neaky divny antivirak

ComboFix 08-03-24.2 - DADMTB 2008-03-25 12:29:10.1 - NTFSx86
Systém Microsoft Windows XP Professional  5.1.2600.2.1250.1.1029.18.186 [GMT 1:00]
Running from: C:\Documents and Settings\DADMTB\Plocha\ComboFix.exe
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\ELO - oco\Data aplikací\macromedia\Flash Player\#SharedObjects\LGM8YA7G\www.broadcaster.com
C:\Documents and Settings\ELO - oco\Data aplikací\macromedia\Flash Player\#SharedObjects\LGM8YA7G\www.broadcaster.com\played_list.sol
C:\Documents and Settings\ELO - oco\Data aplikací\macromedia\Flash Player\#SharedObjects\LGM8YA7G\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\ELO - oco\Data aplikací\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\ELO - oco\Data aplikací\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\dwnrpofk.dll
C:\WINDOWS\qvdntlmw.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\system32\mcrh.tmp

.
(((((((((((((((((((((((((   Files Created from 2008-02-25 to 2008-03-25  )))))))))))))))))))))))))))))))
.

2008-03-25 11:48 . 2008-03-25 12:25   99,552,000   --a------   C:\panic.je.nanic-kinobox.part1.rar
2008-03-25 11:26 . 2008-03-25 11:41   <DIR>   d--------   C:\Posledni.Plavky
2008-03-24 21:42 . 2008-03-24 21:42   94,208   --a------   C:\WINDOWS\system32\xmfuhiha.exe
2008-03-24 20:31 . 2008-03-25 09:32   <DIR>   d--------   C:\Program Files\Spyware Doctor
2008-03-24 20:31 . 2008-03-24 20:31   <DIR>   d--------   C:\Documents and Settings\DADMTB\Data aplikací\PC Tools
2008-03-24 20:31 . 2007-12-10 14:53   81,288   --a------   C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-24 20:31 . 2007-12-10 14:53   66,952   --a------   C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-24 20:31 . 2008-02-01 12:55   42,376   --a------   C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-24 20:31 . 2007-12-10 14:53   29,576   --a------   C:\WINDOWS\system32\drivers\kcom.sys
2008-03-24 20:02 . 2008-03-24 20:09   <DIR>   d--------   C:\Program Files\Norton Security Scan
2008-03-24 19:53 . 2008-03-25 12:13   <DIR>   d--------   C:\Documents and Settings\All Users\Data aplikací\Google Updater
2008-03-24 19:17 . 2008-03-24 19:17   <DIR>   d--------   C:\Program Files\PC-Cleaner
2008-03-24 18:53 . 2008-03-24 18:53   <DIR>   d--------   C:\Program Files\Spybot - Search & Destroy
2008-03-24 18:53 . 2008-03-24 19:25   <DIR>   d--------   C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-03-24 14:07 . 2008-03-24 14:07   <DIR>   d--------   C:\Documents and Settings\DADMTB\Plochavirii
2008-03-24 14:07 . 2008-03-24 14:07   <DIR>   d--------   C:\Documents and Settings\All Users\Data aplikací\kdghuhyr
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\PlochaTrojan.Win32.BlackBird.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\PlochaFWebdEditor.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\Plochafwebd.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\Plochafkwp2.0.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\Plochafkwp1.5.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\Plochafilemanagerclient.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\PlochaEditorFKWP2.0.exe
2008-03-24 14:07 . 2008-03-24 14:07   4,096   --a------   C:\Documents and Settings\DADMTB\PlochaEditorFKWP1.5.exe
2008-03-24 14:06 . 2008-03-24 11:38   212,992   --a------   C:\WINDOWS\kdftlboerql.dll
2008-03-24 14:06 . 2008-03-24 14:06   114,688   --a------   C:\WINDOWS\system32\elgjubqb.exe
2008-03-22 20:36 . 2006-06-08 09:59   733,914,704   --a------   C:\Ja Robot.avi
2008-03-22 13:12 . 2008-03-22 14:38   <DIR>   d--------   C:\Documents and Settings\DADMTB\Data aplikací\Eric's TelNet98
2008-03-19 20:22 . 2008-03-19 20:22   <DIR>   d--------   C:\Documents and Settings\DADMTB\Data aplikací\InstallShield
2008-03-19 20:08 . 2008-03-19 20:08   <DIR>   d--------   C:\Documents and Settings\DADMTB\Data aplikací\THQ
2008-03-18 12:00 . 2008-03-18 12:00   <DIR>   d--------   C:\filas_point___by__IxaN
2008-03-16 17:40 . 2008-03-16 17:40   <DIR>   d--------   C:\Program Files\Microsoft SQL Server
2008-03-16 17:40 . 2008-03-17 12:44   <DIR>   d--------   C:\Program Files\Microsoft Silverlight
2008-03-16 17:35 . 2008-03-24 20:07   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 9.0
2008-03-16 17:33 . 2008-03-16 17:34   <DIR>   d--------   C:\Program Files\Microsoft Web Designer Tools
2008-03-16 17:33 . 2008-03-16 17:33   <DIR>   dr-h-----   C:\MSOCache
2008-03-16 17:33 . 2008-03-24 20:07   <DIR>   d--------   C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2008-03-16 17:30 . 2008-03-16 17:30   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2008-03-16 17:30 . 2008-03-16 17:30   <DIR>   d--------   C:\Program Files\Reference Assemblies
2008-03-16 17:30 . 2008-03-16 17:30   <DIR>   d--------   C:\Program Files\MSBuild
2008-03-16 17:30 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2008-03-16 17:25 . 2008-03-16 17:25   <DIR>   d--------   C:\Program Files\MSXML 6.0
2008-03-15 13:29 . 2008-03-21 14:45   <DIR>   d--------   C:\stranka
2008-03-10 17:47 . 2008-03-19 20:47   <DIR>   d--------   C:\Program Files\Yahoo!
2008-03-10 17:47 . 2008-03-10 17:47   <DIR>   d--------   C:\Program Files\CCleaner
2008-03-07 14:37 . 2008-03-07 14:41   <DIR>   d--------   C:\Documents and Settings\DADMTB\Data aplikací\XnView
2008-02-28 14:24 . 2008-03-24 20:05   <DIR>   d--------   C:\Program Files\Graffiti Studio 2.0
2008-02-28 14:24 . 2008-02-28 14:24   24   --a------   C:\WINDOWS\AM_D8.PRF

