VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Radek at 2014-04-04 23:02:06
Systém Microsoft Windows XP Professional Service Pack 3
System drive E: has 225 GB (74%) free of 305 GB
Total RAM: 2014 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:02:11, on 4.4.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
E:\Program Files\Application Updater\ApplicationUpdater.exe
E:\Program Files\Intel\AMT\LMS.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Radek\Dokumenty\Downloads\RSIT.exe
E:\Program Files\trend micro\Radek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?rlz=1W4CHBA_csCZ570
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "E:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - E:\Program Files\pdfforge Toolbar\IE\8.9\pdfforgeToolbarIE.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - E:\Program Files\pdfforge Toolbar\IE\8.9\pdfforgeToolbarIE.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - E:\Program Files\pdfforge Toolbar\IE\8.9\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SearchSettings] "E:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9240389625
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: e:\progra~1\movies~1\datamngr\mgrldr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Application Updater - Spigot, Inc. - E:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Active Management Technology LMS Service (LMS) - Intel - E:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Torch Crash Handler (TorchCrashHandler) - Unknown owner - E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Update\TorchCrashHandler.exe (file missing)

--
End of file - 7496 bytes

======Scheduled tasks folder======

E:\WINDOWS\tasks\Adobe Flash Player Updater.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
E:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
E:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
pdfforge Toolbar - E:\Program Files\pdfforge Toolbar\IE\8.9\pdfforgeToolbarIE.dll [2014-03-17 1398592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B922D405-6D13-4A2B-AE89-08A030DA4402} - pdfforge Toolbar - E:\Program Files\pdfforge Toolbar\IE\8.9\pdfforgeToolbarIE.dll [2014-03-17 1398592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=E:\WINDOWS\RTHDCPL.EXE [2012-06-06 20065936]
"NeroFilterCheck"=E:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"TrueImageMonitor.exe"=E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2006-10-19 1183656]
"AcronisTimounterMonitor"=E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2006-10-19 1958800]
"Acronis Scheduler2 Service"=E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2006-10-17 87584]
"GrooveMonitor"=E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
""= []
"SearchSettings"=E:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe [2014-03-17 1393984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=E:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=E:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Zoner Photo Studio Autoupdate"=E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE [2013-06-07 774680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="e:\progra~1\movies~1\datamngr\mgrldr.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
E:\WINDOWS\system32\Ati2evxx.dll [2005-05-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
E:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\Attractel\Zoiper\Zoiper.exe"="E:\Program Files\Attractel\Zoiper\Zoiper.exe:*:Enabled:Zoiper"
"E:\Program Files\ICQ7.7\ICQ.exe"="E:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"E:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="E:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"E:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="E:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"E:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="E:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.050\winbox.exe"="E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.050\winbox.exe:*:Enabled:winbox"
"E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.410\winbox.exe"="E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.410\winbox.exe:*:Enabled:winbox"
"C:\ntb\winbox.exe"="C:\ntb\winbox.exe:*:Enabled:winbox"
"E:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtuser.exe"="E:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtuser.exe:*:Enabled:Movies Toolbar (Dist. by Bandoo Media, Inc.) DTX Broker"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe:*:Enabled:Torch"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe:*:Enabled:hola_plugin.exe"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe:*:Enabled:hola_plugin_x64.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\ICQ7.7\ICQ.exe"="E:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe:*:Enabled:Torch"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe:*:Enabled:hola_plugin.exe"
"E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe"="E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe:*:Enabled:hola_plugin_x64.exe"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe]
