07 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-10-08 04:50 . 2007-09-17 06:07 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-10-08 04:50 . 2007-09-17 06:07 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-10-08 04:50 . 2007-09-17 06:07 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-10-08 04:50 . 2007-09-17 06:07 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-10-08 04:50 . 2007-09-17 06:07 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-10-08 04:50 . 2007-09-17 06:07 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-10-08 04:50 . 2007-09-17 06:07 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-10-08 04:50 . 2007-09-17 06:07 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-10-08 04:50 . 2007-09-17 06:07 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-10-08 04:50 . 2007-09-17 06:07 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-10-08 04:50 . 2007-09-17 06:07 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-10-08 04:50 . 2007-09-17 06:07 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-10-08 04:50 . 2007-09-17 06:07 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-10-03 03:06 . 2011-08-17 15:32 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-03 00:37 . 2011-08-17 15:32 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-09-26 09:41 . 2008-07-29 17:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2004-09-14 20:55 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2004-09-14 20:55 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 2004-09-14 20:49 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 20:45 . 2011-02-08 07:40 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:45 . 2009-11-01 14:49 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-06 20:38 . 2011-06-19 09:54 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2009-11-01 14:49 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2009-11-01 14:49 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2009-11-01 14:49 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2009-11-01 14:49 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2009-11-01 14:49 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2009-11-01 14:49 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2009-11-01 14:49 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-06 14:10 . 2004-09-14 21:02 1858944 ------w- c:\windows\system32\win32k.sys
2011-08-27 09:46 . 2009-09-26 09:23 24576 ----a-w- c:\windows\MadUnInst.exe
2011-08-22 23:41 . 2004-09-14 21:02 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:41 . 2004-09-14 20:51 43520 ------w- c:\windows\system32\licmgr10.dll
2011-08-22 23:41 . 2004-09-14 20:50 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-09-14 20:50 385024 ------w- c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-09-14 20:48 138496 ------w- c:\windows\system32\drivers\afd.sys
2011-09-29 07:07 . 2011-10-25 09:23 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"California Fonts Loader"="c:\program files\California Font Manager\CaliforniaFonts.exe" [2011-04-02 631016]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"GUCI_AVS"="c:\windows\PixArt\PAP7501\GUCI_AVS.exe" [2007-12-10 323584]
"PACTray"="c:\windows\PixArt\PAP7501\PACTray.exe" [2008-11-14 319488]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"e:\\Programy\\Opera\\opera.exe"=
"e:\\Programy\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\Karel\\Plocha\\UTILIITKY\\Uploadery\\Megarapid.eu\\MegaRapidManager.exe"=
"e:\\Programy\\QIP Infium\\infium.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"g:\\HRY\\quake3\\quake3.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"c:\\Program Files\\Ubisoft\\Might & Magic Heroes VI\\Might & Magic Heroes VI.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [26.8.2009 15:53 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.4.2009 21:01 691696]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19.6.2011 10:54 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.11.2009 15:49 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.11.2009 15:49 20568]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [19.9.2011 14:26 2253120]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.SYS --> c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29.9.2011 20:05 136176]
S3 esihdrv;esihdrv;\??\c:\docume~1\Karel\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\Karel\LOCALS~1\Temp\esihdrv.sys [?]
S3 GUCI_AVS;Canyon USB2.0 PC Camera;c:\windows\system32\drivers\GUCI_AVS.sys [25.11.2009 21:48 580992]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [29.9.2011 20:05 136176]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 12:37 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-10-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-29 19:05]
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-29 19:05]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uDefault_Search_URL = hxxp://search.qip.ru
mStart Page = hxxp://www.centrum.cz/?utm_source=tbr_centrum
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:18810
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - e:\programy\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} - e:\programy\Verdict Free\etnxp.dll
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} - e:\programy\Verdict Free\etnxp.dll
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\*
TCP: DhcpNameServer = 10.0.32.132 88.86.107.86
FF - ProfilePath - c:\documents and settings\Karel\Data aplikací\Mozilla\Firefox\Profiles\8a9975xm.default\
FF - prefs.js: browser.startup.homepage - hxxp://mail.centrum.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-ShockWave V0.95 - g:\hry\EA Games\Command & Conquer Generals Zero Hour\Uinst_shw.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-03 10:35
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1220945662-1500820517-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:32,fd,34,3a,09,df,0c,d0,eb,2f,34,b3,c5,ba,5d,4f,20,f5,99,07,e2,9a,19,
d2,ca,a0,36,cb,59,e6,3e,11,d2,6a,0f,a4,7e,85,74,25,92,8d,d4,6b,97,a6,aa,95,\
"??"=hex:56,e9,f7,e8,78,90,1c,6c,51,12,ad,b6,be,2c,84,07
.
[HKEY_USERS\S-1-5-21-1220945662-1500820517-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:5f,d9,1e,9f,ab,c6,85,9e,23,fa,82,ce,55,2f,cf,1d,e3,6f,7f,ea,38,
e9,77,c0,5a,8f,04,04,5f,e6,95,56,6f,d4,cc,d8,b3,51,ac,ab,31,ff,8b,3d,a9,45,\
"rkeysecu"=hex:c5,4d,ad,51,0b,1f,8d,f0,ac,fb,f6,fb,fc,fa,72,61
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(1720)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\RunDLL32.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
.
**************************************************************************
.
Celkový čas: 2011-11-03 10:43:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-03 09:43
.
Před spuštěním: Volných bajtů: 89 989 734 400
Po spuštění: Volných bajtů: 90 324 983 808
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 60DFB554B36BA19AB9850BD6764EF154

[Rudy]

Rootkit odstraněn, zbytek logu vypadá čistý. Nastala nějaká změna?

