VIRY.CZ

Zdravím , prosím o kontrolu logu z RSIT

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2012-10-24 08:53:14
Microsoft Windows XP Professional Service Pack 3
System drive C: has 11 GB (38%) free of 30 GB
Total RAM: 1271 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:53:46 AM, on 10/24/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\afwServ.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\TotalCMD\TOTALCMD.EXE
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\My Documents\Downloads\RSIT (1).exe
C:\Program Files\trend micro\admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavi prekladaè - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preloži &oznaèený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preloži &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 9150 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-682003330-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-682003330-1005UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://start.icq.com/"
prefs.js - "extensions.enabledItems" - "{800b5000-a755-47e1-992b-48a1c1357f07}:1.3.3, {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971, {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28"
prefs.js - "keyword.URL" - "http://search.icq.com/search/afe_result ... r=1.4.7&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\Alwil Software\Avast5\WebRep\FF
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.287 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0]
"Description"=DivX® Player Plugin for VOD Content
"Path"=C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35]
"Description"=
"Path"=C:\WINDOWS\system32\npdeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.0.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsILegitCheckPlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
libdivx.dll
np32dsw.dll
npdivx32.dll
npdivx32.xpt
npDivxPlayerPlugin.dll
npLegitCheckPlugin.dll
NPOFF12.DLL
nppdf32.dll
nsIDivxPlayerPlugin.xpt
ShockwavePlugin.class
ssldivx.dll

C:\Program Files\Mozilla Firefox\searchplugins\
amazondotcom.xml
answers.xml
bing.xml
creativecommons.xml
eBay.xml
google.xml
twitter.xml
wikipedia.xml
yahoo.xml

C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{ba14329e-9550-4989-b3f2-9732e92d17cc}

C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default\searchplugins\
icq-search.xml
icqplugin-1.xml
icqplugin-2.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.gif
icqplugin.src
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2009-10-20 503808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-08-28 329712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2012-08-21 1227224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-08-28 59376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-08-28 79856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2009-10-20 503808]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2012-08-21 1227224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Smapp"=C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2003-07-30 143360]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-01-13 131072]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-01-13 163840]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-01-13 135168]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-01-12 32768]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2006-01-12 155648]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"avast"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2012-08-21 4282728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-16 136176]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\admin\Start Menu\Programs\Startup
AutorunsDisabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-01-13 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\TeamViewer\Version7\TeamViewer.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze"
"C:\Program Files\Raptr\raptr.exe"="C:\Program Files\Raptr\raptr.exe:*:Enabled:Raptr Client"
"C:\Program Files\Raptr\raptr_im.exe"="C:\Program Files\Raptr\raptr_im.exe:*:Enabled:Raptr IM"
"C:\Program Files\EasyPHP-12.0\mysql\bin\mysqld.exe"="C:\Program Files\EasyPHP-12.0\mysql\bin\mysqld.exe:*:Enabled:mysqld"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MIDI1"=SYNCOR11.DLL
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.FFDS"=ffdshow.ax
"msacm.ac3filter"=ac3filter.acm
"vidc.XVID"=xvidvfw.dll
"VIDC.ACDV"=ACDV.dll
"VIDC.FPS1"=frapsvid.dll