"Debugger="tasklist.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=E:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=E:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.DIVX"=divx.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2014-04-04 23:02:06 ----D---- E:\rsit
2014-03-22 11:51:10 ----HDC---- E:\WINDOWS\$NtUninstallKB2934207$
2014-03-22 10:45:52 ----N---- E:\WINDOWS\system32\xp_eos.exe
2014-03-20 14:31:17 ----D---- E:\Program Files\Application Updater
2014-03-20 14:31:16 ----D---- E:\Program Files\pdfforge Toolbar
2014-03-20 14:31:16 ----D---- E:\Program Files\Common Files\Spigot
2014-03-20 14:31:12 ----SHD---- E:\Config.Msi
2014-03-12 16:29:54 ----HDC---- E:\WINDOWS\$NtUninstallKB2929961$
2014-03-12 16:29:50 ----HDC---- E:\WINDOWS\$NtUninstallKB2930275$
2014-03-12 16:14:08 ----A---- E:\WINDOWS\system32\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2014-04-04 23:02:09 ----D---- E:\Program Files\trend micro
2014-04-04 22:59:00 ----D---- E:\WINDOWS\Prefetch
2014-04-04 22:57:50 ----D---- E:\WINDOWS\Temp
2014-04-04 22:57:50 ----D---- E:\WINDOWS
2014-04-04 22:04:21 ----D---- E:\Documents and Settings\All Users\Data aplikací\TorchCrashHandler
2014-04-04 22:03:09 ----D---- E:\WINDOWS\system32\CatRoot2
2014-04-04 22:02:17 ----A---- E:\WINDOWS\system32\log.txt
2014-04-04 15:30:34 ----N---- E:\WINDOWS\SchedLgU.Txt
2014-03-30 23:03:44 ----D---- E:\WINDOWS\Debug
2014-03-30 22:22:06 ----D---- E:\WINDOWS\system32
2014-03-30 22:22:06 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI
2014-03-28 23:27:02 ----SHD---- E:\WINDOWS\Installer
2014-03-28 22:22:14 ----RD---- E:\Program Files
2014-03-28 15:26:57 ----A---- E:\WINDOWS\NeroDigital.ini
2014-03-22 17:00:07 ----SD---- E:\WINDOWS\Tasks
2014-03-22 11:51:12 ----HD---- E:\WINDOWS\inf
2014-03-22 11:51:11 ----RSHDC---- E:\WINDOWS\system32\dllcache
2014-03-20 14:31:16 ----D---- E:\Program Files\Common Files
2014-03-18 12:29:25 ----A---- E:\WINDOWS\system32\MRT.exe
2014-03-12 16:30:09 ----D---- E:\Program Files\Internet Explorer
2014-03-12 16:29:31 ----D---- E:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2014-03-12 16:14:09 ----A---- E:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 snapman;Acronis Snapshots Manager; E:\WINDOWS\system32\DRIVERS\snapman.sys [2013-05-23 114048]
R0 timounter;Acronis True Image Backup Archive Explorer; E:\WINDOWS\system32\DRIVERS\timntr.sys [2013-05-23 395744]
R1 intelppm;Řadič procesoru Intel; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; E:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R2 tifsfilter;Acronis True Image FS Filter; E:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2013-05-23 39264]
R3 ati2mtag;ati2mtag; E:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-05-04 1133056]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; E:\WINDOWS\system32\DRIVERS\e1k5132.sys [2008-06-05 144480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; E:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); E:\WINDOWS\system32\drivers\RtkHDAud.sys [2012-06-19 6141584]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; E:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-14 12288]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; E:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 gdrv;gdrv; \??\E:\WINDOWS\gdrv.sys []
S3 Monfilt;Monfilt; E:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); E:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Pomocná služba protokolu IPv6; E:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 AcrSch2Svc;Acronis Scheduler2 Service; E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2006-10-17 230944]
R2 Application Updater;Application Updater; E:\Program Files\Application Updater\ApplicationUpdater.exe [2014-03-17 807800]
R2 Ati HotKey Poller;Ati HotKey Poller; E:\WINDOWS\system32\Ati2evxx.exe [2005-05-04 364544]
R2 LMS;Intel(R) Active Management Technology LMS Service; E:\Program Files\Intel\AMT\LMS.exe [2006-06-28 98304]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 ATI Smart;ATI Smart; E:\WINDOWS\system32\ati2sgag.exe [2005-05-03 516096]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-22 136176]
S2 TorchCrashHandler;Torch Crash Handler; E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Update\TorchCrashHandler.exe []
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12 257928]
S3 aspnet_state;ASP.NET State Service; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-22 136176]
S3 idsvc;Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; E:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; E:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Diky

Zdravim

Vidim tam nakazu. Ale nevidim antivir. Proc? Cistit nezabezpeceny pocitac je zbytecne


Udelejte !!!kompletni!!! kontrolu s MBAM http://forum.viry.cz/viewtopic.php?f=29&t=115222 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

zdravim, diky. Doporucenyprogram bohuzel nejde naistalvoat. Pri instalaci to hazi nekolik chybovych hlaseni"runtime error" atd.

