Zmizel mi ve Vista Správce úloh, internet je pomalý

[Sejkmajker]

Mám problém s Vistama.Poslední dobou je můj notebook pomalý.Před třemi měsíci jsem ho pročistil(naformátoval) a od té doby šlapal jak hodinky,ale posledních 14dní je jak línej šnek, to se týče jak nabíhání, tak i prací na internetu.Po instalaci Vista jsem hned nainstaloval Avast Home a Spybot Search and Destroy.Po tom co se notebook začal zpomalovat, tak jsem ho projel jak Avastem tak i Spybotem.Avast mi našel trojského koně(myslim v sys32), tak jsem ho dal do truhly(asi lepší než smazat?) a Spybot mi našel taky něco a skoro všechno šlo odstranit asi až na 4 soubory u kterých mi to psalo,že nejsem Administrátor - to ale není pravda, protože já jsem(mám jeden účet).Když se mi začne počítač zasekávat, tak dám ctrl+alt+delete a chci spustit Správce úloh,ale ten tam není Můžete mi prosím někdo poradit, jak teď mám postupovat, nechcii znova přeinstalovávat celý systém.V příloze posílám log z RSIT(nejde mi přiložit soubor s koncovkou txt ani docx,tak jsem to zkopiroval do žádosti - snad s tím nebude problém).Díky za Vám moc za pomoc

RSIT

tebooLogfile of random's system information tool 1.06 (written by random/random)
Run by Hanka at 2010-01-27 20:46:42
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 30 GB (28%) free of 107 GB
Total RAM: 1022 MB (11% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:35, on 27.1.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\programy\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\programy\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wuauclt.exe
C:\Programy\Microsoft Office\Office12\WINWORD.EXE
C:\WINDOWS\System32\mspaint.exe
C:\programy\Microsoft Office\Office12\POWERPNT.EXE
C:\Sejk\Programy\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XNW4QRI\RSIT[1].exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\trend micro\Hanka.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=Userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: gwprimawega - {7028e056-9367-c48a-d333-9ef0bb50de4c} - C:\Windows\system32\2V0XK-3B.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programy\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avast!] C:\Programy\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: 9635938.lnk = C:\Users\Hanka\AppData\Local\Temp\mvNat.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programy\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programy\PartyPoker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programy\PartyPoker\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\programy\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\programy\ICQ6.5\ICQ.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Programy\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: PokerTime - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerTimeMPP\MPPoker.exe (file missing) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programy\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\system32\kbdsock.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programy\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programy\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programy\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programy\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Plánovač automatické aktualizace LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Programy\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 13035 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programy\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7028e056-9367-c48a-d333-9ef0bb50de4c}]
gwprimawega - C:\Windows\system32\2V0XK-3B.dll [2009-12-26 1200128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Programy\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-18 263280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2010-01-18 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-05-19 1144712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
VeriSoft Access Manager - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll [2006-11-21 71192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-05-19 1144712]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-18 263280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-01-13 827392]
"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
"CognizanceTS"=c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll [2003-12-22 17920]
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"avast!"=C:\Programy\ALWILS~1\Avast4\ashDisp.exe [2009-11-24 81000]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-05-15 8429568]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-05-15 81920]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-11-23 198160]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"NokiaMusic FastStart"=C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe [2009-11-06 2090272]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"GrooveMonitor"=C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"SpybotSD TeaTimer"=C:\Programy\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
""= []
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-01-18 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\programy\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe /command:faststart []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2009-10-27 401728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-02-13 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2009-10-15 289072]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

C:\Users\Hanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
9635938.lnk - C:\Users\Hanka\AppData\Local\Temp\mvNat.exe
OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\Windows\system32\kbdsock.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Programy\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ASWLNPkg

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSetActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSetActiveDesktop"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86a460a0-bccf-11de-b2b1-001a6bad94f7}]
shell\AutoRun\command - F:\SETUP.EXE
shell\configure\command - F:\SETUP.EXE
shell\install\command - F:\SETUP.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9127c70-9a38-11de-bc10-806e6f6e6963}]
shell\AutoRun\command - E:\5800XpressMusic.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8db3886-ecbf-11de-934f-001a6bad94f7}]
shell\AutoRun\command - "H:\WD SmartWare.exe" autoplay=true