======List of files/folders created in the last 1 month======

2012-10-08 09:48:11 ----A---- C:\d3d9caps.tmp
2012-10-08 09:34:50 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2012-10-08 09:34:50 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2012-10-08 09:34:50 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2012-10-08 09:34:49 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2012-10-08 09:34:48 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2012-10-08 09:34:47 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2012-10-08 09:34:46 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2012-10-08 09:34:46 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2012-10-08 09:34:45 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2012-10-08 09:34:45 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2012-10-08 09:34:44 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2012-10-08 09:34:44 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2012-10-08 09:34:42 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2012-10-08 09:34:41 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2012-10-08 09:34:40 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2012-10-08 09:34:35 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2012-10-08 09:34:34 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2012-10-08 09:34:32 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2012-10-08 09:34:27 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2012-10-08 09:34:26 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2012-10-08 09:34:25 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2012-10-08 09:34:24 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2012-10-08 09:34:23 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2012-10-08 09:34:23 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2012-10-08 09:34:22 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2012-10-08 09:34:21 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2012-10-08 09:34:20 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2012-10-08 09:34:20 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2012-10-08 09:34:19 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2012-10-08 09:34:17 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2012-10-08 09:34:17 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2012-10-08 09:34:16 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2012-10-08 09:34:15 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2012-10-08 09:34:10 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2012-10-08 09:34:10 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2012-10-08 09:34:09 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2012-10-08 09:34:06 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2012-10-08 09:34:06 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2012-10-08 09:34:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2012-10-08 09:33:59 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2012-10-08 09:33:59 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2012-10-08 09:33:58 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2012-10-08 09:33:57 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2012-10-08 09:33:56 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2012-10-08 09:33:56 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2012-10-08 09:33:55 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2012-10-08 09:33:54 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2012-10-08 09:33:53 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2012-10-08 09:33:53 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2012-10-08 09:33:51 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2012-10-08 09:33:51 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2012-10-08 09:33:50 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2012-10-08 09:33:49 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2012-10-08 09:33:48 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2012-10-08 09:33:47 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2012-10-08 09:33:46 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2012-10-08 09:33:45 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2012-10-08 09:33:44 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2012-10-08 09:33:44 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2012-10-08 09:33:43 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2012-10-08 09:33:42 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2012-10-08 09:33:42 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2012-10-08 09:33:41 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2012-10-08 09:33:41 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2012-10-08 09:33:40 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2012-10-08 09:33:39 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-10-08 09:33:38 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2012-10-08 09:33:36 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2012-10-08 09:33:36 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2012-10-08 09:33:35 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2012-10-08 09:33:34 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2012-10-08 09:33:33 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2012-10-08 09:33:32 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-10-08 09:33:32 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-10-08 09:33:32 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2012-10-08 09:33:31 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-10-08 09:33:30 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-10-08 09:33:30 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-10-08 09:33:29 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-10-08 09:33:29 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-10-08 09:33:29 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-10-08 09:33:24 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-10-08 09:33:23 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-10-08 09:33:23 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-10-08 09:33:22 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-10-08 09:33:21 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-10-08 09:33:21 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-10-08 09:33:20 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-10-08 09:33:19 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-10-08 09:33:18 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-10-08 09:33:16 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-10-08 09:30:00 ----D---- C:\WINDOWS\Logs
2012-10-08 09:26:27 ----D---- C:\Fraps
2012-10-04 11:32:24 ----D---- C:\Program Files\DirectX
2012-10-04 11:08:32 ----A---- C:\WINDOWS\NeroDigital.ini
2012-10-04 11:05:24 ----D---- C:\WINDOWS\RegisteredPackages
2012-10-04 10:57:29 ----D---- C:\Program Files\CamStudio
2012-10-03 09:11:50 ----D---- C:\Documents and Settings\admin\Application Data\vlc
2012-10-03 09:11:40 ----D---- C:\Documents and Settings\admin\Application Data\dvdcss
2012-09-25 07:49:40 ----A---- C:\WINDOWS\system32\javaws.exe
2012-09-25 07:49:40 ----A---- C:\WINDOWS\system32\javaw.exe
2012-09-25 07:49:40 ----A---- C:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 month======

