Problem s padanim pc

[maxxooo]

zdravim pani pred nejakym casom som sem pisal koli problemu s padanim vsetkych prehliadacov a a naslednym restartovanim. Tento problem som nakoniec vyriesil reinstalaciou- teda to som si aspon myslel.Teraz sa problem objavil bohuzial znova a k tomu sa pridal aj iny problem a to ze pc zacina sam od seba pracovat na plny vykon- napr. v pc wizard mi ukazuje ze vsetky jadra su takmer na 100% vytazene. Chcel by som vas teda poprosit o to, ci by ste nemohli pozret ci tam nie je nejaky "bordel". Bol by som Vam velmi vdacny. Operacny system mam windows XP 32bit SP3 so vsetkymi aktualizaciami

log z RSIT:
Logfile of random's system information tool 1.06 (written by random/random)
Run by computer at 2010-03-16 17:25:52
Systém Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 69 GB (87%) free of 80 GB
Total RAM: 1791 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:00, on 16.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\computer\My Documents\Preberanie\RSIT.exe
C:\Program Files\trend micro\computer.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe" -b
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

--
End of file - 4862 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004UA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-11-18 1196936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-11-18 1196936]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"=C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [2009-08-20 5782528]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-18 98304]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [2009-08-28 33673216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-05 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-19 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-16 17:25:52 ----D---- C:\rsit
2010-03-16 17:25:52 ----D---- C:\Program Files\trend micro
2010-03-10 11:56:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-09 12:49:38 ----D---- C:\WINDOWS\Minidump
2010-03-09 12:44:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2010-03-09 12:43:37 ----D---- C:\WINDOWS\system32\URTTEMP
2010-03-05 21:23:47 ----D---- C:\Program Files\Lavalys
2010-03-05 20:36:40 ----D---- C:\Documents and Settings\computer\Application Data\InstallShield
2010-03-05 20:24:32 ----A---- C:\WINDOWS\system32\cutil32.dll
2010-03-05 20:24:32 ----A---- C:\WINDOWS\system32\cudart.dll
2010-03-05 20:23:57 ----D---- C:\Program Files\CPUID
2010-03-05 20:23:12 ----D---- C:\Program Files\Ask.com
2010-03-05 20:23:03 ----D---- C:\Documents and Settings\computer\Application Data\GlarySoft
2010-03-05 20:23:02 ----D---- C:\Program Files\Glary Registry Repair
2010-03-05 20:02:41 ----D---- C:\WINDOWS\ie8updates
2010-03-05 20:02:13 ----D---- C:\WINDOWS\WBEM
2010-03-05 20:01:23 ----HDC---- C:\WINDOWS\ie8
2010-03-05 20:01:23 ----D---- C:\WINDOWS\system32\sk-SK
2010-03-05 20:00:16 ----A---- C:\WINDOWS\system32\normaliz.dll
2010-03-05 20:00:16 ----A---- C:\WINDOWS\system32\nlsdl.dll
2010-03-05 20:00:16 ----A---- C:\WINDOWS\system32\idndl.dll
2010-03-05 20:00:15 ----N---- C:\WINDOWS\system32\WinFXDocObj.exe
2010-03-05 20:00:15 ----N---- C:\WINDOWS\system32\msrating.dll.mui
2010-03-05 20:00:15 ----N---- C:\WINDOWS\system32\mshta.exe.mui
2010-03-05 20:00:15 ----A---- C:\WINDOWS\system32\msdbg2.dll
2010-03-05 20:00:15 ----A---- C:\WINDOWS\system32\ieudinit.exe
2010-03-05 20:00:14 ----N---- C:\WINDOWS\system32\msfeedssync.exe
2010-03-05 20:00:14 ----N---- C:\WINDOWS\system32\ieui.dll
2010-03-05 20:00:14 ----N---- C:\WINDOWS\system32\ieframe.dll.mui
2010-03-05 20:00:14 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2010-03-05 20:00:14 ----A---- C:\WINDOWS\system32\msfeeds.dll
2010-03-05 20:00:14 ----A---- C:\WINDOWS\system32\iertutil.dll
2010-03-05 20:00:13 ----N---- C:\WINDOWS\system32\iedkcs32.dll.mui
2010-03-05 20:00:13 ----N---- C:\WINDOWS\system32\ieapfltr.dll
2010-03-05 20:00:13 ----N---- C:\WINDOWS\system32\ie4uinit.exe.mui
2010-03-05 20:00:13 ----N---- C:\WINDOWS\system32\icardie.dll
2010-03-05 20:00:13 ----N---- C:\WINDOWS\system32\advpack.dll.mui
2010-03-05 20:00:13 ----A---- C:\WINDOWS\system32\ieframe.dll
2010-03-05 19:49:09 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-05 19:49:04 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-03-05 19:49:01 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-03-05 19:48:43 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-03-05 19:48:26 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-05 16:20:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-03-05 16:20:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-03-05 16:20:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-03-05 16:20:08 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-03-05 16:20:05 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-03-05 16:20:02 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-03-05 16:19:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-03-05 16:19:56 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-03-05 16:19:49 ----HDC---- C:\WINDOWS\$NtUninstallKB978207$