Peky

Zkuste tento http://www.stahuj.centrum.cz/utility_a_ ... i-malware/

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.04.05.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Radek :: ZUZKA [administrátor]

Ochrana: Povolena

5.4.2014 9:46:30
MBAM-log-2014-04-05 (12-05-43).txt

Typ: Kompletní kontrola (E:\|G:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 354413
Uplynulý čas: 1 hodin, 7 minut, 6 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} (PUP.Optional.Datamngr.A) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 15
E:\Software\Vypalování\Clone\clonedvd-2-9-1-9-final-full-keygen-cz.rar (Trojan.Downloader) -> Nebyla provedena žádná instrukce.
E:\Software\Vypalování\Clone\clonedvd-2-9-1-9-final-full-keygen-cz\CloneDVD.2.9.1.9.Final.Full+keygen (CZ)\Keygen.exe (Trojan.Downloader) -> Nebyla provedena žádná instrukce.
E:\Software\Vypalování\Clone\clonedvd-2-9-1-9-final-full-keygen-cz\CloneDVD.2.9.1.9.Final.Full+keygen (CZ)\SND\CloneDVD2Keygen.exe (Trojan.Downloader) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP129\A0024990.exe (PUP.Optional.MyWebSearch) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025633.exe (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025635.exe (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025636.dll (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025638.dll (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025936.exe (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025938.exe (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025939.dll (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0025942.dll (PUP.Optional.Bandoo.A) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0026059.exe (PUP.Optional.Bandoo) -> Nebyla provedena žádná instrukce.
E:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP135\A0026072.exe (PUP.Optional.MoviesToolBar.A) -> Nebyla provedena žádná instrukce.
G:\System Volume Information\_restore{10B2BCB4-DB1C-4E85-B30B-A50C845AD39B}\RP153\A0028242.exe (PUP.Optional.MyWebSearch) -> Nebyla provedena žádná instrukce.

(konec)

Postupujte presne v tomto poradi.
1) MBAM nezavirejte, jen minimalizujte.
2) Vymazte/Vypnete vytvareni bodu obnovy http://forum.viry.cz/viewtopic.php?f=46&t=47040 , ale nerestartujte pc.
3) Ted nechte nalezy MBAM odstranit a restartujte pc.
4) Udelejte novy test s MBAM a dejte sem vysledky.

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.04.05.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Radek :: ZUZKA [administrátor]

Ochrana: Povolena

5.4.2014 21:30:52
mbam-log-2014-04-05 (21-30-52).txt

Typ: Kompletní kontrola (E:\|G:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 347472
Uplynulý čas: 1 hodin, 4 minut, 21 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 3
E:\RECYCLER\S-1-5-21-1214440339-884357618-682003330-1004\De9.rar (Trojan.Downloader) -> Přesun do karantény a smazání se zdařilo.
E:\RECYCLER\S-1-5-21-1214440339-884357618-682003330-1004\De10\CloneDVD.2.9.1.9.Final.Full+keygen (CZ)\Keygen.exe (Trojan.Downloader) -> Přesun do karantény a smazání se zdařilo.
E:\RECYCLER\S-1-5-21-1214440339-884357618-682003330-1004\De10\CloneDVD.2.9.1.9.Final.Full+keygen (CZ)\SND\CloneDVD2Keygen.exe (Trojan.Downloader) -> Přesun do karantény a smazání se zdařilo.

(konec)

3 neradi smazani (pred tim jsem dva rucne smazal z adresare SW)

MBAM odinstalujte.

Pokud jste to jeste neudelal, zapnete zase funkci vytvareni bodu obnovy.

Co s tim antivirem?


Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe , ulozte ho na plochu a spustte.
Probehne kratoucky testik a pak se zpristupni vpravo nahore tlacitko Prohledat. Na to kliknete a probehne dalsi test.
Po dokonceni kliknete na napis Zprava a objevi se log. Ten mi sem vlozte

pouzval jsem AVGecko a Avast, nikdy nic nenasli tak jsem to dal pryc. Co by jste mohl doporucit ?