2012-10-24 08:53:46 ----D---- C:\Program Files\trend micro
2012-10-24 08:53:44 ----D---- C:\WINDOWS\system32\Drivers
2012-10-24 08:53:44 ----D---- C:\WINDOWS
2012-10-24 08:53:27 ----D---- C:\Documents and Settings
2012-10-24 08:53:16 ----D---- C:\WINDOWS\Prefetch
2012-10-24 08:50:27 ----A---- C:\WINDOWS\WINCMD.INI
2012-10-24 08:46:38 ----D---- C:\WINDOWS\Temp
2012-10-24 07:44:16 ----D---- C:\WINDOWS\system32
2012-10-24 07:44:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-10-23 15:27:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-10-18 09:03:37 ----SHD---- C:\WINDOWS\Installer
2012-10-17 09:31:46 ----D---- C:\Program Files\ExpressShip
2012-10-09 15:20:31 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-10-08 16:02:26 ----D---- C:\WINDOWS\system32\CatRoot2
2012-10-08 12:38:58 ----D---- C:\Documents and Settings\admin\Application Data\Azureus
2012-10-08 09:34:55 ----D---- C:\WINDOWS\system32\DirectX
2012-10-08 09:34:50 ----HD---- C:\WINDOWS\inf
2012-10-08 09:33:29 ----RSD---- C:\WINDOWS\assembly
2012-10-08 09:33:10 ----D---- C:\WINDOWS\Microsoft.NET
2012-10-04 11:32:24 ----RD---- C:\Program Files
2012-10-04 11:07:08 ----D---- C:\Program Files\Movie Maker
2012-10-04 11:05:34 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-10-01 09:02:18 ----A---- C:\WINDOWS\wcx_ftp.ini
2012-09-28 15:30:18 ----D---- C:\Program Files\Internet Explorer
2012-09-28 15:29:58 ----D---- C:\WINDOWS\ie8updates
2012-09-28 15:28:59 ----HD---- C:\WINDOWS\$hf_mig$
2012-09-25 07:49:32 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswNdis;avast! Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\aswNdis.sys [2012-03-07 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service; C:\WINDOWS\system32\drivers\aswNdis2.sys [2012-08-21 202928]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-10-20 716272]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-08-21 25256]
R1 aswFW;avast! TDI Firewall driver; C:\WINDOWS\system32\drivers\aswFW.sys [2012-08-21 113776]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2012-0

Také zdravím!
Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-682003330-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1801674531-682003330-1005UA.job

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.

Ďakujem veľmi pekne, všetko opäť šlape ako má, pomohol si mi.

OK, to jsem rád. Ještě potřebuji poslední log RSIT.

Tu je ešte log z RSIT

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2012-10-31 11:42:27
Microsoft Windows XP Professional Service Pack 3
System drive C: has 13 GB (45%) free of 30 GB
Total RAM: 1271 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:42:43 AM, on 10/31/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\afwServ.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\TotalCMD\TOTALCMD.EXE
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\admin\My Documents\Downloads\RSIT (1).exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\trend micro\admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavi prekladaè - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preloži &oznaèený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preloži &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 10010 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\avast! Emergency Update.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://start.icq.com/"
prefs.js - "extensions.enabledItems" - "{800b5000-a755-47e1-992b-48a1c1357f07}:1.3.3, {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971, {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28"
prefs.js - "keyword.URL" - "http://search.icq.com/search/afe_result ... r=1.4.7&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\Alwil Software\Avast5\WebRep\FF
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.4.402.287 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=C:\Program Files\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0]
"Description"=DivX® Player Plugin for VOD Content
"Path"=C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37]
"Description"=
"Path"=C:\WINDOWS\system32\npdeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.0.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsILegitCheckPlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
libdivx.dll
np32dsw.dll
npdivx32.dll
npdivx32.xpt
npDivxPlayerPlugin.dll
npLegitCheckPlugin.dll
NPOFF12.DLL
nppdf32.dll
nsIDivxPlayerPlugin.xpt
ShockwavePlugin.class
ssldivx.dll

C:\Program Files\Mozilla Firefox\searchplugins\
amazondotcom.xml
answers.xml
bing.xml
creativecommons.xml
eBay.xml
google.xml
twitter.xml
wikipedia.xml
yahoo.xml

C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default\extensions\
{800b5000-a755-47e1-992b-48a1c1357f07}
{ba14329e-9550-4989-b3f2-9732e92d17cc}