2010-03-05 16:19:47 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-03-05 16:19:43 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-03-05 16:19:40 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-03-05 16:19:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-03-05 16:19:34 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-03-05 16:19:31 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2010-03-05 16:19:29 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-03-05 16:19:26 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-03-05 16:19:23 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-03-05 16:19:20 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-03-05 16:19:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-03-05 16:19:15 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-03-05 16:19:12 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-03-05 16:19:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-03-05 16:19:06 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-03-05 16:19:02 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-03-05 16:18:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-03-05 16:18:55 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-03-05 16:18:53 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-03-05 16:18:50 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-03-05 16:18:47 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-03-05 16:18:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-03-05 16:18:40 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-03-05 16:18:37 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-03-05 16:18:34 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-03-05 16:18:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-03-05 16:18:28 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-03-05 16:18:25 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-03-05 16:18:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-03-05 16:18:19 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-03-05 16:18:15 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-03-05 16:18:11 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-03-05 16:18:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2010-03-05 16:18:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-03-05 16:18:03 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-03-05 16:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2010-03-05 16:17:57 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2010-03-05 16:17:54 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-03-05 16:17:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-03-05 16:17:46 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-03-05 16:17:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-03-05 16:17:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-03-05 16:17:36 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-03-05 16:17:33 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-03-05 16:17:30 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-03-05 16:17:27 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-03-05 16:17:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-03-05 16:17:16 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-03-05 16:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-03-05 16:17:10 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2010-03-05 16:17:07 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-03-05 16:17:04 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-03-05 16:16:59 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-03-05 16:13:33 ----A---- C:\WINDOWS\system32\ksuser.dll
2010-03-05 16:13:14 ----N---- C:\WINDOWS\system32\difxapi.dll
2010-03-05 16:13:13 ----D---- C:\Program Files\VIA
2010-03-05 16:09:51 ----A---- C:\WINDOWS\iun6002.exe
2010-03-05 16:09:48 ----D---- C:\Program Files\Codec Pack - All In 1
2010-03-05 16:07:35 ----A---- C:\WINDOWS\Codec Pack - All In 1 Setup Log.txt
2010-03-05 15:59:34 ----D---- C:\Program Files\UlisesSoft
2010-03-05 15:49:40 ----D---- C:\WINDOWS\system32\XPSViewer
2010-03-05 15:49:36 ----D---- C:\Program Files\Reference Assemblies
2010-03-05 15:49:23 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2010-03-05 15:49:23 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2010-03-05 15:49:23 ----N---- C:\WINDOWS\system32\prntvpt.dll
2010-03-05 15:49:23 ----D---- C:\e68a8b85765107e3babe605d0d7e15
2010-03-05 15:42:15 ----D---- C:\WINDOWS\Prefetch
2010-03-05 15:39:30 ----D---- C:\WINDOWS\system32\scripting
2010-03-05 15:39:30 ----D---- C:\WINDOWS\system32\en-us
2010-03-05 15:39:29 ----D---- C:\WINDOWS\system32\en
2010-03-05 15:39:29 ----D---- C:\WINDOWS\l2schemas
2010-03-05 15:39:28 ----D---- C:\WINDOWS\system32\bits
2010-03-05 15:36:37 ----D---- C:\WINDOWS\ServicePackFiles
2010-03-05 15:34:29 ----D---- C:\WINDOWS\network diagnostic
2010-03-05 15:31:47 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-03-05 15:31:05 ----D---- C:\WINDOWS\EHome
2010-03-05 15:28:50 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-03-05 15:26:43 ----SHD---- C:\RECYCLER
2010-03-05 15:23:07 ----A---- C:\WINDOWS\system32\h323log.txt
2010-03-05 15:21:00 ----A---- C:\WINDOWS\system32\MRT.exe
2010-03-05 15:20:50 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
2010-03-05 15:19:33 ----A---- C:\WINDOWS\system32\usbui.dll
2010-03-05 15:18:50 ----A---- C:\WINDOWS\imsins.BAK
2010-03-05 15:18:49 ----SHD---- C:\WINDOWS\Installer
2010-03-05 15:18:49 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-03-05 15:18:48 ----D---- C:\Program Files\Common Files\ODBC
2010-03-05 15:18:48 ----A---- C:\WINDOWS\ODBCINST.INI
2010-03-05 15:18:46 ----D---- C:\Program Files\Common Files\SpeechEngines
2010-03-05 15:18:45 ----RD---- C:\Program Files
2010-03-05 15:18:45 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-03-05 15:18:45 ----D---- C:\Program Files\Common Files
2010-03-05 15:18:43 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-03-05 15:18:43 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-03-05 15:18:43 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-03-05 15:18:42 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-03-05 15:18:41 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-03-05 15:18:40 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-03-05 15:18:40 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-03-05 15:18:40 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-03-05 15:18:40 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-03-05 15:18:40 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdro.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2010-03-05 15:18:38 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2010-03-05 15:18:37 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-03-05 15:18:37 ----A---- C:\WINDOWS\system32\irclass.dll
