VIRY.CZ

Zdravím, asi před měsícem jsem upgradoval HW a provedl čistou instalaci WIN. Pak následovalo doinstalování různých programů, zejména děti doplnily nějaké hra od kamarádů a já začínám mít pocit, že jsem tam kde před měsícem. V systrayi nejsou vidět všechny ikony spuštěných programů, přestože v procesech běží, start PC trvá několik minut. Projel jsem PC Avastem, Spybotem a nic. Nasadil jsem tedy Combofix a taky nic (jen smazal zálohy registru vytvořené Ccleanerem). Prosím o kontrolu logu RSIT i Combofix a radu čím by to mohlo být.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2010-03-11 15:51:38
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 280 GB (59%) free of 477 GB
Total RAM: 3454 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:45, on 11.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\FreeCommander\FreeCommander.exe
C:\Downloads\Software\RSIT.exe
C:\Program Files\trend micro\Petr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Služba Plánovač2] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [alcohol.exe Autorun] C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe /startup
O4 - HKCU\..\Run: [MoeMonitor.exe] "C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4788138906
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F3062C2-810E-48D3-9928-3E3ACBD07A22}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: wlcrdplauncher - C:\Program Files\Live Mesh\Remote Desktop\wlcrdplauncher.dll
O23 - Service: Acronis Služba Plánovač2 (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)

--
End of file - 7572 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\Program Files\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-31 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-31 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-05-20 98304]
"TrueImageMonitor.exe"=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2009-12-14 4377960]
"AcronisTimounterMonitor"=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2009-12-14 962272]
"Acronis Služba Plánovač2"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2009-12-14 377600]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-01-31 149280]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"pdfFactory Pro Dispatcher v3"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe [2009-12-15 614400]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-02-11 2756488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"=C:\Program Files\Free Download Manager\fdm.exe [2009-01-31 3399727]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-24 203928]
"alcohol.exe Autorun"=C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe [2010-02-04 3347968]
"MoeMonitor.exe"=C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe [2010-02-02 1315152]

C:\Documents and Settings\Petr\Nabídka Start\Programy\Po spuštění
Logitech . Product Registration.lnk - C:\Program Files\Logitech\QuickCam\eReg.exe
OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-12-11 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlcrdplauncher]
C:\Program Files\Live Mesh\Remote Desktop\wlcrdplauncher.dll [2010-02-02 21840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\WinSCP\WinSCP.exe"="C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:WinSCP: SFTP, FTP and SCP client"
"C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe"="C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe:*:Enabled:Live Mesh Remote Desktop"
"C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\GacBase\Moe.exe"="C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\GacBase\Moe.exe:*:Enabled:Live Mesh"
"C:\Program Files\scol\scolsetup.exe"="C:\Program Files\scol\scolsetup.exe:*:Enabled:scolsetup"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe"="C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe:*:Enabled:Live Mesh Remote Desktop"
"C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\GacBase\Moe.exe"="C:\Documents and Settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\GacBase\Moe.exe:*:Enabled:Live Mesh"