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Radek [Práva správce]
Mód : Kontrola -- Datum : 04/06/2014 08:56:00
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 27 ¤¤¤
[IFEO] HKLM\[...]\bitguard.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\bprotect.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\bpsvc.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\browsemngr.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\browserdefender.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\browsermngr.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\browserprotect.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\browsersafeguard.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\bundlesweetimsetup.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\cltmngsvc.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\delta babylon.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\delta tb.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\delta2.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\deltainstaller.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\deltasetup.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\deltatb.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\deltatb_2501-c733154b.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\iminentsetup.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\protectedsearch.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\rjatydimofu.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\searchprotection.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\snapdo.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\stinst32.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\stinst64.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\sweetimsetup.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[IFEO] HKLM\[...]\tbdelta.exetoolbar783881609.exe : Debugger (tasklist.exe [7]) -> NALEZENO
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Browser Addons : 1 ¤¤¤
[IE][PUP] System : pdfforge Toolbar

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : PUP ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD1600AABB-56PUA0 +++++
--- User ---
[MBR] c8da19a6f76448ce046e8a8ea65e30c1
[BSP] aecf3142531cf5a55e88173af3cdb37d : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 MB
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) ST3320620AS +++++
--- User ---
[MBR] 215bb45419a620ccf3b8d51e3937088b
[BSP] b90567c5ca1298545b3e1a1d337e1b85 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 MB
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_04062014_085600.txt >>

Avast free je fajn, sam ho taky pouzivam. Tak jej nainstalujte.


Znovu spustte RogueKiller (pokud jste ho jeste nezavrel/a, rovnou kliknete na napis Smazat)
Probehne kratoucky testik a pak se zpristupni vpravo nahore tlacitko Prohledat. Na to kliknete a probehne dalsi test.
Po dokonceni kliknete na napis Smazat.
Pak kliknete na napis Zprava a objevi se log. Ten mi sem vlozte.
Pak kliknete na napis Oprava Host a Zprava.
Objevi se dalsi log. I ten mi sem vlozte.

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Radek [Práva správce]
Mód : Kontrola -- Datum : 04/06/2014 09:06:05
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Browser Addons : 1 ¤¤¤
[IE][PUP] System : pdfforge Toolbar

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : PUP ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD1600AABB-56PUA0 +++++
--- User ---
[MBR] c8da19a6f76448ce046e8a8ea65e30c1
[BSP] aecf3142531cf5a55e88173af3cdb37d : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 MB
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) ST3320620AS +++++
--- User ---
[MBR] 215bb45419a620ccf3b8d51e3937088b
[BSP] b90567c5ca1298545b3e1a1d337e1b85 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 MB
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_04062014_090605.txt >>
RKreport[0]_D_04062014_090442.txt



oprava host

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Radek [Práva správce]
Mód : Oprava HOSTS -- Datum : 04/06/2014 09:07:27
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 0 ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : PUP ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Resetovaný HOSTS: ¤¤¤
127.0.0.1 localhost


Dokončeno : << RKreport[0]_H_04062014_090727.txt >>
RKreport[0]_D_04062014_090442.txt;RKreport[0]_S_04062014_090605.txt

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Spustte ho.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Clean
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner [S?].txt ). Ten mi sem zkopirujte.

# AdwCleaner v3.023 - Report created 06/04/2014 at 09:12:41
# Updated 01/04/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Radek - ZUZKA
# Running from : E:\Documents and Settings\Radek\Plocha\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : Application Updater
[#] Service Deleted : torchcrashhandler

***** [ Files / Folders ] *****

Folder Deleted : E:\Documents and Settings\All Users\Data aplikací\ICQ\ICQToolbar
Folder Deleted : E:\Documents and Settings\All Users\Data aplikací\torchcrashhandler
Folder Deleted : E:\Program Files\Application Updater
Folder Deleted : E:\Program Files\ICQ6Toolbar
Folder Deleted : E:\Program Files\pdfforge Toolbar
Folder Deleted : E:\Program Files\Common Files\Spigot
Folder Deleted : E:\Documents and Settings\LocalService\Local Settings\Data aplikací\torch
Folder Deleted : E:\Documents and Settings\Zuzka\Local Settings\Data aplikací\torch
Folder Deleted : E:\Documents and Settings\Zuzka\Data aplikací\pdfforge
Folder Deleted : E:\Documents and Settings\Zuzka\Data aplikací\Search Settings
Folder Deleted : E:\Documents and Settings\Zuzka\Nabídka Start\Programy\torch
Folder Deleted : E:\Documents and Settings\Radek\Local Settings\Data aplikací\torch
Folder Deleted : E:\Documents and Settings\Radek\Data aplikací\pdfforge
Folder Deleted : E:\Documents and Settings\Radek\Data aplikací\Search Settings
Folder Deleted : E:\Documents and Settings\Radek\Data aplikací\searchresultstb