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 11:26   ---------   d---a-w   C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-03-25 09:40   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\MegauploadToolbar
2008-03-24 18:53   ---------   d-----w   C:\Program Files\Google
2008-03-24 13:32   ---------   d-----w   C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2008-03-22 20:57   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\Skype
2008-03-22 13:55   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\uTorrent
2008-03-22 11:49   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\skypePM
2008-03-20 19:49   ---------   d-----w   C:\Program Files\Qtrax_20080125
2008-03-20 10:37   ---------   d-----w   C:\Program Files\CyberLink
2008-03-20 10:29   ---------   d-----w   C:\Program Files\Activision
2008-03-19 19:22   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-03-16 10:53   ---------   d-----w   C:\Program Files\SpeedFan
2008-03-14 18:59   ---------   d-----w   C:\Program Files\Valve
2008-03-08 15:10   ---------   d-----w   C:\Program Files\RapidSpool
2008-02-29 20:30   ---------   d-----w   C:\Program Files\MegauploadToolbar
2008-02-22 18:28   ---------   d-----w   C:\Program Files\ICQ6
2008-02-20 17:13   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\Hamachi
2008-02-20 15:58   ---------   d-----w   C:\Program Files\Sony Ericsson
2008-02-20 15:52   ---------   d-----w   C:\Program Files\IRXpress
2008-02-20 09:45   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\TV JOJ Media Player
2008-02-17 15:33   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-02-16 16:07   ---------   d-----w   C:\Program Files\DVDFab Platinum
2008-02-16 15:47   ---------   d-----w   C:\Program Files\Opera 9
2008-02-14 14:01   ---------   d-----w   C:\Documents and Settings\DADMTB\Data aplikací\Flock
2006-09-28 15:22   91,265   -c--a-w   C:\Program Files\OCT2006_xinput_x64.cab
2006-09-28 15:22   49,149   -c--a-w   C:\Program Files\OCT2006_xinput_x86.cab
2006-09-28 15:21   41,996   -c--a-w   C:\Program Files\dxdllreg_x86.cab
2006-09-28 15:21   183,321   -c--a-w   C:\Program Files\OCT2006_XACT_x64.cab
2006-09-28 15:21   138,977   -c--a-w   C:\Program Files\OCT2006_XACT_x86.cab
2006-09-28 15:21   1,413,862   -c--a-w   C:\Program Files\OCT2006_d3dx9_31_x64.cab
2006-09-28 15:21   1,128,177   -c--a-w   C:\Program Files\OCT2006_d3dx9_31_x86.cab
2005-12-12 17:19   32   ----a-w   C:\Documents and Settings\All Users\Data aplikací\ezsid.dat
2006-01-04 19:28   7,026   -csha-w   C:\WINDOWS\system32\mpqss.ini2
2007-06-28 15:45   6,409   -csha-w   C:\WINDOWS\system32\rstwa.bak1
2007-08-06 13:47   736,867   -csha-w   C:\WINDOWS\system32\rstwa.bak2
2007-07-13 12:06   1,031,467   -csha-w   C:\WINDOWS\system32\rstwa.ini2
.
[code]<pre>
----a-w            39,792 2006-01-04 18:59:23  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w           339,968 2006-01-04 18:59:24  C:\Program Files\AGEIA Technologies\TrayIcon .exe
----a-w            79,224 2006-01-04 18:59:11  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w            81,920 2006-01-04 18:59:14  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           221,184 2006-01-04 18:59:14  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w           185,896 2006-01-04 18:59:18  C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
----a-w            32,768 2006-01-04 18:59:11  C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
----a-w            81,920 2006-01-02 15:13:33  C:\Program Files\D-Tools\daemon .exe
----a-w           132,496 2006-01-04 18:59:19  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w         1,694,208 2006-01-03 16:12:10  C:\Program Files\Messenger\msmsgs .exe
----a-w           200,704 2006-01-04 18:59:27  C:\Program Files\PowerISO\PWRISOVM .EXE
----a-w           286,720 2006-01-04 18:59:22  C:\Program Files\QuickTime\qttask                             .exe
----a-w            75,304 2006-01-04 18:59:16  C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4 .exe
----a-w         1,410,600 2006-01-04 18:59:20  C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg .exe
-c--a-w            15,360 2006-01-04 18:59:28  C:\WINDOWS\system32\ctfmon .exe
-c--a-w           155,648 2006-01-04 18:59:13  C:\WINDOWS\system32\NeroCheck .exe
</pre>[/code]