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-01-27 20:46:56 ----D---- C:\Program Files\trend micro
2010-01-27 20:46:42 ----D---- C:\rsit
2010-01-22 14:02:40 ----A---- C:\Windows\system32\Qc-C-Ui.exe
2010-01-22 14:01:13 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 14:01:11 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 14:01:07 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 14:01:06 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 14:01:06 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 14:01:05 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 14:01:04 ----A---- C:\Windows\system32\occache.dll
2010-01-22 14:01:04 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 14:01:02 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 14:01:01 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-22 14:01:01 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 14:01:01 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 14:01:00 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 14:01:00 ----A---- C:\Windows\system32\iesysprep.dll
2010-01-22 14:00:59 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 14:00:58 ----A---- C:\Windows\system32\msfeedssync.exe
2010-01-22 14:00:58 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 14:00:58 ----A---- C:\Windows\system32\iernonce.dll
2010-01-18 11:19:57 ----D---- C:\Users\Hanka\AppData\Roaming\Google
2010-01-18 11:18:45 ----D---- C:\ProgramData\Google
2010-01-18 11:18:45 ----D---- C:\Program Files\Google
2010-01-18 11:17:39 ----A---- C:\Windows\system32\javaws.exe
2010-01-18 11:17:39 ----A---- C:\Windows\system32\javaw.exe
2010-01-18 11:17:39 ----A---- C:\Windows\system32\java.exe
2010-01-17 21:03:38 ----D---- C:\Users\Hanka\AppData\Roaming\AVS4YOU
2010-01-17 21:02:50 ----D---- C:\ProgramData\AVS4YOU
2010-01-17 20:57:41 ----D---- C:\Program Files\Common Files\AVSMedia
2010-01-17 20:56:13 ----A---- C:\Windows\system32\msxml3a.dll
2010-01-17 20:56:13 ----A---- C:\Windows\system32\mfc70.dll
2010-01-17 20:56:12 ----D---- C:\Program Files\AVS4YOU
2010-01-17 16:35:05 ----D---- C:\Windows\Sun
2010-01-17 11:40:03 ----D---- C:\ProgramData\WindowsSearch
2010-01-16 19:45:45 ----D---- C:\Program Files\SmartDraw 2008
2010-01-13 10:24:49 ----A---- C:\Windows\system32\t2embed.dll
2010-01-13 10:24:49 ----A---- C:\Windows\system32\fontsub.dll

======List of files/folders modified in the last 1 months======

2010-01-27 20:47:11 ----D---- C:\Windows\Prefetch
2010-01-27 20:47:06 ----D---- C:\Windows\Temp
2010-01-27 20:46:56 ----RD---- C:\Program Files
2010-01-27 20:10:35 ----D---- C:\Users\Hanka\AppData\Roaming\uTorrent
2010-01-27 11:44:25 ----D---- C:\Windows\system32\catroot2
2010-01-27 11:44:25 ----D---- C:\Windows\system32\catroot
2010-01-27 11:44:21 ----D---- C:\Windows\winsxs
2010-01-27 10:41:04 ----D---- C:\Windows\SMINST
2010-01-27 01:32:42 ----SHD---- C:\System Volume Information
2010-01-27 01:31:57 ----D---- C:\Users\Hanka\AppData\Roaming\Skype
2010-01-27 00:33:17 ----D---- C:\Users\Hanka\AppData\Roaming\skypePM
2010-01-25 23:21:43 ----SD---- C:\Users\Hanka\AppData\Roaming\Microsoft
2010-01-25 23:21:06 ----SHD---- C:\Windows\Installer
2010-01-25 23:21:01 ----D---- C:\ProgramData\Microsoft Help
2010-01-25 22:45:03 ----D---- C:\Windows\Tasks
2010-01-25 22:37:17 ----D---- C:\Users\Hanka\AppData\Roaming\SmartDraw
2010-01-25 02:02:29 ----D---- C:\Staženo z internetu
2010-01-23 19:54:49 ----D---- C:\Windows\System32
2010-01-23 19:54:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-23 19:54:48 ----D---- C:\Windows\inf
2010-01-23 16:02:05 ----D---- C:\Windows\system32\migration
2010-01-23 16:02:02 ----D---- C:\Program Files\Internet Explorer
2010-01-19 15:31:06 ----D---- C:\WINDOWS
2010-01-18 22:54:16 ----D---- C:\Windows\system32\Tasks
2010-01-18 11:18:45 ----HD---- C:\ProgramData
2010-01-18 11:17:35 ----D---- C:\Program Files\Java
2010-01-18 11:03:42 ----D---- C:\Windows\system32\drivers
2010-01-17 20:57:41 ----D---- C:\Program Files\Common Files
2010-01-16 19:26:03 ----D---- C:\Download torrent
2010-01-14 11:29:18 ----D---- C:\Program Files\Windows Mail
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-01-05 00:17:46 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-24 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-24 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-24 48560]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 8192]
R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2007-03-28 140424]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
R3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-09-06 19456]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-09-06 29184]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-04-12 160768]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-12-07 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-12-07 207360]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-07 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-05-15 7115264]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-19 49664]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-01-13 181432]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-12-07 659968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 a018dofy;a018dofy; C:\Windows\system32\drivers\a018dofy.sys []
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-09-06 220160]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2008-01-19 28160]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 ASBroker;Logon Session Broker; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 ASChannel;Local Communication Channel; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Programy\Alwil Software\Avast4\aswUpdSv.exe [2009-11-24 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Programy\Alwil Software\Avast4\ashServ.exe [2009-11-24 138680]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 Plánovač automatické aktualizace LiveUpdate;Plánovač automatické aktualizace LiveUpdate; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R2 SBSDWSCService;SBSD Security Center Service; C:\Programy\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-11-28 386560]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Programy\Alwil Software\Avast4\ashMaiSv.exe [2009-11-24 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Programy\Alwil Software\Avast4\ashWebSv.exe [2009-11-24 352920]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-01-18 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-26 2999664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Programy\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-02-12 880640]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-09-17 651776]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-02-17 74656]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