2010-03-05 15:18:37 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-03-05 15:18:37 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-03-05 15:18:36 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-03-05 15:18:35 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-03-05 15:18:35 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-03-05 15:18:35 ----A---- C:\WINDOWS\system32\batt.dll
2010-03-05 15:18:34 ----A---- C:\WINDOWS\system32\storprop.dll
2010-03-05 15:18:34 ----A---- C:\WINDOWS\notepad.exe
2010-03-05 15:18:28 ----RA---- C:\WINDOWS\SET25.tmp
2010-03-05 15:18:28 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2010-03-05 15:18:26 ----RA---- C:\WINDOWS\SET8.tmp
2010-03-05 15:18:24 ----RA---- C:\WINDOWS\SET4.tmp
2010-03-05 15:18:23 ----RA---- C:\WINDOWS\SET3.tmp
2010-03-05 15:18:19 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-05 15:18:19 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-05 15:18:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-03-05 15:17:57 ----A---- C:\WINDOWS\setuplog.txt
2010-03-05 15:17:55 ----D---- C:\Documents and Settings
2010-03-05 15:17:27 ----RSH---- C:\boot.ini
2010-03-05 15:15:53 ----D---- C:\Documents and Settings\computer\Application Data\Mozilla
2010-03-05 15:15:48 ----D---- C:\Program Files\Mozilla Firefox
2010-03-05 15:15:22 ----SHD---- C:\System Volume Information
2010-03-05 15:14:59 ----A---- C:\WINDOWS\system32\msonpmon.dll
2010-03-05 15:14:34 ----D---- C:\Program Files\Microsoft Works
2010-03-05 15:14:22 ----D---- C:\Program Files\MSBuild
2010-03-05 15:14:05 ----D---- C:\Program Files\Microsoft Visual Studio
2010-03-05 15:14:05 ----D---- C:\Program Files\Common Files\DESIGNER
2010-03-05 15:13:32 ----D---- C:\Program Files\Microsoft.NET
2010-03-05 15:12:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-05 15:12:26 ----RSD---- C:\WINDOWS\Fonts
2010-03-05 15:12:26 ----RD---- C:\WINDOWS\Web
2010-03-05 15:12:26 ----HD---- C:\WINDOWS\inf
2010-03-05 15:12:26 ----D---- C:\WINDOWS\WinSxS
2010-03-05 15:12:26 ----D---- C:\WINDOWS\twain_32
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Temp
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\wins
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\wbem
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\usmt
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\spool
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\ShellExt
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\Setup
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\ras
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\oobe
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\npp
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\mui
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\inetsrv
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\IME
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\icsxml
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\ias
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\export
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\drivers
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\dhcp
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\config
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\3com_dmi
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\3076
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\2052
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1054
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1042
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1041
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1037
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1033
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1031
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1028
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32\1025
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system32
2010-03-05 15:12:26 ----D---- C:\WINDOWS\system
2010-03-05 15:12:26 ----D---- C:\WINDOWS\security
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Resources
2010-03-05 15:12:26 ----D---- C:\WINDOWS\repair
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Provisioning
2010-03-05 15:12:26 ----D---- C:\WINDOWS\pchealth
2010-03-05 15:12:26 ----D---- C:\WINDOWS\PeerNet
2010-03-05 15:12:26 ----D---- C:\WINDOWS\mui
2010-03-05 15:12:26 ----D---- C:\WINDOWS\msapps
2010-03-05 15:12:26 ----D---- C:\WINDOWS\msagent
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Media
2010-03-05 15:12:26 ----D---- C:\WINDOWS\java
2010-03-05 15:12:26 ----D---- C:\WINDOWS\ime
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Help
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Driver Cache
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Debug
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Cursors
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Connection Wizard
2010-03-05 15:12:26 ----D---- C:\WINDOWS\Config
2010-03-05 15:12:26 ----D---- C:\WINDOWS\AppPatch
2010-03-05 15:12:26 ----D---- C:\WINDOWS\addins
2010-03-05 15:12:26 ----D---- C:\WINDOWS
2010-03-05 15:11:58 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-03-05 15:11:35 ----D---- C:\WINDOWS\SHELLNEW
2010-03-05 15:11:29 ----D---- C:\Program Files\Microsoft Office
2010-03-05 15:11:28 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-03-05 15:11:18 ----RHD---- C:\MSOCache
2010-03-05 15:08:12 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2010-03-05 15:06:23 ----D---- C:\Documents and Settings\computer\Application Data\WinRAR
2010-03-05 15:05:17 ----D---- C:\Documents and Settings\computer\Application Data\ATI
2010-03-05 15:05:17 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2010-03-05 15:04:15 ----D---- C:\WINDOWS\system32\PreInstall
2010-03-05 15:04:15 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-03-05 15:04:14 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2010-03-05 15:03:44 ----D---- C:\Program Files\WinRAR