------- Sigcheck -------

2006-04-20 13:18  360576  b2220c618b42a2212a59d91ebd6fc4b4   C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2002-08-29 02:58  332928  244a2f9816bc9b593957281ef577d976   C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 22:14  359040  9f4b36614a0fc234525ba224957de55c   C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2006-04-20 12:51  359808  de891ad282e856acfd40990094a63b6f   C:\WINDOWS\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"fmhprntt"="C:\WINDOWS\system32\elgjubqb.exe" [2008-03-24 14:06 114688]
"qitfqidn"="C:\WINDOWS\system32\xmfuhiha.exe" [2008-03-24 21:42 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 11:23 67584 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-03-30 03:48 5898240]
"nwiz"="nwiz.exe" [2005-03-30 03:48 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-03-30 03:48 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask                             .exe" [2006-01-04 19:59 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-17 14:49 15360]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-24 19:53:57 125624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"veEcM8R00Y"= C:\Documents and Settings\All Users\Data aplikací\kdghuhyr\cnmfyjcz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnklii]
pmnklii.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Valve\\hl.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 nxsIO32;NextSensor Kernel I/O Driver;C:\WINDOWS\System32\DRIVERS\nxsIO32.sys [2007-11-02 15:55]
R3 EuMusDesignVirtualAudioCableWdm_sdh;Sandhills Audio Cable;C:\WINDOWS\system32\DRIVERS\vacsdhkd.sys [2006-01-12 20:44]
R3 KCIRDA;%KCIRDA.ServiceDesc%;C:\WINDOWS\system32\DRIVERS\KCIrNet.sys [2001-10-04 09:23]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 cpuz;cpuz;C:\Documents and Settings\DANIEL\Plocha\cpuz.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-03-24 19:02:56 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-25 12:31:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-25 12:31:58
ComboFix-quarantined-files.txt  2008-03-25 11:31:42
.
2005-12-12 17:07:52   --- E O F --- 

files to delete:
C:\WINDOWS\system32\xmfuhiha.exe
C:\Documents and Settings\DADMTB\PlochaTrojan.Win32.BlackBird.exe
C:\Documents and Settings\DADMTB\PlochaFWebdEditor.exe
C:\Documents and Settings\DADMTB\Plochafwebd.exe
C:\Documents and Settings\DADMTB\Plochafkwp2.0.exe
C:\Documents and Settings\DADMTB\Plochafkwp1.5.exe
C:\Documents and Settings\DADMTB\Plochafilemanagerclient.exe
C:\Documents and Settings\DADMTB\PlochaEditorFKWP2.0.exe
C:\Documents and Settings\DADMTB\PlochaEditorFKWP1.5.exe
C:\WINDOWS\kdftlboerql.dll
C:\WINDOWS\system32\elgjubqb.exe
C:\WINDOWS\AM_D8.PRF
C:\WINDOWS\system32\rstwa.bak1
C:\WINDOWS\system32\rstwa.bak2
C:\WINDOWS\system32\rstwa.ini2

folders to delete:
C:\Documents and Settings\All Users\Data aplikací\kdghuhyr
C:\Documents and Settings\DADMTB\Plochavirii

registry keys to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnklii

registry values to delete:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | fmhprntt
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | qitfqidn

files to delete:
C:\WINDOWS\system32\mpqss.ini2

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\mpqss.ini2" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\mpqss.ini2" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.



//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Thu Mar 27 19:40:02 2008

19:40:02: Error: Invalid script.  A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error:  file "C:\WINDOWS\system32\mpqss.ini2" not found!
Deletion of file "C:\WINDOWS\system32\mpqss.ini2" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Completed script processing.

*******************

Finished!  Terminate.