======List of files/folders created in the last 1 months======

2010-03-11 15:51:38 ----D---- C:\rsit
2010-03-11 15:51:38 ----D---- C:\Program Files\trend micro
2010-03-11 15:49:51 ----A---- C:\ComboFix.txt
2010-03-11 14:58:10 ----A---- C:\Boot.bak
2010-03-11 14:58:01 ----RASHD---- C:\cmdcons
2010-03-11 14:56:44 ----A---- C:\WINDOWS\zip.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\SWSC.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\SWREG.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\sed.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\PEV.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\MBR.exe
2010-03-11 14:56:44 ----A---- C:\WINDOWS\grep.exe
2010-03-11 14:53:38 ----D---- C:\32788R22FWJFW
2010-03-11 14:52:44 ----D---- C:\WINDOWS\ERDNT
2010-03-11 14:48:31 ----D---- C:\Qoobox
2010-03-11 14:26:15 ----D---- C:\ATI
2010-03-11 14:02:26 ----A---- C:\WINDOWS\system32\atiiiexx.dll
2010-03-11 13:57:37 ----D---- C:\AMD
2010-03-11 03:08:31 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-10 16:09:07 ----D---- C:\Program Files\Lineage II
2010-03-08 20:35:38 ----D---- C:\QIP Infium JadrisPack
2010-03-08 17:27:38 ----D---- C:\Documents and Settings\Petr\Data aplikací\PSpad
2010-03-06 21:57:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-02-26 17:11:16 ----D---- C:\Program Files\GSC Game World
2010-02-24 15:02:14 ----A---- C:\WINDOWS\imsins.BAK
2010-02-24 15:02:08 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-22 17:13:20 ----D---- C:\Program Files\7-Zip
2010-02-22 15:49:54 ----D---- C:\Program Files\scol
2010-02-21 11:10:45 ----A---- C:\WINDOWS\system32\ptpusb.dll
2010-02-21 11:10:41 ----A---- C:\WINDOWS\system32\ptpusd.dll
2010-02-18 19:10:58 ----A---- C:\WINDOWS\system32\Iyvu9_32.dll
2010-02-18 19:10:58 ----A---- C:\WINDOWS\system32\Iacenc.dll
2010-02-18 19:01:06 ----A---- C:\WINDOWS\IsUninst.exe
2010-02-18 18:39:46 ----D---- C:\Program Files\Cenega Czech
2010-02-18 18:26:17 ----D---- C:\Program Files\Warcraft III
2010-02-18 16:49:46 ----D---- C:\Program Files\Activision
2010-02-17 19:19:12 ----D---- C:\Program Files\WoW - TBC
2010-02-17 16:52:47 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2010-02-17 16:39:15 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-02-17 16:39:14 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-02-17 16:38:42 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-02-17 16:38:05 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-02-17 16:36:14 ----D---- C:\Program Files\PerformanceTest
2010-02-17 16:35:59 ----A---- C:\WINDOWS\system32\cutil32.dll
2010-02-17 16:35:59 ----A---- C:\WINDOWS\system32\cudart.dll
2010-02-17 16:35:55 ----D---- C:\Program Files\CPUID
2010-02-17 15:47:25 ----D---- C:\Program Files\oZone3D
2010-02-17 14:12:18 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-02-17 14:11:57 ----D---- C:\WINDOWS\Logs
2010-02-17 14:11:55 ----D---- C:\WINDOWS\system32\temp
2010-02-17 14:11:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\PassMark
2010-02-17 14:11:46 ----D---- C:\Program Files\BurnInTest
2010-02-16 19:23:11 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-16 19:21:54 ----D---- C:\Program Files\Common Files\LogiShrd
2010-02-16 19:21:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\Logitech
2010-02-16 19:07:58 ----D---- C:\Documents and Settings\Petr\Data aplikací\Leadertech
2010-02-16 19:05:02 ----D---- C:\Documents and Settings\Petr\Data aplikací\Logitech
2010-02-16 18:31:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\LogiShrd
2010-02-16 17:36:43 ----D---- C:\WINDOWS\Minidump
2010-02-16 14:07:31 ----D---- C:\Program Files\SpeedFan
2010-02-16 13:12:15 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-16 13:11:36 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-16 13:07:19 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-16 13:07:10 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-16 13:07:01 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-16 13:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-16 13:06:37 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-16 13:05:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$