2010-03-05 15:03:28 ----D---- C:\Documents and Settings\computer\Application Data\ESET
2010-03-05 15:02:29 ----D---- C:\Program Files\ESET
2010-03-05 15:02:29 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-03-05 14:58:17 ----RA---- C:\WINDOWS\system32\RTLTEAMING_NB.DLL
2010-03-05 14:56:17 ----A---- C:\WINDOWS\system32\MSVCRTD.DLL
2010-03-05 14:56:16 ----A---- C:\WINDOWS\system32\mfc42d.dll
2010-03-05 14:54:22 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-03-05 14:54:18 ----D---- C:\Documents and Settings\computer\Application Data\Macromedia
2010-03-05 14:54:17 ----D---- C:\Documents and Settings\computer\Application Data\Adobe
2010-03-05 14:54:04 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-03-05 14:53:56 ----D---- C:\Program Files\Common Files\Adobe
2010-03-05 14:53:56 ----D---- C:\Program Files\Adobe
2010-03-05 14:48:41 ----RSD---- C:\WINDOWS\assembly
2010-03-05 14:48:30 ----D---- C:\WINDOWS\Microsoft.NET
2010-03-05 14:47:34 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2010-03-05 14:46:48 ----RA---- C:\WINDOWS\system32\atiiiexx.dll
2010-03-05 14:46:45 ----RA---- C:\WINDOWS\system32\ATIDEMGX.dll
2010-03-05 14:46:11 ----D---- C:\Program Files\ATI Technologies
2010-03-05 14:45:06 ----RA---- C:\WINDOWS\system32\AsIO.dll
2010-03-05 14:45:05 ----D---- C:\Program Files\ASUS
2010-03-05 14:44:47 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-03-05 14:44:41 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-03-05 14:44:38 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-03-05 14:44:37 ----D---- C:\Program Files\AMD
2010-03-05 14:43:44 ----RA---- C:\WINDOWS\system32\RtNicProp32.dll
2010-03-05 14:43:36 ----D---- C:\Program Files\Realtek
2010-03-05 14:42:55 ----HD---- C:\Program Files\InstallShield Installation Information
2010-03-05 14:42:47 ----D---- C:\Program Files\Common Files\InstallShield
2010-03-05 14:42:19 ----A---- C:\WINDOWS\Language_trs.ini
2010-03-05 14:42:13 ----A---- C:\WINDOWS\Ascd_tmp.ini
2010-03-05 14:39:22 ----A---- C:\WINDOWS\system32\wpa.bak
2010-03-05 14:31:53 ----D---- C:\WINDOWS\system32\1051
2010-03-05 14:31:34 ----D---- C:\temp
2010-03-05 14:30:18 ----D---- C:\Documents and Settings\computer\Application Data\Identities
2010-03-05 14:30:17 ----HD---- C:\Program Files\Uninstall Information
2010-03-05 14:30:14 ----SD---- C:\Documents and Settings\computer\Application Data\Microsoft
2010-03-05 14:30:14 ----ASH---- C:\Documents and Settings\computer\Application Data\desktop.ini
2010-03-05 14:29:18 ----D---- C:\WINDOWS\SoftwareDistribution
2010-03-05 14:29:17 ----SD---- C:\WINDOWS\system32\Microsoft
2010-03-05 14:29:16 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 14:27:30 ----D---- C:\WINDOWS\system32\xircom
2010-03-05 14:27:30 ----D---- C:\Program Files\xerox
2010-03-05 14:27:30 ----D---- C:\Program Files\microsoft frontpage
2010-03-05 14:27:27 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-03-05 14:27:26 ----HD---- C:\WINDOWS\$hf_mig$
2010-03-05 14:27:25 ----N---- C:\WINDOWS\system32\xpsp3res.dll
2010-03-05 14:27:15 ----A---- C:\WINDOWS\control.ini
2010-03-05 14:27:15 ----A---- C:\AUTOEXEC.BAT
2010-03-05 14:27:09 ----A---- C:\WINDOWS\OEWABLog.txt
2010-03-05 14:27:06 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-03-05 14:26:40 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-03-05 14:26:40 ----RD---- C:\WINDOWS\Offline Web Pages
2010-03-05 14:26:39 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-03-05 14:26:37 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-03-05 14:26:34 ----HD---- C:\Program Files\WindowsUpdate
2010-03-05 14:26:20 ----D---- C:\WINDOWS\system32\DirectX
2010-03-05 14:26:06 ----A---- C:\WINDOWS\system32\atrace.dll
2010-03-05 14:26:04 ----A---- C:\WINDOWS\system32\desktop.ini
2010-03-05 14:26:04 ----A---- C:\WINDOWS\desktop.ini
2010-03-05 14:25:59 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-03-05 14:25:58 ----D---- C:\Program Files\Common Files\Services
2010-03-05 14:25:58 ----A---- C:\WINDOWS\system32\acctres.dll
2010-03-05 14:25:56 ----SD---- C:\WINDOWS\Tasks
2010-03-05 14:25:56 ----D---- C:\Program Files\Common Files\MSSoap
2010-03-05 14:25:56 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-03-05 14:25:52 ----D---- C:\WINDOWS\system32\Macromed
2010-03-05 14:25:52 ----D---- C:\WINDOWS\srchasst
2010-03-05 14:25:50 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-03-05 14:25:50 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-03-05 14:25:50 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-03-05 14:25:50 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\wups.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\wuauclt.exe
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\qmgr.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-03-05 14:25:49 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-03-05 14:25:45 ----D---- C:\Program Files\Movie Maker
2010-03-05 14:25:43 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-03-05 14:25:43 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-03-05 14:25:43 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-03-05 14:25:43 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-03-05 14:25:40 ----A---- C:\WINDOWS\system32\fltmc.exe
2010-03-05 14:25:40 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-03-05 14:25:39 ----D---- C:\WINDOWS\system32\Restore
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\srsvc.dll
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\srclient.dll
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-03-05 14:25:39 ----A---- C:\WINDOWS\system32\ils.dll
2010-03-05 14:25:38 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-03-05 14:25:38 ----A---- C:\WINDOWS\system32\msconf.dll
2010-03-05 14:25:38 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-03-05 14:25:36 ----D---- C:\Program Files\NetMeeting