Process   PID   CPU   Description   Company Name
System Idle Process   0   95.38      
 Interrupts   n/a      Hardware Interrupts   
 DPCs   n/a   1.54   Deferred Procedure Calls   
 System   4         
  smss.exe   628      Správce relací systému Windows NT   Microsoft Corporation
   csrss.exe   692      Client Server Runtime Process   Microsoft Corporation
   winlogon.exe   716      Windows NT Logon Application   Microsoft Corporation
    services.exe   760      Services and Controller app   Microsoft Corporation
     svchost.exe   924      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   984      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1080      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1180      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1324      Generic Host Process for Win32 Services   Microsoft Corporation
     aswUpdSv.exe   1476      avast! Antivirus updating service   ALWIL Software
     ashServ.exe   1580      avast! antivirus service   ALWIL Software
     spoolsv.exe   236      Spooler SubSystem App   Microsoft Corporation
     mDNSResponder.exe   1528      Bonjour Service   Apple Computer, Inc.
     Apache.exe   1816      Apache HTTP Server   Apache Software Foundation
      Apache.exe   2236      Apache HTTP Server   Apache Software Foundation
     GoogleUpdaterService.exe   360      gusvc   Google
     MDM.EXE   1032      Machine Debug Manager   Microsoft Corporation
     nSvcIp.exe   276         
     nSvcLog.exe   2008         
     nvsvc32.exe   1636      NVIDIA Driver Helper Service, Version 76.44   NVIDIA Corporation
     PnkBstrA.exe   316         
     svchost.exe   468      Generic Host Process for Win32 Services   Microsoft Corporation
     wdfmgr.exe   1128      Windows User Mode Driver Manager   Microsoft Corporation
     ashMaiSv.exe   3452      avast! e-Mail Scanner Service   ALWIL Software
     ashWebSv.exe   3500      avast! Web Scanner   ALWIL Software
     alg.exe   1172      Application Layer Gateway Service   Microsoft Corporation
    lsass.exe   772      LSA Shell (Export Version)   Microsoft Corporation
explorer.exe   444   1.54   Průzkumník Windows   Microsoft Corporation
 cnmfyjcz.exe   1536         
 SOUNDMAN.EXE   1940      Realtek Sound Manager   Realtek Semiconductor Corp.
 ashDisp.exe   1068      avast! service GUI component   ALWIL Software
 qttask                             .exe   1240      QuickTime Task   Apple Inc.
 ctfmon.exe   1260      CTF Loader   Microsoft Corporation
 elgjubqb.exe   1848         
 GoogleUpdater.exe   1956      Google Updater   Google
 firefox.exe   2168      Firefox   Mozilla Corporation
procexp.exe   388   1.54   Sysinternals Process Explorer   Sysinternals - www.sysinternals.com