C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\taw3bd1h.default\searchplugins\
icq-search.xml
icqplugin-1.xml
icqplugin-2.xml
icqplugin-3.xml
icqplugin-4.xml
icqplugin-5.xml
icqplugin-6.xml
icqplugin-7.xml
icqplugin-8.xml
icqplugin-9.xml
icqplugin.gif
icqplugin.src
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2009-10-20 503808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-09-24 329712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2012-10-23 1227224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-09-24 59376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-09-24 79856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2009-10-20 503808]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2012-10-23 1227224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Smapp"=C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2003-07-30 143360]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-01-13 131072]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-01-13 163840]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-01-13 135168]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-01-12 32768]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2006-01-12 155648]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-27 919008]
"avast"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2012-10-23 4297136]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-09-17 254896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-16 136176]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\admin\Start Menu\Programs\Startup
AutorunsDisabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-01-13 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\TeamViewer\Version7\TeamViewer.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze"
"C:\Program Files\Raptr\raptr.exe"="C:\Program Files\Raptr\raptr.exe:*:Enabled:Raptr Client"
"C:\Program Files\Raptr\raptr_im.exe"="C:\Program Files\Raptr\raptr_im.exe:*:Enabled:Raptr IM"
"C:\Program Files\EasyPHP-12.0\mysql\bin\mysqld.exe"="C:\Program Files\EasyPHP-12.0\mysql\bin\mysqld.exe:*:Enabled:mysqld"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MIDI1"=SYNCOR11.DLL
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.FFDS"=ffdshow.ax
"msacm.ac3filter"=ac3filter.acm
"vidc.XVID"=xvidvfw.dll
"VIDC.ACDV"=ACDV.dll
"VIDC.FPS1"=frapsvid.dll

======List of files/folders created in the last 1 month======

2012-10-29 09:29:12 ----D---- C:\Program Files\Common Files\Java
2012-10-29 07:48:18 ----A---- C:\WINDOWS\system32\javaws.exe
2012-10-29 07:48:17 ----A---- C:\WINDOWS\system32\javaw.exe
2012-10-29 07:48:17 ----A---- C:\WINDOWS\system32\java.exe
2012-10-08 08:34:50 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2012-10-08 08:34:50 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2012-10-08 08:34:50 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2012-10-08 08:34:49 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2012-10-08 08:34:48 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2012-10-08 08:34:47 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2012-10-08 08:34:46 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2012-10-08 08:34:46 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2012-10-08 08:34:45 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2012-10-08 08:34:45 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2012-10-08 08:34:44 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2012-10-08 08:34:44 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2012-10-08 08:34:42 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2012-10-08 08:34:41 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2012-10-08 08:34:40 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2012-10-08 08:34:35 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2012-10-08 08:34:34 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2012-10-08 08:34:32 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2012-10-08 08:34:27 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2012-10-08 08:34:26 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2012-10-08 08:34:25 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2012-10-08 08:34:24 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2012-10-08 08:34:23 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2012-10-08 08:34:23 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2012-10-08 08:34:22 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2012-10-08 08:34:21 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2012-10-08 08:34:20 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2012-10-08 08:34:20 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2012-10-08 08:34:19 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2012-10-08 08:34:17 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2012-10-08 08:34:17 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2012-10-08 08:34:16 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2012-10-08 08:34:15 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2012-10-08 08:34:10 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2012-10-08 08:34:10 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2012-10-08 08:34:09 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2012-10-08 08:34:06 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2012-10-08 08:34:06 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2012-10-08 08:34:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2012-10-08 08:33:59 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2012-10-08 08:33:59 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2012-10-08 08:33:58 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2012-10-08 08:33:57 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2012-10-08 08:33:56 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2012-10-08 08:33:56 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2012-10-08 08:33:55 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2012-10-08 08:33:54 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2012-10-08 08:33:53 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2012-10-08 08:33:53 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2012-10-08 08:33:51 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2012-10-08 08:33:51 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2012-10-08 08:33:50 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2012-10-08 08:33:49 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2012-10-08 08:33:48 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2012-10-08 08:33:47 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2012-10-08 08:33:46 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2012-10-08 08:33:45 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2012-10-08 08:33:44 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2012-10-08 08:33:44 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2012-10-08 08:33:43 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2012-10-08 08:33:42 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2012-10-08 08:33:42 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2012-10-08 08:33:41 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2012-10-08 08:33:41 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2012-10-08 08:33:40 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2012-10-08 08:33:39 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-10-08 08:33:38 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2012-10-08 08:33:36 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2012-10-08 08:33:36 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2012-10-08 08:33:35 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2012-10-08 08:33:34 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2012-10-08 08:33:33 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2012-10-08 08:33:32 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-10-08 08:33:32 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-10-08 08:33:32 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2012-10-08 08:33:31 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-10-08 08:33:30 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-10-08 08:33:30 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-10-08 08:33:29 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-10-08 08:33:29 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-10-08 08:33:29 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-10-08 08:33:24 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-10-08 08:33:23 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-10-08 08:33:23 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-10-08 08:33:22 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-10-08 08:33:21 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-10-08 08:33:21 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-10-08 08:33:20 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-10-08 08:33:19 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-10-08 08:33:18 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-10-08 08:33:16 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-10-08 08:30:00 ----D---- C:\WINDOWS\Logs
2012-10-08 08:26:27 ----D---- C:\Fraps
2012-10-04 10:32:24 ----D---- C:\Program Files\DirectX
2012-10-04 10:08:32 ----A---- C:\WINDOWS\NeroDigital.ini
2012-10-04 10:05:24 ----D---- C:\WINDOWS\RegisteredPackages
2012-10-04 09:57:29 ----D---- C:\Program Files\CamStudio
2012-10-03 08:11:50 ----D---- C:\Documents and Settings\admin\Application Data\vlc
2012-10-03 08:11:40 ----D---- C:\Documents and Settings\admin\Application Data\dvdcss