2010-03-05 14:25:36 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-03-05 14:25:36 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-03-05 14:25:36 ----A---- C:\WINDOWS\system32\inetres.dll
2010-03-05 14:25:35 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-03-05 14:25:34 ----D---- C:\Program Files\Outlook Express
2010-03-05 14:25:34 ----A---- C:\WINDOWS\system32\schedsvc.dll
2010-03-05 14:25:34 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-03-05 14:25:34 ----A---- C:\WINDOWS\system32\mstask.dll
2010-03-05 14:25:33 ----A---- C:\WINDOWS\system32\isign32.dll
2010-03-05 14:25:33 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-03-05 14:25:33 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-03-05 14:25:33 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-03-05 14:25:29 ----D---- C:\Program Files\Internet Explorer
2010-03-05 14:25:29 ----D---- C:\Program Files\Common Files\System
2010-03-05 14:25:19 ----D---- C:\Program Files\ComPlus Applications
2010-03-05 14:25:17 ----A---- C:\WINDOWS\vbaddin.ini
2010-03-05 14:25:17 ----A---- C:\WINDOWS\vb.ini
2010-03-05 14:25:13 ----D---- C:\WINDOWS\Registration
2010-03-05 14:24:57 ----D---- C:\Program Files\Online Services
2010-03-05 14:24:56 ----D---- C:\Program Files\Windows Media Player
2010-03-05 14:24:52 ----D---- C:\Program Files\Messenger
2010-03-05 14:24:50 ----D---- C:\Program Files\MSN Gaming Zone
2010-03-05 14:24:50 ----A---- C:\WINDOWS\system32\write.exe
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\winchat.exe
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\hticons.dll
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\avwav.dll
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-03-05 14:24:44 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-03-05 14:24:40 ----A---- C:\WINDOWS\system32\getuname.dll
2010-03-05 14:24:39 ----A---- C:\WINDOWS\system32\winmine.exe
2010-03-05 14:24:39 ----A---- C:\WINDOWS\system32\sol.exe
2010-03-05 14:24:39 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-03-05 14:24:39 ----A---- C:\WINDOWS\system32\charmap.exe
2010-03-05 14:24:39 ----A---- C:\WINDOWS\system32\calc.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\tskill.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\tscon.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\shadow.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\reset.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\regini.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\msg.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\logoff.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\freecell.exe
2010-03-05 14:24:38 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\stclient.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-03-05 14:24:37 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-03-05 14:24:34 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-03-05 14:24:21 ----D---- C:\Program Files\MSN
2010-03-05 14:24:20 ----D---- C:\Program Files\Windows NT
2010-03-05 14:24:20 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-03-05 14:24:20 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-03-05 14:24:20 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-03-05 14:24:20 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-03-05 14:24:20 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-03-05 14:24:19 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-03-05 14:24:19 ----A---- C:\WINDOWS\system32\spider.exe
2010-03-05 14:24:19 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-03-05 14:24:19 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\termsrv.dll
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-03-05 14:24:18 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-03-05 14:24:17 ----D---- C:\WINDOWS\system32\MsDtc
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-03-05 14:24:17 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-03-05 14:24:16 ----D---- C:\WINDOWS\system32\Com
2010-03-05 14:24:16 ----A---- C:\WINDOWS\system32\colbact.dll
2010-03-05 14:24:16 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-03-05 14:24:16 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-03-05 14:24:16 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-03-05 14:24:16 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-03-05 14:24:15 ----A---- C:\WINDOWS\system32\comuid.dll
2010-03-05 14:24:15 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-03-05 14:24:15 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-03-05 14:24:11 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-03-05 14:24:11 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-03-05 14:24:11 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-03-05 14:24:11 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2010-03-05 15:11:41 ----A---- C:\WINDOWS\win.ini
2010-03-05 14:33:39 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2009-08-04 11296]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 ASInsHelp;ASInsHelp; \??\C:\WINDOWS\system32\drivers\AsInsHelp32.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 RtNdPt5x;Realtek NDIS Protocol Driver; C:\WINDOWS\system32\DRIVERS\RtNdPt5x.sys [2008-07-09 22016]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-19 4477952]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-02-28 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-05-25 142336]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2009-08-17 1390976]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features; C:\WINDOWS\system32\DRIVERS\RTLTEAMING.SYS [2008-01-23 25984]
S3 RTLVLAN;Realtek VLAN Intermediate Driver; C:\WINDOWS\system32\DRIVERS\RTLVLAN.SYS [2008-05-26 17408]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD_RAIDXpert;AMD RAIDXpert; C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-03-16 122880]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-19 602112]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[maxxooo]