======List of files/folders modified in the last 1 months======

2010-03-11 15:51:38 ----RD---- C:\Program Files
2010-03-11 15:51:24 ----D---- C:\WINDOWS\Prefetch
2010-03-11 15:49:54 ----D---- C:\WINDOWS\system32\drivers
2010-03-11 15:49:53 ----D---- C:\WINDOWS\Temp
2010-03-11 15:48:50 ----D---- C:\Documents and Settings\Petr\Data aplikací\Free Download Manager
2010-03-11 15:48:15 ----D---- C:\Documents and Settings\Petr\Data aplikací\Skype
2010-03-11 15:43:49 ----D---- C:\WINDOWS
2010-03-11 15:43:49 ----A---- C:\WINDOWS\system.ini
2010-03-11 15:21:42 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-11 15:10:29 ----D---- C:\WINDOWS\system32\config
2010-03-11 15:06:52 ----D---- C:\WINDOWS\system32
2010-03-11 15:06:52 ----D---- C:\WINDOWS\AppPatch
2010-03-11 15:06:44 ----D---- C:\Program Files\Common Files
2010-03-11 14:58:11 ----RASH---- C:\boot.ini
2010-03-11 14:57:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-11 14:28:22 ----SHD---- C:\WINDOWS\Installer
2010-03-11 14:13:57 ----HD---- C:\WINDOWS\inf
2010-03-11 14:10:23 ----D---- C:\Program Files\Trillian
2010-03-11 14:08:37 ----D---- C:\Program Files\ATI Technologies
2010-03-11 14:08:21 ----RSD---- C:\WINDOWS\assembly
2010-03-11 14:07:58 ----D---- C:\WINDOWS\WinSxS
2010-03-11 14:04:22 ----D---- C:\Program Files\Common Files\ATI Technologies
2010-03-11 14:02:54 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-03-11 13:54:49 ----D---- C:\Downloads
2010-03-11 12:50:30 ----D---- C:\Documents and Settings\Petr\Data aplikací\skypePM
2010-03-11 03:08:37 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-11 03:08:35 ----D---- C:\Program Files\Movie Maker
2010-03-11 03:08:16 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-11 03:02:40 ----D---- C:\WINDOWS\Debug
2010-03-10 12:22:10 ----D---- C:\Program Files\Mozilla Thunderbird
2010-03-07 17:54:07 ----D---- C:\Program Files\CCleaner
2010-03-02 06:30:12 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-24 15:02:40 ----D---- C:\WINDOWS\ie8updates
2010-02-22 17:51:57 ----D---- C:\Program Files\Free Download Manager
2010-02-22 15:50:45 ----D---- C:\WINDOWS\system
2010-02-22 07:56:54 ----RSD---- C:\WINDOWS\Fonts
2010-02-18 19:10:54 ----D---- C:\Program Files\Intel
2010-02-17 16:40:10 ----D---- C:\WINDOWS\system32\DirectX
2010-02-16 19:22:31 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-16 14:23:37 ----D---- C:\Program Files\Recuva
2010-02-16 14:23:17 ----D---- C:\Program Files\Defraggler
2010-02-15 21:51:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-02-11 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-02-11 162512]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-02-11 46672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-02-11 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-02-11 100432]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-12-11 4525056]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-16 12160]
R3 RDPDISPM;RDPDISPM; C:\WINDOWS\system32\DRIVERS\rdpdispm.sys [2010-02-02 9040]
R3 RDPVDD;RDPVDD; C:\WINDOWS\system32\DRIVERS\rdpvmp.sys [2010-02-02 19408]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S3 ad1va2fj;ad1va2fj; C:\WINDOWS\system32\drivers\ad1va2fj.sys []
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-02-11 23376]
S3 mbr;mbr; \??\C:\DOCUME~1\Petr\LOCALS~1\Temp\mbr.sys []
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS\System32\Drivers\vulfnth.sys [2003-08-04 6912]
S3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS\System32\Drivers\vulfntr.sys [2003-08-04 11392]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Služba Plánovač2; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2009-12-14 619296]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-12-11 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-31 153376]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 wlcrasvc;Live Mesh Remote Desktop; C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe [2010-02-02 44880]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-05-15 593920]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-01 133104]
S2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe []
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-02-11 40384]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

COMBOFIX:

ComboFix 10-03-10.08 - Petr 11.03.2010 15:01:08.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3454.3064 [GMT 1:00]
Running from: c:\documents and settings\Petr\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Petr\Dokumenty\cc_20081209_205839.reg
c:\documents and settings\Petr\Dokumenty\cc_20090323_182253.reg
c:\documents and settings\Petr\Dokumenty\cc_20091002_092120.reg
c:\documents and settings\Petr\Dokumenty\products.reg
c:\documents and settings\Petr\Dokumenty\ZbThumbnail.info