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\iLivid.torrent
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings]
Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [E:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtuser.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Application\torch.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [E:\Documents and Settings\Radek\Local Settings\Data aplikací\Torch\Plugins\Hola\hola_plugin_x64.exe]
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\pdfforge
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKCU\Software\smarttweak
Key Deleted : HKCU\Software\torch
Key Deleted : HKCU\Software\AppDataLow\Software\pdfforge
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKLM\Software\Application Updater
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\ICQ\ICQToolbar
Key Deleted : HKLM\Software\pdfforge
Key Deleted : HKLM\Software\Search Settings
Key Deleted : HKLM\Software\torch
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\30C16B15B255BD349A1157B8A83E2AF9
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1CAE30F47D14B41B5FC8FA53658044

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Google Chrome v33.0.1750.154

[ File : E:\Documents and Settings\Zuzka\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]


[ File : E:\Documents and Settings\Radek\Local Settings\Data aplikací\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [8299 octets] - [06/04/2014 09:12:01]
AdwCleaner[S0].txt - [8249 octets] - [06/04/2014 09:12:41]

########## EOF - E:\AdwCleaner\AdwCleaner[S0].txt - [8309 octets] ##########

Dejte novy log z RSIT

Logfile of random's system information tool 1.09 (written by random/random)
Run by Radek at 2014-04-06 09:18:27
Systém Microsoft Windows XP Professional Service Pack 3
System drive E: has 227 GB (74%) free of 305 GB
Total RAM: 2014 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:18:31, on 6.4.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
E:\Program Files\Intel\AMT\LMS.exe
E:\WINDOWS\RTHDCPL.EXE
E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
E:\Program Files\Outlook Express\msimn.exe
E:\Documents and Settings\Radek\Local Settings\Temporary Internet Files\Content.IE5\7OEOMZYK\RSIT[1].exe
E:\Program Files\trend micro\Radek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/?rlz=1W4CHBA_csCZ570
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "E:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Program Files\ICQ7.7\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9240389625
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: e:\progra~1\movies~1\datamngr\mgrldr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - E:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Active Management Technology LMS Service (LMS) - Intel - E:\Program Files\Intel\AMT\LMS.exe