Process: explorer.exe Pid: 444

Name   Description   Company Name   Version
AcGenral.DLL   Windows Compatibility DLL   Microsoft Corporation   5.01.2600.2180
ACTIVEDS.dll   ADs Router Layer DLL   Microsoft Corporation   5.01.2600.2180
actxprxy.dll   ActiveX Interface Marshaling Library   Microsoft Corporation   6.00.2900.2180
adsldpc.dll   ADs LDAP Provider C DLL   Microsoft Corporation   5.01.2600.2180
ADVAPI32.dll   Advanced Windows 32 Base API   Microsoft Corporation   5.01.2600.2180
appHelp.dll   Application Compatibility Client Library   Microsoft Corporation   5.01.2600.2180
ashShell.dll   avast! Shell Extension   ALWIL Software   4.07.1098.0000
ATL.DLL   ATL Module for Windows XP (Unicode)   Microsoft Corporation   3.05.2284.0000
BatMeter.dll   Battery Meter Helper DLL   Microsoft Corporation   6.00.2900.2180
BROWSEUI.dll   Shell Browser UI Library   Společnost Microsoft   6.00.2900.3199
c_1252.nls         
CLBCATQ.DLL      Microsoft Corporation   2001.12.4414.0308
comctl32.dll   User Experience Controls Library   Microsoft Corporation   6.00.2900.2982
comctl32.dll   Common Controls Library   Microsoft Corporation   5.82.2900.2982
COMRes.dll      Microsoft Corporation   2001.12.4414.0258
credui.dll   Credential Manager User Interface   Microsoft Corporation   5.01.2600.2180
CRYPT32.dll   Crypto API32   Microsoft Corporation   5.131.2600.2180
CRYPTUI.dll   Microsoft Trust UI Provider   Microsoft Corporation   5.131.2600.2180
CSCDLL.dll   Offline Network Agent   Microsoft Corporation   5.01.2600.2180
cscui.dll   Client Side Caching UI   Microsoft Corporation   5.01.2600.2180
ctype.nls         
davclnt.dll   Web DAV Client DLL   Microsoft Corporation   5.01.2600.2180
drprov.dll   Microsoft Terminal Server Network Provider   Microsoft Corporation   5.01.2600.2180
Explorer.EXE   Průzkumník Windows   Microsoft Corporation   6.00.2900.3156
GDI32.dll   GDI Client DLL   Microsoft Corporation   5.01.2600.3159
ieframe.dll   Internet Explorer   Microsoft Corporation   7.00.6000.16544
iertutil.dll   Run time utility for Internet Explorer   Microsoft Corporation   7.00.6000.16544
IMAGEHLP.dll   Windows NT Image Helper   Microsoft Corporation   5.01.2600.2180
IMM32.DLL   Windows XP IMM32 API Client DLL   Microsoft Corporation   5.01.2600.2180
index.dat         
index.dat         
index.dat         
index.dat         
iphlpapi.dll   IP Helper API   Microsoft Corporation   5.01.2600.2912
IZArcCM.dll         
kernel32.dll   Windows NT BASE API Client DLL   Microsoft Corporation   5.01.2600.3119
LINKINFO.dll   Windows Volume Tracking   Microsoft Corporation   5.01.2600.2751
locale.nls         
MFC42.DLL   MFCDLL Shared Library - Retail Version   Microsoft Corporation   6.02.4131.0000
MFC42LOC.DLL   MFC Language Specific Resources   Microsoft Corporation   6.00.8665.0000
MLANG.dll   Multi Language Support DLL   Microsoft Corporation   6.00.2900.2180
MPR.dll   Multiple Provider Router DLL   Microsoft Corporation   5.01.2600.2180
MPRAPI.dll   Windows NT MP Router Administration DLL   Microsoft Corporation   5.01.2600.2180
MSACM32.dll   Microsoft ACM Audio Filter   Microsoft Corporation   5.01.2600.2180
MSASN1.dll   ASN.1 Runtime APIs   Microsoft Corporation   5.01.2600.2180
MSCTF.dll   MSCTF Server DLL   Microsoft Corporation   5.01.2600.2180
msctfime.ime   Microsoft Text Frame Work Service IME   Microsoft Corporation   5.01.2600.2180
msi.dll   Windows Installer   Microsoft Corporation   3.01.4000.4039
MSIMG32.dll   GDIEXT Client DLL   Microsoft Corporation   5.01.2600.2180
mslbui.dll   Modul Add-in panelu jazyků   Microsoft Corporation   5.01.2600.2180
msutb.dll   MSUTB Server DLL   Microsoft Corporation   5.01.2600.2180
msv1_0.dll   Microsoft Authentication Package v1.0   Microsoft Corporation   5.01.2600.2180
MSVCR80.dll   Microsoft® C Runtime Library   Microsoft Corporation   8.00.50727.1433
msvcrt.dll   Windows NT CRT DLL   Microsoft Corporation   7.00.2600.2180
NETAPI32.dll   Net Win32 API DLL   Microsoft Corporation   5.01.2600.2976
NETRAP.dll   Net Remote Admin Protocol DLL   Microsoft Corporation   5.01.2600.2180
NETSHELL.dll   Network Connections Shell   Microsoft Corporation   5.01.2600.2180
NETUI0.dll   NT LM UI Common Code - GUI Classes   Microsoft Corporation   5.01.2600.2180
NETUI1.dll   NT LM UI Common Code - Networking classes   Microsoft Corporation   5.01.2600.2180
Normaliz.dll   Unicode Normalization DLL   Microsoft Corporation   6.00.5441.0000
ntdll.dll   NT Layer DLL   Microsoft Corporation   5.01.2600.2180
ntlanman.dll   Microsoft® Lan Manager   Microsoft Corporation   5.01.2600.2180
ntshrui.dll   Shell extensions for sharing   Microsoft Corporation   5.01.2600.2180
ole32.dll   Microsoft OLE for Windows   Microsoft Corporation   5.01.2600.2726
OLEAUT32.dll      Microsoft Corporation   5.01.2600.3139
olepro32.dll      Microsoft Corporation   5.01.2600.2180
PDFShell.dll   PDF Shell Extension   Adobe Systems, Inc.   8.01.0000.0000
POWRPROF.dll   Power Profile Helper DLL   Microsoft Corporation   6.00.2900.2180
PSAPI.DLL   Process Status Helper   Microsoft Corporation   5.01.2600.2180
rarext.dll         
rarlng.dll   WinRAR archiver   Alexander Roshal   3.70.0005.0000
RASAPI32.dll   Rozhraní API pro vzdálený přístup   Microsoft Corporation   5.01.2600.2180
RASDLG.dll   Remote Access Common Dialog API   Microsoft Corporation   5.01.2600.2180
rasman.dll   Remote Access Connection Manager   Microsoft Corporation   5.01.2600.2180
RhinoShExt.dll   Rhino 3.0 3DM File Extension for Windows Explorer   Robert McNeel & Associates   3.00.2005.0328
RPCRT4.dll   Remote Procedure Call Runtime   Microsoft Corporation   5.01.2600.3173
rsaenh.dll   Microsoft Enhanced Cryptographic Provider   Microsoft Corporation   5.01.2600.2161
rtutils.dll   Routing Utilities   Microsoft Corporation   5.01.2600.2180
SAMLIB.dll   SAM Library DLL   Microsoft Corporation   5.01.2600.2180
Secur32.dll   Security Support Provider Interface   Microsoft Corporation   5.01.2600.2180
SETUPAPI.dll   Windows Setup API   Microsoft Corporation   5.01.2600.2180
SHDOCVW.dll   Shell Doc Object and Control Library   Microsoft Corporation   6.00.2900.3199
SHELL32.dll   Windows Shell Common Dll   Microsoft Corporation   6.00.2900.3241
ShimEng.dll   Shim Engine DLL   Microsoft Corporation   5.01.2600.2180
SHLWAPI.dll   Shell Light-weight Utility Library   Microsoft Corporation   6.00.2900.3199
sortkey.nls         
sorttbls.nls         
stobject.dll   Systray shell service object   Microsoft Corporation   5.01.2600.2180
syncui.dll   Aktovka systému Windows   Microsoft Corporation   5.01.2600.2180
TAPI32.dll   Microsoft® Windows(TM) Telephony API Client DLL   Microsoft Corporation   5.01.2600.2180
themeui.dll   Windows Theme API   Microsoft Corporation   6.00.2900.2180
unicode.nls         
urlmon.dll   OLE32 Extensions for Win32   Microsoft Corporation   7.00.6000.16544
USER32.dll   Windows XP USER API Client DLL   Microsoft Corporation   5.01.2600.3099
USERENV.dll   Userenv   Microsoft Corporation   5.01.2600.2180
UxTheme.dll   Microsoft UxTheme Library   Microsoft Corporation   6.00.2900.2180
VERSION.dll   Version Checking and File Installation Libraries   Microsoft Corporation   5.01.2600.2180
webcheck.dll   Web Site Monitor   Microsoft Corporation   7.00.6000.16544
WININET.dll   Internet Extensions for Win32   Microsoft Corporation   7.00.6000.16544
WINMM.dll   MCI API DLL   Microsoft Corporation   5.01.2600.2180
WINSTA.dll   Winstation Library   Microsoft Corporation   5.01.2600.2180
WINTRUST.dll   Microsoft Trust Verification APIs   Microsoft Corporation   5.131.2600.2180
WLDAP32.dll   Win32 LDAP API DLL   Microsoft Corporation   5.01.2600.2180
WS2_32.dll   Windows Socket 2.0 32-Bit DLL   Microsoft Corporation   5.01.2600.2180
WS2HELP.dll   Windows Socket 2.0 Helper for Windows NT   Microsoft Corporation   5.01.2600.2180
WTSAPI32.dll   Windows Terminal Server SDK APIs   Microsoft Corporation   5.01.2600.2180
xpsp2res.dll   Zprávy aktualizace Service Pack 2   Microsoft Corporation   5.01.2600.2180