-----------------EOF-----------------

[Marek-26]

stahnete a ulozte nejlepe na plochu ComboFix

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano:



dale muze dojit k varovani ohledne rezidentniho stitu vaseho antiviru a upozorneni na nenainstalovanou konzoli pro zotaveni; tu zatim neinstalujte.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, deaktivujte jeho rezidentni stit, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim Combofixu s rezidentem antispyware

po restartu aplikace vytvori log, ulozeny na C:/Combofix.txt (pri opakovanem pouziti jsou logy oznaceny Combofix2.txt atd.), jeho obsah vlozte sem

[Sejkmajker]

Děkuji za radu, vyzkouším.

[Sejkmajker]

Po dokončení testu, mi to udělalo akorát tenhle soubor(obsah souboru viz.níže).Na disku žádný adresář Combofix nemám.Doufám, ře Vám ten obsah pomůže, protože já se v něm opravdu nevyznám. Díky za pomoc


ComboFix 10-01-27.06 - Hanka 28.01.2010 20:16:23.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.1022.418 [GMT 0:00]
Spuštěný z: c:\users\Hanka\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1351 [VPS 091109-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1351 [VPS 091109-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2179285541-3270822918-3895208942-500
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\Fh-2f_AQV-Vq1Fa
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\q47_8I_Du1M-_D
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\udRemove.exe
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\VoDpkh-FXj
c:\users\Hanka\AppData\Roaming\Desktopicon
c:\users\Hanka\AppData\Roaming\Desktopicon\config.ini
c:\users\Hanka\AppData\Roaming\Desktopicon\eBayShortcuts.exe
c:\windows\System32\2V0XK-3B.dll
c:\windows\system32\warning.html