Vdaka za pomoc
prave teraz sa k tomu pc uz nedostanem tak hned zajtra ten log vlozim

[Rudy]

OK. Ozvěte se.

[maxxooo]

Tak uz som sa k tomu dostal a tu je log:

ComboFix 10-03-16.03 - computer 17.03.2010 9:02.1.4 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1791.1212 [GMT 1:00]
Running from: c:\documents and settings\computer\Desktop\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\system32\mshtml.dll was found and disinfected
Restored copy from - c:\windows\ie8\mshtml.dll

.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-16 16:25 . 2010-03-16 16:26 -------- d-----w- C:\rsit
2010-03-16 16:25 . 2010-03-16 16:26 -------- d-----w- c:\program files\trend micro
2010-03-10 10:56 . 2010-03-11 16:17 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\ApplicationHistory
2010-03-10 10:56 . 2010-03-10 10:56 131 ----a-w- c:\documents and settings\computer\Local Settings\Application Data\fusioncache.dat
2010-03-10 10:50 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-09 11:43 . 2010-03-09 11:43 -------- d-----w- c:\windows\system32\URTTEMP
2010-03-08 14:40 . 2010-03-08 14:41 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Adobe
2010-03-05 20:23 . 2010-03-05 20:23 -------- d-----w- c:\program files\Lavalys
2010-03-05 20:19 . 2009-03-27 00:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-03-05 20:05 . 2010-03-05 20:05 -------- d-sh--w- c:\documents and settings\computer\PrivacIE
2010-03-05 20:05 . 2010-03-09 11:41 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\AskToolbar
2010-03-05 19:37 . 2007-04-16 15:46 33792 ----a-w- c:\windows\system32\drivers\AmdPPM.sys
2010-03-05 19:36 . 2010-03-05 19:36 -------- d-----w- c:\documents and settings\computer\Application Data\InstallShield
2010-03-05 19:34 . 2008-01-04 12:34 11832 ----a-w- c:\windows\system32\drivers\AsInsHelp64.sys
2010-03-05 19:34 . 2008-01-04 12:34 10216 ----a-w- c:\windows\system32\drivers\AsInsHelp32.sys
2010-03-05 19:30 . 2010-03-05 19:30 -------- d-sh--w- c:\documents and settings\computer\IETldCache
2010-03-05 19:24 . 2009-10-06 17:32 327168 ----a-w- c:\windows\system32\cutil32.dll
2010-03-05 19:24 . 2009-08-03 19:25 285696 ----a-w- c:\windows\system32\cudart.dll
2010-03-05 19:23 . 2010-03-05 20:19 -------- d-----w- c:\program files\CPUID
2010-03-05 19:23 . 2010-03-05 19:23 -------- d-----w- c:\program files\Ask.com
2010-03-05 19:23 . 2010-03-05 19:23 -------- d-----w- c:\documents and settings\computer\Application Data\GlarySoft
2010-03-05 19:23 . 2010-03-05 19:23 -------- d-----w- c:\program files\Glary Registry Repair
2010-03-05 19:02 . 2010-03-05 19:02 -------- d-----w- c:\windows\ie8updates
2010-03-05 19:01 . 2010-03-05 19:02 -------- dc-h--w- c:\windows\ie8
2010-03-05 19:01 . 2010-03-05 19:02 -------- d-----w- c:\windows\system32\sk-SK
2010-03-05 18:58 . 2010-03-05 18:58 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Temp
2010-03-05 18:58 . 2010-03-05 18:58 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Google
2010-03-05 18:48 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-05 15:09 . 2010-03-05 15:07 737280 ----a-w- c:\windows\iun6002.exe
2010-03-05 15:09 . 2010-03-05 15:09 -------- d-----w- c:\program files\Codec Pack - All In 1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-05 19:37 . 2010-03-05 13:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-05 15:13 . 2010-03-05 15:13 -------- d-----w- c:\program files\VIA
2010-03-05 15:13 . 2010-03-05 13:42 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-05 15:00 . 2010-03-05 14:59 -------- d-----w- c:\program files\UlisesSoft
2010-03-05 14:53 . 2010-03-05 14:05 69408 ----a-w- c:\documents and settings\computer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-05 14:49 . 2010-03-05 14:49 -------- d-----w- c:\program files\Reference Assemblies
2010-03-05 14:40 . 2010-03-05 13:26 147275 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-05 14:40 . 2010-03-05 13:26 5110 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-03-05 14:15 . 2010-03-05 14:15 0 ----a-w- c:\windows\nsreg.dat
2010-03-05 14:15 . 2010-03-05 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-05 14:14 . 2010-03-05 14:14 -------- d-----w- c:\program files\Microsoft Works
2010-03-05 14:14 . 2010-03-05 14:14 -------- d-----w- c:\program files\MSBuild
2010-03-05 14:13 . 2010-03-05 14:13 -------- d-----w- c:\program files\Microsoft.NET
2010-03-05 14:11 . 2010-03-05 14:11 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-05 14:05 . 2010-03-05 14:05 -------- d-----w- c:\documents and settings\computer\Application Data\ATI
2010-03-05 14:05 . 2010-03-05 14:05 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-03-05 14:04 . 2010-03-05 14:04 0 ----a-w- c:\windows\ativpsrm.bin
2010-03-05 14:03 . 2010-03-05 14:03 -------- d-----w- c:\documents and settings\computer\Application Data\ESET
2010-03-05 14:02 . 2010-03-05 14:02 -------- d-----w- c:\program files\ESET
2010-03-05 14:02 . 2010-03-05 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-05 13:58 . 2010-03-05 13:43 -------- d-----w- c:\program files\Realtek
2010-03-05 13:57 . 2010-03-05 13:44 -------- d-----w- c:\program files\AMD
2010-03-05 13:56 . 2010-03-05 13:45 -------- d-----w- c:\program files\ASUS
2010-03-05 13:54 . 2010-03-05 13:54 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-05 13:54 . 2010-03-05 13:53 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-05 13:50 . 2010-03-05 13:46 -------- d-----w- c:\program files\ATI Technologies
2010-03-05 13:32 . 2010-03-05 13:26 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-03-05 13:27 . 2010-03-05 13:27 -------- d-----w- c:\program files\microsoft frontpage
2010-03-05 13:25 . 2010-03-05 13:25 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-08 07:13 . 2010-01-08 07:13 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-18 14:02 . 2009-12-18 14:02 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-11-18 17:40 1196936 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-11-18 1196936]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-03-05 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2009-08-20 5782528]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-18 98304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-08-28 33673216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\bin\RAIDXpertService.exe [16.3.2009 0:47 122880]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [5.3.2010 14:58 22016]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [5.3.2010 16:13 1390976]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [5.3.2010 14:58 25984]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [5.3.2010 14:58 17408]
.
Contents of the 'Scheduled Tasks' folder