Process   PID   CPU   Description   Company Name
System Idle Process   0   92.75      
 Interrupts   n/a      Hardware Interrupts   
 DPCs   n/a      Deferred Procedure Calls   
 System   4         
  smss.exe   628      Správce relací systému Windows NT   Microsoft Corporation
   csrss.exe   692      Client Server Runtime Process   Microsoft Corporation
   winlogon.exe   716      Windows NT Logon Application   Microsoft Corporation
    services.exe   760      Services and Controller app   Microsoft Corporation
     svchost.exe   924      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   984      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1080      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1180      Generic Host Process for Win32 Services   Microsoft Corporation
     svchost.exe   1324      Generic Host Process for Win32 Services   Microsoft Corporation
     aswUpdSv.exe   1476      avast! Antivirus updating service   ALWIL Software
     ashServ.exe   1580      avast! antivirus service   ALWIL Software
     spoolsv.exe   236      Spooler SubSystem App   Microsoft Corporation
     mDNSResponder.exe   1528      Bonjour Service   Apple Computer, Inc.
     Apache.exe   1816      Apache HTTP Server   Apache Software Foundation
      Apache.exe   2236      Apache HTTP Server   Apache Software Foundation
     GoogleUpdaterService.exe   360      gusvc   Google
     MDM.EXE   1032      Machine Debug Manager   Microsoft Corporation
     nSvcIp.exe   276         
     nSvcLog.exe   2008         
     nvsvc32.exe   1636      NVIDIA Driver Helper Service, Version 76.44   NVIDIA Corporation
     PnkBstrA.exe   316         
     svchost.exe   468      Generic Host Process for Win32 Services   Microsoft Corporation
     wdfmgr.exe   1128      Windows User Mode Driver Manager   Microsoft Corporation
     ashMaiSv.exe   3452      avast! e-Mail Scanner Service   ALWIL Software
     ashWebSv.exe   3500      avast! Web Scanner   ALWIL Software
     alg.exe   1172      Application Layer Gateway Service   Microsoft Corporation
    lsass.exe   772      LSA Shell (Export Version)   Microsoft Corporation
explorer.exe   444      Průzkumník Windows   Microsoft Corporation
 cnmfyjcz.exe   1536         
 SOUNDMAN.EXE   1940      Realtek Sound Manager   Realtek Semiconductor Corp.
 ashDisp.exe   1068      avast! service GUI component   ALWIL Software
 qttask                             .exe   1240      QuickTime Task   Apple Inc.
 ctfmon.exe   1260      CTF Loader   Microsoft Corporation
 elgjubqb.exe   1848         
 GoogleUpdater.exe   1956      Google Updater   Google
 firefox.exe   2168      Firefox   Mozilla Corporation
procexp.exe   388   7.25   Sysinternals Process Explorer   Sysinternals - www.sysinternals.com