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-27 20:46 . 2010-01-27 20:48 -------- d-----w- c:\program files\trend micro
2010-01-27 20:46 . 2010-01-27 21:39 -------- d-----w- C:\rsit
2010-01-22 14:02 . 2010-01-22 14:02 118256 ----a-w- c:\windows\system32\Qc-C-Ui.exe
2010-01-22 14:00 . 2010-01-02 06:32 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-18 11:19 . 2010-01-18 11:20 -------- d-----w- c:\users\Hanka\AppData\Local\Google
2010-01-18 11:18 . 2010-01-18 11:19 -------- d-----w- c:\program files\Google
2010-01-17 21:03 . 2010-01-17 21:03 -------- d-----w- c:\users\Hanka\AppData\Roaming\AVS4YOU
2010-01-17 21:02 . 2010-01-17 21:02 -------- d-----w- c:\programdata\AVS4YOU
2010-01-17 20:57 . 2010-01-17 21:00 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-17 20:56 . 2008-08-13 10:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-01-17 20:56 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-01-17 20:56 . 2010-01-17 21:01 -------- d-----w- c:\program files\AVS4YOU
2010-01-17 16:35 . 2010-01-17 16:35 -------- d-----w- c:\windows\Sun
2010-01-17 11:40 . 2010-01-17 11:40 -------- d-----w- c:\programdata\WindowsSearch
2010-01-16 19:45 . 2010-01-19 14:32 -------- d-----w- c:\program files\SmartDraw 2008
2010-01-13 10:24 . 2009-10-19 14:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 10:24 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-28 20:37 . 2009-09-05 18:02 12 ----a-w- c:\windows\bthservsdp.dat
2010-01-28 16:53 . 2009-10-15 12:28 -------- d-----w- c:\users\Hanka\AppData\Roaming\uTorrent
2010-01-27 01:31 . 2009-12-19 23:08 -------- d-----w- c:\users\Hanka\AppData\Roaming\Skype
2010-01-27 00:33 . 2009-12-19 23:11 -------- d-----w- c:\users\Hanka\AppData\Roaming\skypePM
2010-01-25 23:21 . 2009-12-02 08:22 -------- d-----w- c:\programdata\Microsoft Help
2010-01-25 22:37 . 2009-12-04 19:40 -------- d-----w- c:\users\Hanka\AppData\Roaming\SmartDraw
2010-01-25 21:47 . 2009-09-27 11:40 1 ----a-w- c:\users\Hanka\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-23 19:54 . 2007-01-08 21:09 618394 ----a-w- c:\windows\system32\perfh005.dat
2010-01-23 19:54 . 2007-01-08 21:09 122640 ----a-w- c:\windows\system32\perfc005.dat
2010-01-18 11:20 . 2010-01-18 11:20 1230960 ----a-w- c:\programdata\Google\Google Toolbar\Component\GoogleCld_3F6C343113693CD9.dll
2010-01-18 11:17 . 2007-06-20 10:53 -------- d-----w- c:\program files\Java
2010-01-14 11:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-14 11:12 . 2009-10-02 21:44 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-22 14:01 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 14:01 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 14:01 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-19 23:11 . 2009-12-19 23:11 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-12-19 23:07 . 2009-12-19 23:07 -------- d-----r- c:\program files\Skype
2009-12-19 23:07 . 2009-12-19 23:07 -------- d-----w- c:\program files\Common Files\Skype
2009-12-19 23:07 . 2009-09-06 08:00 -------- d-----w- c:\programdata\Skype
2009-12-10 18:13 . 2009-12-09 18:31 -------- d-----w- c:\program files\Valve
2009-12-10 17:09 . 2009-12-10 17:04 -------- d-----w- c:\program files\Counter-Strike 1.6 Patch Version 26
2009-12-09 18:31 . 2007-06-20 09:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-04 23:39 . 2009-09-05 17:51 115224 ----a-w- c:\users\Hanka\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-04 22:42 . 2009-12-04 22:20 -------- d-----w- c:\users\Hanka\AppData\Roaming\SmartDraw Image Plugin
2009-12-03 18:47 . 2009-12-03 18:47 -------- d-----w- c:\programdata\Boss Media
2009-12-02 22:35 . 2009-12-02 22:35 -------- d-----w- c:\program files\XviD
2009-12-02 08:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild
2009-12-02 08:30 . 2009-12-02 08:30 -------- d-----w- c:\program files\Microsoft.NET
2009-12-02 08:26 . 2009-12-02 08:26 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-11-30 15:34 . 2009-11-29 19:36 -------- d-----w- c:\users\Hanka\AppData\Roaming\Apple Computer
2009-11-30 15:06 . 2009-11-30 15:04 -------- d-----w- c:\program files\iTunes
2009-11-30 15:05 . 2009-11-30 15:05 -------- d-----w- c:\program files\iPod
2009-11-30 15:05 . 2009-11-29 19:21 -------- d-----w- c:\program files\Common Files\Apple
2009-11-30 01:53 . 2009-11-10 14:09 -------- d-----w- c:\users\Hanka\AppData\Roaming\Nokia
2009-11-30 01:53 . 2009-11-30 01:53 52948 ----a-w- c:\windows\inf\Ovi Player\0009\tmp86B1.tmp
2009-11-30 01:53 . 2009-11-30 01:53 52948 ----a-w- c:\windows\inf\Ovi Player\0005\tmp86B1.tmp
2009-11-30 01:53 . 2009-11-30 01:53 52948 ----a-w- c:\windows\inf\Ovi Player\0000\tmp86B1.tmp
2009-11-30 01:53 . 2009-11-30 01:53 1657 ----a-w- c:\windows\inf\Ovi Player\tmp86B2.tmp
2009-11-30 01:53 . 2009-11-09 16:46 -------- d-----w- c:\program files\Nokia
2009-11-30 00:28 . 2009-11-10 14:08 -------- d-----w- c:\users\Hanka\AppData\Roaming\PC Suite
2009-11-30 00:27 . 2009-11-30 00:27 -------- d-----w- c:\programdata\Nokia
2009-11-30 00:27 . 2009-11-30 00:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-11-30 00:24 . 2009-11-10 14:08 -------- d-----w- c:\programdata\PC Suite