2010-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004Core.job
- c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-05 18:58]

2010-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004UA.job
- c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-05 18:58]

2010-03-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-11-18 17:40]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\computer\Application Data\Mozilla\Firefox\Profiles\lqcnutqd.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=GLSV5&o=10168&locale=en_EU&q=
FF - plugin: c:\documents and settings\computer\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 09:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(184)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AMD\RAIDXpert\bin\RAIDXpert.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2010-03-17 09:06:57 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-17 08:06

Pre-Run: 72 535 048 192 bytes free
Post-Run: 72 936 067 072 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 0A4E4153D32A9A31A9116E522DF8FD09

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files\Ask.com

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu CXomboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[maxxooo]

diky moc hned rano to vykonam

mam potom vlozit log?

[Rudy]

Log určitě vložte.

[maxxooo]

tak tu je log:

ComboFix 10-03-16.03 - computer 18.03.2010 18:55:34.2.4 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1791.1071 [GMT 1:00]
Running from: c:\documents and settings\computer\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\computer\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-18 to 2010-03-18 )))))))))))))))))))))))))))))))
.

2010-03-17 08:16 . 2009-12-21 19:14 5942784 -c----w- c:\windows\system32\dllcache\mshtml.dll
2010-03-17 08:01 . 2010-03-17 08:01 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-03-16 16:25 . 2010-03-16 16:26 -------- d-----w- C:\rsit
2010-03-16 16:25 . 2010-03-16 16:26 -------- d-----w- c:\program files\trend micro
2010-03-10 10:56 . 2010-03-11 16:17 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\ApplicationHistory
2010-03-10 10:56 . 2010-03-10 10:56 131 ----a-w- c:\documents and settings\computer\Local Settings\Application Data\fusioncache.dat
2010-03-10 10:50 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-09 11:43 . 2010-03-09 11:43 -------- d-----w- c:\windows\system32\URTTEMP
2010-03-08 14:40 . 2010-03-08 14:41 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Adobe
2010-03-05 20:23 . 2010-03-05 20:23 -------- d-----w- c:\program files\Lavalys
2010-03-05 20:19 . 2009-03-27 00:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-03-05 20:05 . 2010-03-05 20:05 -------- d-sh--w- c:\documents and settings\computer\PrivacIE
2010-03-05 20:05 . 2010-03-09 11:41 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\AskToolbar
2010-03-05 19:37 . 2007-04-16 15:46 33792 ----a-w- c:\windows\system32\drivers\AmdPPM.sys
2010-03-05 19:36 . 2010-03-05 19:36 -------- d-----w- c:\documents and settings\computer\Application Data\InstallShield
2010-03-05 19:34 . 2008-01-04 12:34 11832 ----a-w- c:\windows\system32\drivers\AsInsHelp64.sys
2010-03-05 19:34 . 2008-01-04 12:34 10216 ----a-w- c:\windows\system32\drivers\AsInsHelp32.sys
2010-03-05 19:30 . 2010-03-05 19:30 -------- d-sh--w- c:\documents and settings\computer\IETldCache
2010-03-05 19:24 . 2009-10-06 17:32 327168 ----a-w- c:\windows\system32\cutil32.dll
2010-03-05 19:24 . 2009-08-03 19:25 285696 ----a-w- c:\windows\system32\cudart.dll
2010-03-05 19:23 . 2010-03-05 20:19 -------- d-----w- c:\program files\CPUID
2010-03-05 19:23 . 2010-03-05 19:23 -------- d-----w- c:\documents and settings\computer\Application Data\GlarySoft
2010-03-05 19:23 . 2010-03-05 19:23 -------- d-----w- c:\program files\Glary Registry Repair
2010-03-05 19:02 . 2010-03-05 19:02 -------- d-----w- c:\windows\ie8updates
2010-03-05 19:01 . 2010-03-05 19:02 -------- dc-h--w- c:\windows\ie8
2010-03-05 19:01 . 2010-03-05 19:02 -------- d-----w- c:\windows\system32\sk-SK
2010-03-05 18:58 . 2010-03-18 12:03 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Temp
2010-03-05 18:58 . 2010-03-05 18:58 -------- d-----w- c:\documents and settings\computer\Local Settings\Application Data\Google
2010-03-05 18:48 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-05 15:09 . 2010-03-05 15:07 737280 ----a-w- c:\windows\iun6002.exe
2010-03-05 15:09 . 2010-03-05 15:09 -------- d-----w- c:\program files\Codec Pack - All In 1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-05 19:37 . 2010-03-05 13:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-05 15:13 . 2010-03-05 15:13 -------- d-----w- c:\program files\VIA