.
((((((((((((((((((((((((( Files Created from 2010-02-11 to 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-11 13:53 . 2010-03-11 13:56 -------- d-----w- C:\32788R22FWJFW
2010-03-11 13:26 . 2010-03-11 13:26 -------- d-----w- C:\ATI
2010-03-11 13:02 . 2009-12-11 20:41 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-03-11 12:57 . 2010-03-11 12:57 -------- d-----w- C:\AMD
2010-03-10 23:07 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 19:28 . 2010-03-10 19:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-10 15:09 . 2010-03-10 16:54 -------- d-----w- c:\program files\Lineage II
2010-03-08 19:35 . 2010-03-08 19:36 -------- d-----w- C:\QIP Infium JadrisPack
2010-02-26 16:11 . 2010-02-26 16:11 -------- d-----w- c:\program files\GSC Game World
2010-02-22 16:13 . 2010-02-22 16:13 -------- d-----w- c:\program files\7-Zip
2010-02-22 14:49 . 2010-02-22 14:52 -------- d-----w- c:\program files\scol
2010-02-21 10:10 . 2001-10-24 11:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-02-21 10:10 . 2008-04-14 07:51 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-02-21 10:10 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-02-21 10:10 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-02-18 18:10 . 1998-11-18 15:33 144384 ----a-w- c:\windows\system32\Iacenc.dll
2010-02-18 18:10 . 1997-06-13 07:56 56832 ----a-w- c:\windows\system32\Iyvu9_32.dll
2010-02-18 18:01 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-18 17:39 . 2010-02-18 17:39 -------- d-----w- c:\program files\Cenega Czech
2010-02-18 17:26 . 2010-02-24 16:28 -------- d-----w- c:\program files\Warcraft III
2010-02-18 15:49 . 2010-02-18 15:49 -------- d-----w- c:\program files\Activision
2010-02-17 18:19 . 2010-02-17 18:19 -------- d-----w- c:\program files\WoW - TBC
2010-02-17 15:52 . 2010-02-17 15:52 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-02-17 15:39 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-02-17 15:39 . 2008-07-12 07:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-02-17 15:38 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-02-17 15:38 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-02-17 15:36 . 2010-02-17 15:36 -------- d-----w- c:\program files\PerformanceTest
2010-02-17 15:35 . 2009-10-06 17:32 327168 ----a-w- c:\windows\system32\cutil32.dll
2010-02-17 15:35 . 2009-08-03 19:25 285696 ----a-w- c:\windows\system32\cudart.dll
2010-02-17 15:35 . 2010-02-17 15:35 -------- d-----w- c:\program files\CPUID
2010-02-17 14:47 . 2010-02-17 14:47 -------- d-----w- c:\program files\oZone3D
2010-02-17 13:12 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
2010-02-17 13:11 . 2010-02-17 13:11 -------- d-----w- c:\windows\Logs
2010-02-17 13:11 . 2010-02-17 13:11 -------- d-----w- c:\windows\system32\temp
2010-02-17 13:11 . 2010-02-17 13:11 -------- d-----w- c:\program files\BurnInTest
2010-02-16 18:23 . 2010-03-11 13:02 -------- dc----w- c:\windows\system32\DRVSTORE
2010-02-16 18:21 . 2010-02-16 21:04 -------- d-----w- c:\program files\Common Files\LogiShrd
2010-02-16 13:07 . 2010-03-09 12:01 -------- d-----w- c:\program files\SpeedFan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 13:10 . 2010-02-01 08:53 -------- d-----w- c:\program files\Trillian
2010-03-11 13:08 . 2010-01-30 09:11 -------- d-----w- c:\program files\ATI Technologies
2010-03-11 13:04 . 2010-01-30 09:18 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-03-10 11:22 . 2010-01-31 10:18 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-03-07 16:54 . 2010-01-30 09:06 -------- d-----w- c:\program files\CCleaner
2010-02-26 15:26 . 2010-02-01 11:02 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-22 16:51 . 2010-01-30 17:27 -------- d-----w- c:\program files\Free Download Manager
2010-02-18 18:10 . 2010-01-29 16:52 -------- d-----w- c:\program files\Intel
2010-02-16 13:23 . 2010-01-30 09:07 -------- d-----w- c:\program files\Recuva
2010-02-16 13:23 . 2010-01-30 09:07 -------- d-----w- c:\program files\Defraggler
2010-02-11 18:53 . 2010-02-01 16:29 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-02-11 18:53 . 2010-02-01 16:29 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-02-11 18:42 . 2010-02-01 16:30 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-11 18:42 . 2010-02-01 16:30 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-11 18:39 . 2010-02-01 16:30 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-11 18:38 . 2010-02-01 16:30 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-11 18:38 . 2010-02-01 16:30 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-11 18:38 . 2010-02-01 16:30 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-11 18:38 . 2010-02-01 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-02 17:37 . 2010-02-02 17:37 -------- d-----w- c:\program files\Live Mesh
2010-02-02 17:36 . 2010-02-02 17:37 9040 ----a-w- c:\windows\system32\drivers\rdpdispm.sys
2010-02-02 17:36 . 2010-02-02 17:37 19408 ----a-w- c:\windows\system32\drivers\rdpvmp.sys
2010-02-02 17:36 . 2010-02-02 17:37 15696 ----a-w- c:\windows\system32\rdpvdd.dll
2010-02-02 17:36 . 2010-02-02 17:37 118736 ----a-w- c:\windows\system32\rdpdispd.dll
2010-02-01 16:32 . 2010-02-01 16:30 -------- d-----w- c:\program files\Google
2010-02-01 16:29 . 2010-02-01 16:29 -------- d-----w- c:\program files\Alwil Software
2010-02-01 11:14 . 2010-02-01 11:14 -------- d-----w- c:\program files\Alcohol Soft
2010-02-01 10:25 . 2010-01-30 11:12 -------- d-----w- c:\program files\FreeCommander
2010-02-01 00:59 . 2010-02-01 00:59 1396928 ----a-w- c:\windows\system32\auto_reactivate.exe
2010-01-31 18:42 . 2010-01-31 09:32 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-31 18:07 . 2010-01-31 18:06 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-31 17:35 . 2010-01-31 17:34 -------- d-----w- c:\program files\OpenOffice.org 3
2010-01-31 17:27 . 2010-01-31 17:21 -------- d-----r- c:\program files\Skype
2010-01-31 17:24 . 2010-01-31 17:24 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-01-31 17:21 . 2010-01-31 17:21 -------- d-----w- c:\program files\Common Files\Skype
2010-01-31 17:19 . 2010-01-31 17:19 -------- d-----w- c:\program files\WinSCP
2010-01-31 17:18 . 2010-01-31 17:18 -------- d-----w- c:\program files\PSPad editor