2009-11-30 00:22 . 2009-11-30 00:22 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-11-30 00:21 . 2009-11-30 00:21 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-11-24 23:54 . 2009-09-06 06:41 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:50 . 2009-09-06 06:42 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-09-06 06:42 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-09-06 06:41 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-24 23:49 . 2009-09-06 06:42 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-09-06 06:42 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-09-06 06:42 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-23 21:07 . 2006-07-11 18:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-12 17:07 . 2009-11-12 17:07 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-09 17:43 . 2009-11-09 17:43 52962 ----a-w- c:\windows\inf\Nokia Music\0009\tmp8AE4.tmp
2009-11-09 17:43 . 2009-11-09 17:43 52962 ----a-w- c:\windows\inf\Nokia Music\0005\tmp8AE4.tmp
2009-11-09 17:43 . 2009-11-09 17:43 52962 ----a-w- c:\windows\inf\Nokia Music\0000\tmp8AE4.tmp
2009-11-09 17:43 . 2009-11-09 17:43 1657 ----a-w- c:\windows\inf\Nokia Music\tmp8AF5.tmp
2009-11-09 16:48 . 2009-11-09 16:48 12212040 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2009-11-09 16:47 . 2009-11-09 16:47 13930312 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2009-11-09 16:47 . 2009-11-09 16:47 61440 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMF11Runx86.exe
2009-11-09 16:47 . 2009-11-09 16:47 58880 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMF11Runx64.exe
2009-11-09 16:47 . 2009-11-09 16:47 77824 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2009-11-09 16:47 . 2009-11-09 16:47 50000 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\pcswpc.exe
2009-11-09 16:44 . 2009-11-09 16:46 94628904 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Nokia_Ovi_Suite_11_update.exe
2009-11-09 15:58 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-09 15:31 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-09 15:31 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-09 13:22 . 2009-12-10 11:55 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 13:20 . 2009-12-10 11:54 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 11:04 . 2009-12-10 11:54 411136 ----a-w- c:\windows\system32\drivers\http.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-05-19 12:37 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-19 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SpybotSD TeaTimer"="c:\programy\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-18 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 17920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"avast!"="c:\programy\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-15 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-15 81920]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-23 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2009-11-06 2090272]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"GrooveMonitor"="c:\programy\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-19 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-22 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ----a-w- c:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2009-10-27 15:10 401728 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-02-13 09:38 159744 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-04-23 16:11 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-10-15 12:29 289072 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [6.9.2009 6:42 114768]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [13.9.2009 16:32 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [13.9.2009 16:32 21504]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [6.9.2009 6:42 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [6.9.2009 6:41 53328]
R2 SBSDWSCService;SBSD Security Center Service;c:\programy\Spybot - Search & Destroy\SDWinSec.exe [5.9.2009 18:05 1153368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\programy\MICROS~1\Office12\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
FF - ProfilePath - c:\users\Hanka\AppData\Roaming\Mozilla\Firefox\Profiles\swoe8fz2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\sejk\Programy\Mozilla Firefox\extensions\{8b0520fd-7837-4d2e-cfa8-b5e7256cbe01}\components\B_r_V-6F.dll
FF - plugin: c:\programy\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\programy\DivX\DivX Web Player\npdivx32.dll
FF - plugin: c:\programy\Netscape6\nppl3260.dll
FF - plugin: c:\programy\Netscape6\nprjplug.dll
FF - plugin: c:\programy\Netscape6\nprpjplug.dll
FF - plugin: c:\sejk\Programy\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\sejk\Programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{7028e056-9367-c48a-d333-9ef0bb50de4c} - c:\windows\system32\2V0XK-3B.dll
MSConfigStartUp-NokiaMusic FastStart - c:\program files\Nokia\Nokia Music\NokiaMusic.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31} - c:\sejk\Programy\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 22:19
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8430A1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x865a8322
\Driver\ACPI -> acpi.sys @ 0x8233fd4c
\Driver\atapi -> 0x8430a1f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\programy\Alwil Software\Avast4\aswUpdSv.exe
c:\programy\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe
c:\programy\Alwil Software\Avast4\ashMaiSv.exe
c:\programy\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Celkový čas: 2010-01-28 22:29:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-28 22:28