[vtmafian]

Stále se MF zasekává

[Rudy]

Vyčistěte cache prohlížeče, případně reinstalujte pomocí utility MozBackup: http://www.stahuj.centrum.cz/utility_a_ ... mozbackup/ .

[vtmafian]

Vyčistil sem to a přeinstaloval, uvidí se večer jak se to bude chovat, pak se ozvu
EDIT: Stále se MF trhá

Po combofixu mi zůstaly v PC na C nějaký soubory MSOCache, Qoobox, na dalším disku zas cmdcons a Boot.bak. To můžu bez problémů smazat ?

Ještě tu mám jeden problém se souborem který nelze smazat, zkoušel sem tu po restartu, přes total commander i v nouzovém režimu, ale prostě nejde, soubor není systémový, vlastně má 0 bajtů, je to doplněk do jedné hry GTA SA, ale mám to tam už hodně dlouho, tu hru v PC ani nemám, navíc když chci na něj kliknout dál, tak to napíše "s touto složkou nelze pracovat, cesta je příliš dlouhá" další soubor který tam je, na něj ani kliknout nejde, nic se nestane, když chci mrknout na vlastnosti toho souboru tak to taky nejde, ta položka tam není.
Takhle dlouhá cesta vede k těm dvou souborům:
G:\Plocha\instal\Gamesa cestiny a cracky und maps\MAPY,DOWNLOAD,SAVE\RPG\GTA SA\MODELY\AUTA\Mitsubishi\4\Mitsubishi Lancer Evo8 FnF 3\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl

Nevíte co s tím ?

[Rudy]

1. Vámi uvedené složky můžete smazat. CF odinstalujte Start>spustit>(napsat) combofix /uninstall>OK .
2. S dlouhými názvy je vždycky potíž. Soubor nezabírá žádný prostor (0B), takže ničemu nevadí. Zkuste ho odstranit Avengerem: http://www.viry.cz/forum/viewtopic.php?f=11&t=19832 , do něhož vložte skript:

Files to delete:
G:\Plocha\instal\Gamesa cestiny a cracky und maps\MAPY,DOWNLOAD,SAVE\RPG\GTA SA\MODELY\AUTA\Mitsubishi\4\Mitsubishi Lancer Evo8 FnF 3\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl

a klikněte na >Execute<. PC bude restartován. Pokud by to takto nešlo, musel byste to provést přes konzolu pro zotavení.

[vtmafian]

Já už sem combofix odinstaloval předtím, ale zůstali mi tam právě ty soubory a nevím jestli se něco nepokazí když je normálně odstraním

[Rudy]

Nepokazíte nic. V jsou zálohy toho, co smazal (tedy šmejdy) a ostatní nedořešil odinstalátor. Lze na to také použít T_Cleaner: http://www.ulozto.sk/1378533/t-cleaner-exe . Pozor! Některé antiviry ho poavžují za vir, takže je nutné před použitím vypnout rez. štít.

[vtmafian]

OK děkuji.
To sekání MF se o dost zhoršilo, teď se to trhá víc

[Rudy]

Zkuste na chvíli použít IE, a sledujte, zda bude problém stejný.

[vtmafian]

Zatím bez trhání na obou prohlížečích, jenže taky mám za sebou pár restartů. Zkoušel sem odstranit tu složku avangerem, to nepomohlo, pak sem chtěl ručně smazat ty zálohy z combofixu a to nešlo "přístup byl odepřen" tak sem to taky zkoušel avagerem a nic, na to sem spustil t-cleaner a ten co si smazal, včetně avangeru, ale né ty zálohy cmbofixu.

Pokud by to takto nešlo, musel byste to provést přes konzolu pro zotavení.

To nemám vůbec tušení jak se dělá

[Rudy]

Nabootujte z instal. média a sledujte dolní lištu. Až se poprvé objeví "R-opravit", stiskněte "R". Pak se přihlašte k systému. Pokud je profil Administrator zaheslován, musíte zadat heslo, jinak pouze stiskněte >Enter<. Konzola pro zotavení pracuje v řádkovém režimu, tzn. budete muset natypovat následující příkaz:

del G:\Plocha\instal\Gamesa cestiny a cracky und maps\MAPY,DOWNLOAD,SAVE\RPG\GTA SA\MODELY\AUTA\Mitsubishi\4\Mitsubishi Lancer Evo8 FnF 3\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl\Fast`n`furious.3.Mitsubishi.Lancer.BETA.1.0.by.Djblackpearl

pokud se spletete, nebude to fungovat.

Pak stisknete >Enter< a potvrdíte. Nakonec zadáte příkaz:

exit

a odentrujete. PC se restartuje.

[vtmafian]

Nejsem až tak zkušený co se týče práce s PC "Nabootujte z instal. média " taky nemám tušení jak tohle udělat


Internet explorer se též seká