======List of files/folders modified in the last 1 month======

2012-10-31 11:42:34 ----D---- C:\WINDOWS\Prefetch
2012-10-31 11:42:34 ----D---- C:\Program Files\trend micro
2012-10-31 11:07:12 ----D---- C:\WINDOWS\Temp
2012-10-31 09:30:59 ----A---- C:\WINDOWS\WINCMD.INI
2012-10-31 08:00:26 ----D---- C:\WINDOWS\system32
2012-10-31 08:00:26 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-10-30 15:32:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-10-30 15:32:09 ----D---- C:\WINDOWS\system32\CatRoot2
2012-10-30 10:38:48 ----HD---- C:\WINDOWS\inf
2012-10-29 09:29:14 ----SHD---- C:\WINDOWS\Installer
2012-10-29 09:29:12 ----D---- C:\Program Files\Common Files
2012-10-29 07:48:12 ----D---- C:\Program Files\Java
2012-10-26 13:50:45 ----D---- C:\Program Files\ExpressShip
2012-10-26 08:23:20 ----A---- C:\WINDOWS\wcx_ftp.ini
2012-10-25 07:59:24 ----SD---- C:\WINDOWS\Tasks
2012-10-24 07:56:03 ----D---- C:\WINDOWS
2012-10-23 11:17:38 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-10-09 14:20:31 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-10-08 11:38:58 ----D---- C:\Documents and Settings\admin\Application Data\Azureus
2012-10-08 08:34:55 ----D---- C:\WINDOWS\system32\DirectX
2012-10-08 08:33:29 ----RSD---- C:\WINDOWS\assembly
2012-10-08 08:33:10 ----D---- C:\WINDOWS\Microsoft.NET
2012-10-04 10:32:24 ----RD---- C:\Program Files
2012-10-04 10:07:08 ----D---- C:\Program Files\Movie Maker
2012-10-04 10:05:34 ----RSHDC---- C:\WINDOWS\system32\dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswNdis;avast! Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\aswNdis.sys [2012-03-06 12112]
R0 aswNdis

Dvouklikem na soubor C:\Program Files\trend micro\admin.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)

Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.