Před spuštěním: Volných bajtů: 31 092 961 280
Po spuštění: Volných bajtů: 32 191 987 712

- - End Of File - - 2483C70F501789C6087A2C238FCC3994

[Marek-26]

Ještě poprosím o log z MBAM Klikněte na MBAM v mém podpisu a udělejte komplatní scan Zatím nic nemažte pouze vytvořte log a vložte ho sem.
PC se chová stále stejně?
Toto mi otestuje na virustotal.com a vložte sem odkaz na výsledek
c:\windows\system32\Qc-C-Ui.exe

Poprosím ještě aby jste mi vypsal co Avast a SpyBot nalezli

[Sejkmajker]

Po otestování počítače ComboFixem, se mi opět ukazuje Správce úloh .Počítač se mi zdá, ale na dále pomalý, hlavně práci na internetu, ale myslim si, že to připojením nebude.
Dneska jsem spustil ještě Spybot Search&Destroy a Avast(standartní)test.Spybot mi našel asi 10 napadení, ale všechny šli k mému překvapení odstranit a Avast neobjevil nic.Na VirusTotal jsem nechal otestovat ten soubor a výsledky jsou zde.

Soubor Qc-C-Ui.exe přijatý 2010.01.30 13:58:04 (UTC)
Současný stav: Dokončeno
Výsledek: 8/40 (20.00%)
http://www.virustotal.com/cs/analisis/1 ... 1264859884


Po instalaci MBAMu, jsem dal důkladný test a objevilo mi to 12 infikovaných souborů(log viz. dole).


Malwarebytes' Anti-Malware 1.44
Verze databáze: 3662
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882

30.1.2010 17:18:30
mbam-log-2010-01-30 (17-18-13).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 310683
Uplynulý čas: 1 hour(s), 40 minute(s), 15 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 5
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 7

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_CLASSES_ROOT\CLSID\{7028e056-9367-c48a-d333-9ef0bb50de4c} (Adware.BHO.AR) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7028e056-9367-c48a-d333-9ef0bb50de4c} (Adware.BHO.AR) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7028e056-9367-c48a-d333-9ef0bb50de4c} (Adware.BHO.AR) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\BMIMZMHMFM (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\WS9E3IQBKY (Trojan.FakeAlert) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\Qoobox\Quarantine\C\Users\Hanka\AppData\Roaming\Desktopicon\eBayShortcuts.exe.vir (Adware.ADON) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\System32\2V0XK-3B.dll.vir (Adware.BHO.AR) -> No action taken.
C:\Staženo z internetu\Setup.exe (Adware.Agent) -> No action taken.
C:\Users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H4OZ4CVA\Setup[1].exe (Adware.Agent) -> No action taken.
C:\Users\Hanka\Downloads\Adobe Photoshop Elements 7\Adobe All Products Keymaker.exe (Malware.Tool) -> No action taken.
C:\WINDOWS\System32\2V0XK-3B.dll (Adware.BHO.AR) -> No action taken.
C:\Users\Hanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9635938.lnk (Malware.Trace) -> No action taken.

[Marek-26]

Vše co našel MBAM smažte

Odinstalujte Ask.com toolbar

Otevrete si Poznamkovy blok
do nej zkopirujte skript z nasledujiciho okna:

Kód: Vybrat vše

KillAll:

File::
c:\windows\system32\Qc-C-Ui.exe

ulozte vami vytvoreny textovy soubor jako CFScript.txt na plochu

po ulozeni uchopte vami vytvoreny skript levym tlacitkem mysi a presunte jej nad ikonu Combofixu, nad niz skript upustte:



po aplikaci by na vas mel vybafnout dalsi log, vlozte jej sem

[Sejkmajker]

Ask.com toolbar mi nejde odinstalovat, protože nevim, kde ho mám hledat.Ani v jednom prohlížeči, ve správcích dopllňků a nastavení ho nevidim a ovládacích panelech také není. Můžete mi poradit, kde ho mám hledat?Ten text jsem zkopíroval do poznámkového bloku a poté přetáhl do Combofixu.Netušil jsem, že se ten test bude provádět kompletní, tak jsem si nevypnul Spybot a Avast štít , testovalo se to asi 8 minut a dojelo to do fáze 8 a obrazovka smrti bum a Visty spadly .Po náběhu počítače se mi žádný log nevytvořil.Už sotva vidim na display, tak to ráno zkusim znova a vypnu si rezidentní ochranu.

[Marek-26]

Jj zkuste to znova a do CFScriptu přidejte toto:

Kód: Vybrat vše

Folder::
c:\program files\Ask.com

[Sejkmajker]

Po vypnutí rezidentních štítů , už proběhl test bez problémů.Výsledky jsou viz. níže.Po těch všech testech už by měl být počítač "čistý od havěti", ale já si nemůžu pomoci, ale i banální oprace typu : otevření WinCommandra - to trvá někdy i přes 10s.Myslíte, že Avast je nejlepší free antivir, nebo by jste mi doporučil nějaký jiný, ale také zadarmo:). Děkuji za ochotu, při řešení mého problému

C
omboFix 10-01-27.06 - Hanka 31.01.2010 10:39:43.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.1022.446 [GMT 0:00]
Spuštěný z: c:\users\Hanka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Hanka\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1351 [VPS 091109-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1351 [VPS 091109-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\Qc-C-Ui.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\Fh-2f_AQV-Vq1Fa
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\q47_8I_Du1M-_D
c:\users\Hanka\AppData\Local\Microsoft\Windows\Temporary Internet Files\VoDpkh-FXj
c:\windows\system32\Qc-C-Ui.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-31 )))))))))))))))))))))))))))))))
.