2010-03-05 15:13 . 2010-03-05 13:42 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-05 15:00 . 2010-03-05 14:59 -------- d-----w- c:\program files\UlisesSoft
2010-03-05 14:53 . 2010-03-05 14:05 69408 ----a-w- c:\documents and settings\computer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-05 14:49 . 2010-03-05 14:49 -------- d-----w- c:\program files\Reference Assemblies
2010-03-05 14:40 . 2010-03-05 13:26 147275 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-05 14:40 . 2010-03-05 13:26 5110 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-03-05 14:15 . 2010-03-05 14:15 0 ----a-w- c:\windows\nsreg.dat
2010-03-05 14:15 . 2010-03-05 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-05 14:14 . 2010-03-05 14:14 -------- d-----w- c:\program files\Microsoft Works
2010-03-05 14:14 . 2010-03-05 14:14 -------- d-----w- c:\program files\MSBuild
2010-03-05 14:13 . 2010-03-05 14:13 -------- d-----w- c:\program files\Microsoft.NET
2010-03-05 14:11 . 2010-03-05 14:11 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-03-05 14:05 . 2010-03-05 14:05 -------- d-----w- c:\documents and settings\computer\Application Data\ATI
2010-03-05 14:05 . 2010-03-05 14:05 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-03-05 14:04 . 2010-03-05 14:04 0 ----a-w- c:\windows\ativpsrm.bin
2010-03-05 14:03 . 2010-03-05 14:03 -------- d-----w- c:\documents and settings\computer\Application Data\ESET
2010-03-05 14:02 . 2010-03-05 14:02 -------- d-----w- c:\program files\ESET
2010-03-05 14:02 . 2010-03-05 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-05 13:58 . 2010-03-05 13:43 -------- d-----w- c:\program files\Realtek
2010-03-05 13:57 . 2010-03-05 13:44 -------- d-----w- c:\program files\AMD
2010-03-05 13:56 . 2010-03-05 13:45 -------- d-----w- c:\program files\ASUS
2010-03-05 13:54 . 2010-03-05 13:54 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-05 13:54 . 2010-03-05 13:53 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-05 13:50 . 2010-03-05 13:46 -------- d-----w- c:\program files\ATI Technologies
2010-03-05 13:32 . 2010-03-05 13:26 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-03-05 13:27 . 2010-03-05 13:27 -------- d-----w- c:\program files\microsoft frontpage
2010-03-05 13:25 . 2010-03-05 13:25 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-08 07:13 . 2010-01-08 07:13 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2009-12-31 16:50 . 2006-02-28 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-02-28 12:00 916480 ------w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-17_08.05.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-02-28 12:00 . 2010-03-17 07:58 71138 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2010-03-18 06:35 71138 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2010-03-18 06:35 440820 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2010-03-17 07:58 440820 c:\windows\system32\perfh009.dat
+ 2006-02-28 12:00 . 2009-12-21 19:14 5942784 c:\windows\system32\mshtml.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-03-05 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2009-08-20 5782528]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-18 98304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-08-28 33673216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\bin\RAIDXpertService.exe [16.3.2009 0:47 122880]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [5.3.2010 14:58 22016]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [5.3.2010 16:13 1390976]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [5.3.2010 14:58 25984]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [5.3.2010 14:58 17408]
.
Contents of the 'Scheduled Tasks' folder

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004Core.job
- c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-05 18:58]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-839522115-2075830312-1004UA.job
- c:\documents and settings\computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-05 18:58]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\computer\Application Data\Mozilla\Firefox\Profiles\lqcnutqd.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=GLSV5&o=10168&locale=en_EU&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-18 18:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-03-18 18:58:24
ComboFix-quarantined-files.txt 2010-03-18 17:58
ComboFix2.txt 2010-03-17 08:06

Pre-Run: 72 730 234 880 bytes free
Post-Run: 72 692 908 032 bytes free

- - End Of File - - 5774AD7A4AC07ED718009F38BF408847

[Rudy]

Log již vypadá čistý. Nastala nějaká změna?

[maxxooo]

urcite nastal: pc uz nepracuje na plny vykon, uz sa "znormalnil" a s tym padanim este neviem lebo sa to deje nepravidelne ale ak to bude v poriadku tak veeeeeeeeeelmi dakujem

[Rudy]

V případě, že ne, ozvěte se. Nemáte zač!