2010-01-31 17:17 . 2010-01-31 17:16 -------- d-----w- c:\program files\Combined Community Codec Pack
2010-01-31 12:50 . 2010-01-31 12:50 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-31 12:06 . 2003-04-16 12:00 487676 ----a-w- c:\windows\system32\perfh005.dat
2010-01-31 12:06 . 2003-04-16 12:00 108484 ----a-w- c:\windows\system32\perfc005.dat
2010-01-31 10:22 . 2010-01-31 10:21 -------- d-----w- c:\program files\MozBackup
2010-01-31 09:42 . 2010-01-31 09:42 -------- d-----w- c:\program files\Zoner
2010-01-31 09:33 . 2010-01-31 09:33 -------- d-----w- c:\program files\GIMP-2.0
2010-01-31 09:30 . 2010-01-31 09:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-31 09:30 . 2010-01-31 09:30 -------- d-----w- c:\program files\Java
2010-01-31 09:20 . 2010-01-31 09:20 902432 ----a-w- c:\windows\system32\drivers\tdrpm251.sys
2010-01-31 09:20 . 2010-01-31 09:20 570016 ----a-w- c:\windows\system32\drivers\timntr.sys
2010-01-31 09:19 . 2010-01-31 09:19 156928 ----a-w- c:\windows\system32\drivers\snapman.sys
2010-01-31 09:19 . 2010-01-31 09:18 -------- d-----w- c:\program files\Common Files\Acronis
2010-01-31 09:18 . 2010-01-31 09:18 -------- d-----w- c:\program files\Acronis
2010-01-30 10:08 . 2010-01-30 10:08 -------- d-----w- c:\program files\ATI
2010-01-30 09:26 . 2010-01-30 09:26 0 ----a-w- c:\windows\ativpsrm.bin
2010-01-30 09:19 . 2010-01-29 16:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-30 09:19 . 2010-01-29 16:51 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-29 21:17 . 2010-01-29 21:17 -------- d-----w- c:\program files\MSBuild
2010-01-29 21:17 . 2010-01-29 21:17 -------- d-----w- c:\program files\Reference Assemblies
2010-01-29 19:51 . 2010-01-29 19:51 -------- d-----w- c:\program files\MSECache
2010-01-29 19:21 . 2010-01-29 19:11 -------- d-----w- c:\program files\Canon
2010-01-29 18:59 . 2010-01-29 18:59 -------- d-----w- c:\program files\Lavalys
2010-01-29 18:58 . 2010-01-29 18:58 0 ----a-w- c:\windows\nsreg.dat
2010-01-29 17:34 . 2010-01-29 16:43 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-01-29 17:34 . 2010-01-29 16:43 2378 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-01-29 17:13 . 2010-01-29 16:43 8972 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cntstore.bin
2010-01-29 16:57 . 2010-01-29 16:57 -------- d-----w- c:\program files\Analog Devices
2010-01-29 16:44 . 2010-01-29 16:44 -------- d-----w- c:\program files\microsoft frontpage
2010-01-29 16:41 . 2010-01-29 16:41 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-14 10:12 . 2010-01-29 17:49 181120 ------w- c:\windows\system32\MpSigStub.exe
2009-12-31 16:50 . 2010-01-29 17:09 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:09 . 2009-12-22 05:09 81920 ------w- c:\windows\system32\ieencode.dll
2009-12-21 19:08 . 2010-01-29 17:09 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2010-01-29 17:10 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-16 07:19 . 2010-02-01 10:50 282624 ------w- c:\windows\system32\fppr332.dll
2009-12-16 07:19 . 2010-02-01 10:46 405504 ------w- c:\windows\system32\fpres632.dll
2009-12-15 12:52 . 2010-02-01 10:50 393216 ------w- c:\windows\system32\fppmon3.dll
2009-12-14 13:22 . 2010-02-01 10:46 393216 ------w- c:\windows\system32\fpmon6.dll
2009-12-14 07:10 . 2010-01-29 17:09 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 21:02 . 2010-01-29 17:31 4525056 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-12-11 20:45 . 2009-05-16 01:35 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-11 20:44 . 2009-05-16 01:34 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-11 20:43 . 2009-05-16 01:33 3620864 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-11 20:26 . 2010-01-30 09:16 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-11 20:25 . 2010-01-29 17:32 300544 ----a-w- c:\windows\system32\ati2dvag.dll
2009-12-11 20:25 . 2009-05-16 02:55 13434880 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-11 20:23 . 2010-01-29 17:32 3521408 ----a-w- c:\windows\system32\ati3duag.dll
2009-12-11 20:09 . 2009-05-16 03:18 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-11 20:09 . 2009-05-16 03:17 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-11 20:09 . 2009-05-16 03:17 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-12-11 20:08 . 2009-05-16 03:17 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-11 20:08 . 2009-05-16 03:17 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-12-11 20:07 . 2010-01-29 17:32 2154752 ----a-w- c:\windows\system32\ativvaxx.dll
2009-12-11 20:07 . 2010-01-30 09:16 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-12-11 20:07 . 2010-01-30 09:16 3 ----a-w- c:\windows\system32\ativva5x.dat
2009-12-11 20:07 . 2009-05-16 03:15 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-12-11 20:05 . 2009-05-16 03:14 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-12-11 20:01 . 2009-05-16 02:33 565248 ----a-w- c:\windows\system32\atikvmag.dll
2009-12-11 19:59 . 2009-05-16 02:31 176128 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-11 19:58 . 2009-05-16 02:31 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-12-11 19:57 . 2009-05-16 02:26 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2009-12-11 19:52 . 2010-01-29 17:32 638976 ----a-w- c:\windows\system32\ati2cqag.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2009-01-31 3399727]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"alcohol.exe Autorun"="c:\program files\Alcohol Soft\Alcohol 120\Alcohol.exe" [2010-02-04 3347968]
"MoeMonitor.exe"="c:\documents and settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe" [2010-02-02 1315152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-05-20 98304]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-12-14 4377960]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-12-14 962272]
"Acronis Služba Plánovač2"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-12-14 377600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-31 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"pdfFactory Pro Dispatcher v3"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2009-12-15 614400]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Luk\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-9-16 384512]