Process: explorer.exe Pid: 444

Type   Name
Desktop   \Default
Directory   \KnownDlls
Directory   \Windows
Directory   \BaseNamedObjects
Event   \BaseNamedObjects\crypt32LogoffEvent
Event   \BaseNamedObjects\userenv:  User Profile setup event
Event   \BaseNamedObjects\ShellReadyEvent
Event   \BaseNamedObjects\HPlugEjectEvent
File   C:\Documents and Settings\DADMTB
File   \Device\KsecDD
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   \Device\WMIDataDevice
File   \Device\WMIDataDevice
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\Documents and Settings\DADMTB\Plocha
File   C:\Documents and Settings\All Users\Plocha
File   C:\Documents and Settings\DADMTB\Local Settings\Data aplikací\Microsoft\Zápis na CD
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   \Device\NamedPipe\lsarpc
File   C:\Documents and Settings\All Users\Nabídka Start
File   C:\Documents and Settings\DADMTB\Nabídka Start
File   \Device\Ip
File   \Device\Ip
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   \Device\Tcp
File   \Device\Tcp
File   \Device\Ip
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\Documents and Settings\DADMTB\Data aplikací\Microsoft\Internet Explorer\Quick Launch
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\Documents and Settings\DADMTB\Okolní tiskárny
File   C:\Documents and Settings\DADMTB\Okolní síť
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
File   C:\Documents and Settings\DADMTB\Local Settings\Temporary Internet Files\Content.IE5\index.dat
File   C:\Documents and Settings\DADMTB\Cookies\index.dat
File   C:\Documents and Settings\DADMTB\Local Settings\History\History.IE5\index.dat
File   \Device\NamedPipe\ROUTER
File   \Device\Tcp
File   \Dfs
File   \Device\NamedPipe\ROUTER
File   \Device\NamedPipe\srvsvc
File   C:\Documents and Settings\DADMTB\Local Settings\History\History.IE5\MSHist012008032820080329\index.dat
File   \Device\NamedPipe\ROUTER
File   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
Key   HKLM
Key   HKCU
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World Full Access Shared Parameters
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Key   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
Key   HKCR
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKU
Key   HKCR
Key   HKU
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKCR\CLSID
Key   HKCR
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKU
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKLM\SOFTWARE\Microsoft\COM3
Key   HKCR\CLSID
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Plus!\Themes\Apply
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Policies
Key   HKCU\Software\Policies
Key   HKCU\Software
Key   HKLM\SOFTWARE
Key   HKCU\Software\Microsoft\Windows\ShellNoRoam
Key   HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Key   HKCR\HTTP\shell
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Windows\Shell
Key   HKU
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key   HKCU\Software\Classes\CLSID
Key   HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\Tracing\RASDLG
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
Key   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
Key   HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Key   HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
Key   HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Key   HKCU\Software\Classes
Key   HKCU\Software
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Policies
Key   HKLM\SOFTWARE\Policies
Key   HKLM\SOFTWARE
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
Key   HKLM\SOFTWARE\Microsoft\Tracing\NETSHELL
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
Key   HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32
Key   HKCU\Software\Classes
Key   HKCR\*
Key   HKCR\AllFilesystemObjects
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKCU\Software\Classes
Key   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\c
Key   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\c
KeyedEvent   \KernelObjects\CritSecOutOfMemoryEvent
Mutant   \BaseNamedObjects\SHIMLIB_LOG_MUTEX
Mutant   \BaseNamedObjects\ExplorerIsShellMutex
Mutant   \BaseNamedObjects\ShimCacheMutex
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.MKO
Mutant   \BaseNamedObjects\ZonesCounterMutex
Mutant   \BaseNamedObjects\ZonesLockedCacheCounterMutex
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.AMB
Mutant   \BaseNamedObjects\RasPbFile
Mutant   \BaseNamedObjects\ZonesCacheCounterMutex
Mutant   \BaseNamedObjects\ZoneAttributeCacheCounterMutex
Mutant   \BaseNamedObjects\ZoneAttributeCacheCounterMutex
Mutant   \BaseNamedObjects\_SHuassist.mtx
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.AMB
Mutant   \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\RasPbFile
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.ALI
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.MGE
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.MKP
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.EMP
Mutant   \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1454471165-1580818891-725345543-1012MUTEX.DefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\MSCTF.GCompartListMUTEX.DefaultS-1-5-21-1454471165-1580818891-725345543-1012
Mutant   \BaseNamedObjects\_!MSFTHISTORY!_
Mutant   \BaseNamedObjects\c:!documents and settings!dadmtb!local settings!temporary internet files!content.ie5!
Mutant   \BaseNamedObjects\c:!documents and settings!dadmtb!cookies!
Mutant   \BaseNamedObjects\c:!documents and settings!dadmtb!local settings!history!history.ie5!
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.MGE
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.AFE
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.MBF
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.EFH
Mutant   \BaseNamedObjects\c:!documents and settings!dadmtb!local settings!history!history.ie5!mshist012008032820080329!
Mutant   \BaseNamedObjects\_!SHMSFTHISTORY!_
Mutant   \BaseNamedObjects\MSCTF.Shared.MUTEX.AEI
Port   \RPC Control\OLEC83C2F58725B4CA29CD885B39960
Process   explorer.exe(444)
Section   \BaseNamedObjects\ShimSharedMemory
Section   \BaseNamedObjects\MSCTF.Shared.SFM.AMB
Section   \BaseNamedObjects\MSCTF.Shared.SFM.AMB
Section   \BaseNamedObjects\UrlZonesSM_DADMTB
Section   \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-1454471165-1580818891-725345543-1012
Section   \BaseNamedObjects\MSCTF.Shared.SFM.AFE
Section   \BaseNamedObjects\MSCTF.Shared.SFM.EMP
Section   \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MGE.DB.LMKMI
Section   \BaseNamedObjects\MSCTF.Shared.SFM.MGE
Section   \BaseNamedObjects\MSCTF.Shared.SFM.EFH
Section   \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MGE.K.PLNDB
Section   \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1454471165-1580818891-725345543-1012SFM.DefaultS-1-5-21-1454471165-1580818891-725345543-1012
Section   \BaseNamedObjects\MSCTF.GCompartListSFM.DefaultS-1-5-21-1454471165-1580818891-725345543-1012
Section   \BaseNamedObjects\MSCTF.Shared.SFM.MGE
Section   \BaseNamedObjects\windows_shell_global_counters
Section   \BaseNamedObjects\C:_Documents and Settings_DADMTB_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768
Section   \BaseNamedObjects\C:_Documents and Settings_DADMTB_Cookies_index.dat_16384
Section   \BaseNamedObjects\C:_Documents and Settings_DADMTB_Local Settings_History_History.IE5_index.dat_32768
Section   \BaseNamedObjects\MSCTF.Shared.SFM.MKO
Section   \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MGE.H.DONBB
Section   \BaseNamedObjects\MSCTF.Shared.SFM.MBF
Section   \BaseNamedObjects\C:_Documents and Settings_DADMTB_Local Settings_History_History.IE5_MSHist012008032820080329_index.dat_32768
Section   \BaseNamedObjects\MSCTF.Shared.SFM.ALI
Section   \BaseNamedObjects\MSCTF.Shared.SFM.MKP
Section   \BaseNamedObjects\MSCTF.Shared.SFM.AEI
Semaphore   \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore   \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Semaphore   \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
Semaphore   \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore   \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
Semaphore   \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore   \BaseNamedObjects\PowerProfileRegistrySemaphore
Semaphore   \BaseNamedObjects\shell.BitBucket.GlobalDirtyCount
Semaphore   \BaseNamedObjects\shell.BitBucket.NumDeleters
Semaphore   \BaseNamedObjects\shell.BitBucket.c.DirtyCount
Semaphore   \BaseNamedObjects\shell.BitBucket.c.NextFileNum
Thread   explorer.exe(444): 448
Thread   explorer.exe(444): 684
Thread   explorer.exe(444): 1132
Thread   explorer.exe(444): 1136
Thread   explorer.exe(444): 1148
Thread   explorer.exe(444): 1160
Thread   explorer.exe(444): 1160
Thread   explorer.exe(444): 1028
Thread   explorer.exe(444): 2204
Thread   explorer.exe(444): 4008
Thread   explorer.exe(444): 2180
Thread   explorer.exe(444): 2272
Thread   explorer.exe(444): 1884
Token   NT AUTHORITY\SYSTEM:3e7
Token   NT AUTHORITY\NETWORK SERVICE:3e4
WindowStation   \Windows\WindowStations\WinSta0
WindowStation   \Windows\WindowStations\WinSta0