--
End of file - 6666 bytes

======Scheduled tasks folder======

E:\WINDOWS\tasks\Adobe Flash Player Updater.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
E:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
E:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=E:\WINDOWS\RTHDCPL.EXE [2012-06-06 20065936]
"NeroFilterCheck"=E:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"TrueImageMonitor.exe"=E:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2006-10-19 1183656]
"AcronisTimounterMonitor"=E:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2006-10-19 1958800]
"Acronis Scheduler2 Service"=E:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2006-10-17 87584]
"GrooveMonitor"=E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
""= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=E:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=E:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Zoner Photo Studio Autoupdate"=E:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTRAY.EXE [2013-06-07 774680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="e:\progra~1\movies~1\datamngr\mgrldr.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
E:\WINDOWS\system32\Ati2evxx.dll [2005-05-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
E:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\Attractel\Zoiper\Zoiper.exe"="E:\Program Files\Attractel\Zoiper\Zoiper.exe:*:Enabled:Zoiper"
"E:\Program Files\ICQ7.7\ICQ.exe"="E:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"
"E:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="E:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"E:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="E:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"E:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="E:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.050\winbox.exe"="E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.050\winbox.exe:*:Enabled:winbox"
"E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.410\winbox.exe"="E:\Documents and Settings\Radek\Local Settings\Temp\Rar$EXa0.410\winbox.exe:*:Enabled:winbox"
"C:\ntb\winbox.exe"="C:\ntb\winbox.exe:*:Enabled:winbox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\ICQ7.7\ICQ.exe"="E:\Program Files\ICQ7.7\ICQ.exe:*:Enabled:ICQ7.7"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=E:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=E:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.DIVX"=divx.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2014-04-06 09:18:27 ----D---- E:\rsit
2014-04-06 09:11:57 ----D---- E:\AdwCleaner
2014-04-05 09:44:24 ----D---- E:\Documents and Settings\Radek\Data aplikací\Malwarebytes
2014-04-05 09:31:10 ----D---- E:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2014-03-22 11:51:10 ----HDC---- E:\WINDOWS\$NtUninstallKB2934207$
2014-03-22 10:45:52 ----N---- E:\WINDOWS\system32\xp_eos.exe
2014-03-20 14:31:12 ----SHD---- E:\Config.Msi
2014-03-12 16:29:54 ----HDC---- E:\WINDOWS\$NtUninstallKB2929961$
2014-03-12 16:29:50 ----HDC---- E:\WINDOWS\$NtUninstallKB2930275$
2014-03-12 16:14:08 ----A---- E:\WINDOWS\system32\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2014-04-06 09:18:29 ----D---- E:\Program Files\trend micro
2014-04-06 09:17:41 ----D---- E:\WINDOWS\Prefetch
2014-04-06 09:14:35 ----D---- E:\WINDOWS\system32\CatRoot2
2014-04-06 09:14:12 ----A---- E:\WINDOWS\system32\log.txt
2014-04-06 09:13:13 ----A---- E:\WINDOWS\SchedLgU.Txt
2014-04-06 09:12:53 ----D---- E:\WINDOWS\system32
2014-04-06 09:12:43 ----RD---- E:\Program Files
2014-04-06 09:06:04 ----D---- E:\WINDOWS\system32\drivers
2014-04-06 08:53:58 ----SHD---- E:\System Volume Information
2014-04-06 08:53:58 ----D---- E:\WINDOWS\system32\Restore
2014-04-06 01:06:15 ----D---- E:\WINDOWS\Microsoft.NET
2014-04-05 21:07:38 ----D---- E:\WINDOWS\Temp
2014-04-05 16:19:12 ----D---- E:\WINDOWS
2014-03-30 23:03:44 ----D---- E:\WINDOWS\Debug
2014-03-30 22:22:06 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI
2014-03-28 23:27:02 ----SHD---- E:\WINDOWS\Installer
2014-03-28 15:26:57 ----A---- E:\WINDOWS\NeroDigital.ini
2014-03-22 17:00:07 ----SD---- E:\WINDOWS\Tasks
2014-03-22 11:51:12 ----HD---- E:\WINDOWS\inf
2014-03-22 11:51:11 ----RSHDC---- E:\WINDOWS\system32\dllcache
2014-03-20 14:31:16 ----D---- E:\Program Files\Common Files
2014-03-18 12:29:25 ----A---- E:\WINDOWS\system32\MRT.exe
2014-03-12 16:30:09 ----D---- E:\Program Files\Internet Explorer
2014-03-12 16:29:31 ----D---- E:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2014-03-12 16:14:09 ----A---- E:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 snapman;Acronis Snapshots Manager; E:\WINDOWS\system32\DRIVERS\snapman.sys [2013-05-23 114048]
R0 timounter;Acronis True Image Backup Archive Explorer; E:\WINDOWS\system32\DRIVERS\timntr.sys [2013-05-23 395744]
R1 intelppm;Řadič procesoru Intel; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; E:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R2 tifsfilter;Acronis True Image FS Filter; E:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2013-05-23 39264]
R3 ati2mtag;ati2mtag; E:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-05-04 1133056]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; E:\WINDOWS\system32\DRIVERS\e1k5132.sys [2008-06-05 144480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; E:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); E:\WINDOWS\system32\drivers\RtkHDAud.sys [2012-06-19 6141584]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; E:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-14 12288]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; E:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 gdrv;gdrv; \??\E:\WINDOWS\gdrv.sys []
S3 Monfilt;Monfilt; E:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); E:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;Pomocná služba protokolu IPv6; E:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 AcrSch2Svc;Acronis Scheduler2 Service; E:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2006-10-17 230944]
R2 Ati HotKey Poller;Ati HotKey Poller; E:\WINDOWS\system32\Ati2evxx.exe [2005-05-04 364544]
R2 LMS;Intel(R) Active Management Technology LMS Service; E:\Program Files\Intel\AMT\LMS.exe [2006-06-28 98304]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 ATI Smart;ATI Smart; E:\WINDOWS\system32\ati2sgag.exe [2005-05-03 516096]
S2 gupdate;Služba Google Update (gupdate); E:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-22 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; E:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12 257928]
S3 aspnet_state;ASP.NET State Service; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); E:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-22 136176]
S3 idsvc;Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; E:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; E:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------