c:\documents and settings\Radka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-9-16 384512]

c:\documents and settings\Viktor\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-9-16 384512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlcrdplauncher]
2010-02-02 17:35 21840 ----a-w- c:\program files\Live Mesh\Remote Desktop\wlcrdplauncher.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ auto_reactivate c:\bootwiz\asrm.bin\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Live Mesh\\Remote Desktop\\wlcrasvc.exe"=
"c:\\Documents and Settings\\Petr\\Local Settings\\Data aplikací\\Microsoft\\Live Mesh\\GacBase\\Moe.exe"=
"c:\\Program Files\\scol\\scolsetup.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1.2.2010 12:02 721904]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\drivers\tdrpm251.sys [31.1.2010 10:20 902432]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.2.2010 17:30 162512]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.2.2010 17:30 19024]
R2 wlcrasvc;Live Mesh Remote Desktop;c:\program files\Live Mesh\Remote Desktop\wlcrasvc.exe [2.2.2010 18:37 44880]
R3 RDPDISPM;RDPDISPM;c:\windows\system32\drivers\rdpdispm.sys [2.2.2010 18:37 9040]
R3 RDPVDD;RDPVDD;c:\windows\system32\drivers\rdpvmp.sys [2.2.2010 18:37 19408]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.2.2010 17:30 133104]
.
Contents of the 'Scheduled Tasks' folder