C:\WINDOWS\system32\xmfuhiha.exe
C:\Documents and Settings\DADMTB\PlochaTrojan.Win32.BlackBird.exe
C:\Documents and Settings\DADMTB\PlochaFWebdEditor.exe
C:\Documents and Settings\DADMTB\Plochafwebd.exe
C:\Documents and Settings\DADMTB\Plochafkwp2.0.exe
C:\Documents and Settings\DADMTB\Plochafkwp1.5.exe
C:\Documents and Settings\DADMTB\Plochafilemanagerclient.exe
C:\Documents and Settings\DADMTB\PlochaEditorFKWP2.0.exe
C:\Documents and Settings\DADMTB\PlochaEditorFKWP1.5.exe
C:\WINDOWS\kdftlboerql.dll
C:\WINDOWS\system32\elgjubqb.exe
C:\WINDOWS\AM_D8.PRF
C:\WINDOWS\system32\rstwa.bak1
C:\WINDOWS\system32\rstwa.bak2
C:\WINDOWS\system32\rstwa.ini2
C:\WINDOWS\system32\mpqss.ini2
C:\Documents and Settings\All Users\Data aplikací\kdghuhyr
C:\Documents and Settings\DADMTB\Plochavirii

del /f /q "C:\WINDOWS\system32\xmfuhiha.exe"
del /f /q "C:\Documents and Settings\DADMTB\PlochaTrojan.Win32.BlackBird.exe"
del /f /q "C:\Documents and Settings\DADMTB\PlochaFWebdEditor.exe"
del /f /q "C:\Documents and Settings\DADMTB\Plochafwebd.exe"
del /f /q "C:\Documents and Settings\DADMTB\Plochafkwp2.0.exe"
del /f /q "C:\Documents and Settings\DADMTB\Plochafkwp1.5.exe"
del /f /q "C:\Documents and Settings\DADMTB\Plochafilemanagerclient.exe"
del /f /q "C:\Documents and Settings\DADMTB\PlochaEditorFKWP2.0.exe"
del /f /q "C:\Documents and Settings\DADMTB\PlochaEditorFKWP1.5.exe"
del /f /q "C:\WINDOWS\kdftlboerql.dll"
del /f /q "C:\WINDOWS\system32\elgjubqb.exe"
del /f /q "C:\WINDOWS\AM_D8.PRF"
del /f /q "C:\WINDOWS\system32\rstwa.bak1"
del /f /q "C:\WINDOWS\system32\rstwa.bak2"
del /f /q "C:\WINDOWS\system32\rstwa.ini2"
del /f /q "C:\WINDOWS\system32\mpqss.ini2"
rd /s /q "C:\Documents and Settings\All Users\Data aplikací\kdghuhyr"
rd /s /q "C:\Documents and Settings\DADMTB\Plochavirii"

batch c:\del.txt c:\log.txt