2010-01-31 10:59 . 2010-01-31 11:06 -------- d-----w- c:\users\Hanka\AppData\Local\temp
2010-01-31 10:59 . 2010-01-31 10:59 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-31 10:59 . 2010-01-31 10:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-30 13:50 . 2010-01-30 13:50 -------- d-----w- c:\users\Hanka\AppData\Roaming\Malwarebytes
2010-01-30 13:49 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 13:49 . 2010-01-30 13:49 -------- d-----w- c:\programdata\Malwarebytes
2010-01-30 13:49 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 13:49 . 2010-01-30 13:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-27 20:46 . 2010-01-27 20:48 -------- d-----w- c:\program files\trend micro
2010-01-27 20:46 . 2010-01-27 21:39 -------- d-----w- C:\rsit
2010-01-22 14:00 . 2010-01-02 06:32 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-18 11:19 . 2010-01-30 19:41 -------- d-----w- c:\users\Hanka\AppData\Local\Google
2010-01-18 11:18 . 2010-01-29 15:25 -------- d-----w- c:\program files\Google
2010-01-17 21:03 . 2010-01-17 21:03 -------- d-----w- c:\users\Hanka\AppData\Roaming\AVS4YOU
2010-01-17 21:02 . 2010-01-17 21:02 -------- d-----w- c:\programdata\AVS4YOU
2010-01-17 20:57 . 2010-01-17 21:00 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-17 20:56 . 2008-08-13 10:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-01-17 20:56 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-01-17 20:56 . 2010-01-17 21:01 -------- d-----w- c:\program files\AVS4YOU
2010-01-17 16:35 . 2010-01-17 16:35 -------- d-----w- c:\windows\Sun
2010-01-17 11:40 . 2010-01-17 11:40 -------- d-----w- c:\programdata\WindowsSearch
2010-01-16 19:45 . 2010-01-19 14:32 -------- d-----w- c:\program files\SmartDraw 2008
2010-01-13 10:24 . 2009-10-19 14:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 10:24 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 11:01 . 2009-09-05 18:02 12 ----a-w- c:\windows\bthservsdp.dat
2010-01-29 18:48 . 2009-12-19 23:08 -------- d-----w- c:\users\Hanka\AppData\Roaming\Skype
2010-01-29 17:42 . 2009-09-27 11:40 1 ----a-w- c:\users\Hanka\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-29 16:08 . 2009-12-19 23:11 -------- d-----w- c:\users\Hanka\AppData\Roaming\skypePM
2010-01-29 15:36 . 2009-11-09 16:46 -------- d-----w- c:\program files\Nokia
2010-01-29 13:39 . 2010-01-29 13:39 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbCCE3.tmp.exe
2010-01-29 01:12 . 2009-10-15 12:28 -------- d-----w- c:\users\Hanka\AppData\Roaming\uTorrent
2010-01-25 23:21 . 2009-12-02 08:22 -------- d-----w- c:\programdata\Microsoft Help
2010-01-25 22:37 . 2009-12-04 19:40 -------- d-----w- c:\users\Hanka\AppData\Roaming\SmartDraw
2010-01-23 19:54 . 2007-01-08 21:09 618394 ----a-w- c:\windows\system32\perfh005.dat
2010-01-23 19:54 . 2007-01-08 21:09 122640 ----a-w- c:\windows\system32\perfc005.dat
2010-01-18 11:17 . 2007-06-20 10:53 -------- d-----w- c:\program files\Java
2010-01-14 11:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-14 11:12 . 2009-10-02 21:44 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-22 14:01 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 14:01 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 14:01 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-19 23:11 . 2009-12-19 23:11 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-12-19 23:07 . 2009-12-19 23:07 -------- d-----r- c:\program files\Skype
2009-12-19 23:07 . 2009-12-19 23:07 -------- d-----w- c:\program files\Common Files\Skype
2009-12-19 23:07 . 2009-09-06 08:00 -------- d-----w- c:\programdata\Skype
2009-12-10 18:13 . 2009-12-09 18:31 -------- d-----w- c:\program files\Valve
2009-12-10 17:09 . 2009-12-10 17:04 -------- d-----w- c:\program files\Counter-Strike 1.6 Patch Version 26
2009-12-09 18:31 . 2007-06-20 09:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-04 23:39 . 2009-09-05 17:51 115224 ----a-w- c:\users\Hanka\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-04 22:42 . 2009-12-04 22:20 -------- d-----w- c:\users\Hanka\AppData\Roaming\SmartDraw Image Plugin
2009-12-03 18:47 . 2009-12-03 18:47 -------- d-----w- c:\programdata\Boss Media
2009-12-02 22:35 . 2009-12-02 22:35 -------- d-----w- c:\program files\XviD
2009-11-24 23:54 . 2009-09-06 06:41 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:50 . 2009-09-06 06:42 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-09-06 06:42 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-09-06 06:41 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-24 23:49 . 2009-09-06 06:42 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-09-06 06:42 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-09-06 06:42 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-23 21:07 . 2006-07-11 18:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-12 17:07 . 2009-11-12 17:07 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-09 16:48 . 2009-11-09 16:48 12212040 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2009-11-09 16:47 . 2009-11-09 16:47 13930312 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2009-11-09 16:47 . 2009-11-09 16:47 61440 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMF11Runx86.exe
2009-11-09 16:47 . 2009-11-09 16:47 58880 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\WMF11Runx64.exe
2009-11-09 16:47 . 2009-11-09 16:47 77824 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2009-11-09 16:47 . 2009-11-09 16:47 50000 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\pcswpc.exe
2009-11-09 16:44 . 2009-11-09 16:46 94628904 ----a-w- c:\programdata\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Nokia_Ovi_Suite_11_update.exe
2009-11-09 15:31 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-09 15:31 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-09 13:22 . 2009-12-10 11:55 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 13:20 . 2009-12-10 11:54 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 11:04 . 2009-12-10 11:54 411136 ----a-w- c:\windows\system32\drivers\http.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"SpybotSD TeaTimer"="c:\programy\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-18 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 17920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"avast!"="c:\programy\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-15 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-15 81920]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-23 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2009-11-06 2090272]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"GrooveMonitor"="c:\programy\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\users\Hanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-14 384512]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-19 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-22 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ----a-w- c:\programy\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2009-10-27 15:10 401728 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-02-13 09:38 159744 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-04-23 16:11 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-10-15 12:29 289072 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [6.9.2009 6:42 114768]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [13.9.2009 16:32 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [13.9.2009 16:32 21504]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [6.9.2009 6:42 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [6.9.2009 6:41 53328]
R2 SBSDWSCService;SBSD Security Center Service;c:\programy\Spybot - Search & Destroy\SDWinSec.exe [5.9.2009 18:05 1153368]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29.1.2010 15:25 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
bthsvcs REG_MULTI_SZ BthServ
.
Obsah adresáře 'Naplánované úlohy'