2010-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 16:30]

2010-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 16:30]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
TCP: {3F3062C2-810E-48D3-9928-3E3ACBD07A22} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\he0dhx7v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\he0dhx7v.default\extensions\mintrayr@tn123.ath.cx\components\trayToolkit.dll
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 15:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys hal.dll sfsync02.sys atapi.sys spoq.sys >>UNKNOWN [0x8A3FA938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf7495cb8
\Driver\atapi -> sfsync02.sys @ 0xf7717d60
IoDeviceObjectType -> ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7a37bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7a44a21
SendHandler -> NDIS.sys @ 0xf7a2287b
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1072)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2572)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP\DragExt.dll
c:\documents and settings\Petr\Local Settings\Data aplikací\Microsoft\Live Mesh\Bin\WLCShell.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-03-11 15:49:50 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-11 14:49

Pre-Run: Volných bajtů: 293 389 291 520
Post-Run: Volných bajtů: 293 673 385 984

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 95D01871D67BE2A73446780EC7E29844

Dnes jste dělal sken ComboFix. Dejte z něj log.

Log z Combofixu je už v příspěvku.

Omlouvám se za přehlédnutí. CF něco smazal, zbytek logu vypadá OK. Udělejte sken IceSword: http://www.viry.cz/forum/viewtopic.php?f=29&t=11394 a dejte logy Process a KernelModule.

Process:

System Idle Process
System
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe
C:\WINDOWS\system32\smss.exe
C:\Documents and Settings\Petr\Local Settings\Data aplikacˇ\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\DOCUME~1\Petr\LOCALS~1\temp\FreeCommander2036\2\IceSword.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Documents and Settings\Petr\Local Settings\Data aplikacˇ\Microsoft\Live Mesh\GacBase\Moe.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\OO Software\Defrag\oodag.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FreeCommander\FreeCommander.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\alg.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files\Free Download Manager\fdm.exe


Kernel Module:

\WINDOWS\system32\ntoskrnl.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
spsy.sys
\WINDOWS\System32\Drivers\WMILIB.SYS
\WINDOWS\System32\Drivers\SCSIPORT.SYS
ACPI.sys
pci.sys
isapnp.sys
pciide.sys
\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
sfsync02.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\System32\DRIVERS\CLASSPNP.SYS
fltmgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
timntr.sys
tdrpm251.sys
speedfan.sys
snapman.sys
sfhlp02.sys
sfdrv01.sys
Mup.sys
giveio.sys
agp440.sys
\SystemRoot\system32\DRIVERS\rdpdispm.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\rdpvmp.sys
\SystemRoot\System32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\ati2mtag.sys
\SystemRoot\System32\DRIVERS\usbuhci.sys
\SystemRoot\System32\DRIVERS\USBPORT.SYS
\SystemRoot\System32\DRIVERS\usbehci.sys
\SystemRoot\System32\DRIVERS\yk51x86.sys
\SystemRoot\System32\DRIVERS\serial.sys
\SystemRoot\System32\DRIVERS\serenum.sys
\SystemRoot\System32\DRIVERS\fdc.sys
\SystemRoot\System32\DRIVERS\parport.sys
\SystemRoot\System32\DRIVERS\imapi.sys
\SystemRoot\System32\DRIVERS\cdrom.sys
\SystemRoot\System32\DRIVERS\redbook.sys
\SystemRoot\System32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\smwdm.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\aeaudio.sys
\SystemRoot\System32\Drivers\alhdqk9q.SYS
\SystemRoot\System32\DRIVERS\audstub.sys
\SystemRoot\System32\DRIVERS\rasl2tp.sys
\SystemRoot\System32\DRIVERS\ndistapi.sys
\SystemRoot\System32\DRIVERS\ndiswan.sys
\SystemRoot\System32\DRIVERS\raspppoe.sys
\SystemRoot\System32\DRIVERS\raspptp.sys
\SystemRoot\System32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\psched.sys
\SystemRoot\System32\DRIVERS\msgpc.sys
\SystemRoot\System32\DRIVERS\ptilink.sys
\SystemRoot\System32\DRIVERS\raspti.sys
\SystemRoot\System32\DRIVERS\termdd.sys
\SystemRoot\System32\DRIVERS\kbdclass.sys
\SystemRoot\System32\DRIVERS\mouclass.sys
\SystemRoot\System32\DRIVERS\swenum.sys
\SystemRoot\System32\DRIVERS\update.sys
\SystemRoot\System32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\DRIVERS\usbhub.sys
\SystemRoot\System32\DRIVERS\USBD.SYS
\SystemRoot\System32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\DRIVERS\ipsec.sys
\SystemRoot\System32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbios.sys
\SystemRoot\System32\DRIVERS\rdbss.sys
\SystemRoot\System32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\DRIVERS\ipnat.sys
\??\C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\System32\Drivers\Aavmker4.SYS
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\System32\DRIVERS\usbprint.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\DRIVERS\usbccgp.sys
\SystemRoot\System32\DRIVERS\hidusb.sys
\SystemRoot\System32\DRIVERS\HIDCLASS.SYS
\SystemRoot\System32\DRIVERS\kbdhid.sys
\SystemRoot\System32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\ati2dvag.dll
\SystemRoot\System32\ati2cqag.dll
\SystemRoot\System32\atikvmag.dll
\SystemRoot\System32\atiok3x2.dll
\SystemRoot\System32\ati3duag.dll
\SystemRoot\System32\ativvaxx.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\System32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\aswMon2.SYS
\SystemRoot\System32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\aswRdr.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\drivers\kmixer.sys
\SystemRoot\System32\Drivers\HTTP.sys
\??\C:\WINDOWS\system32\Drivers\FILEM70.SYS
\SystemRoot\System32\Drivers\IsDrv122.sys
\WINDOWS\system32\ntdll.dll
\Program Files\Alcohol Soft\Alcohol 120\alcoholx.dll
C:\WINDOWS\system32\giveio.sys
C:\WINDOWS\system32\speedfan.sys
C:\WINDOWS\System32\Drivers\sptd.sys

Ani rootkit v systému nevidím. Zkuste obnovu systému k datu, kdy korektně fungoval.

Tak bohužel ani toto nepomohlo. Nevím co se s PC děje, ale v systray mám čím dál míň ikon. Napřed zmizel ATI Catalyst, pak Avast a teď už i Free Download Manager a OO defrag. Přitom v procesech jsou. Dál mi při startu vypíše MBR Error3 a pak klidně pokračuje v zavedení WIN. Asi budu muset provést obnovu z img čistého systému a vše znovu instalovat. Nejvíc mě štve, že jsem reinstalaci dělal v lednu.

Proveďte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 . problém ale může být i v poškozeném systému.