2010-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 15:25]

2010-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 15:25]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\programy\MICROS~1\Office12\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
FF - ProfilePath - c:\users\Hanka\AppData\Roaming\Mozilla\Firefox\Profiles\swoe8fz2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\sejk\Programy\Mozilla Firefox\extensions\{8b0520fd-7837-4d2e-cfa8-b5e7256cbe01}\components\B_r_V-6F.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programy\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\programy\DivX\DivX Web Player\npdivx32.dll
FF - plugin: c:\programy\Netscape6\nppl3260.dll
FF - plugin: c:\programy\Netscape6\nprjplug.dll
FF - plugin: c:\programy\Netscape6\nprpjplug.dll
FF - plugin: c:\sejk\Programy\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\sejk\Programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Qc-C-Ui - c:\windows\system32\Qc-C-Ui.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 11:05
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x843091F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x865ae322
\Driver\ACPI -> acpi.sys @ 0x82338d4c
\Driver\atapi -> 0x843091f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\programy\Alwil Software\Avast4\aswUpdSv.exe
c:\programy\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\conime.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Celkový čas: 2010-01-31 11:17:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-31 11:16
ComboFix2.txt 2010-01-28 22:29

Před spuštěním: Volných bajtů: 30 774 296 576
Po spuštění: Volných bajtů: 30 648 668 160

- - End Of File - - 87AABD26562FB6A65FABFE6769348A4D

[Marek-26]

Udělejte mi ještě pro jistotu scan s AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179
Můžete zkusit namísto Avast!u například Aviru http://www.free-av.com/

[Sejkmajker]

Počítač se zdá už v pořádku, po tom co jsem testy ještě jednou všechny zopakoval.Děkuji mockrát za pomoc.

[Marek-26]

Nemáte zač
Ještě stáhněte a spusťte http://sweb.cz/Marinus/T-Cleaner.exe

odstraní zbytky po používaných programech