S pamätí nezle provést operaci...

ComboFix 08-06-16.3 - Janko 2008-06-17 16:09:58.1 - NTFSx86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.420.1029.18.636 [GMT 2:00]
Running from: D:\Install\Downloaded\ComboFix.exe
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\windows\regedit.com
C:\windows\system32\taskmgr.com

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


(((((((((((((((((((((((((   Files Created from 2008-05-17 to 2008-06-17  )))))))))))))))))))))))))))))))
.

2008-06-17 16:05 . 2008-06-17 16:05   <DIR>   d--------   C:\Program Files\Trend Micro
2008-06-17 14:16 . 2008-06-17 14:16   5,959,308   --a------   C:\WINDOWS\REGBK02.ZIP
2008-06-16 20:21 . 2008-06-16 20:21   406   --a------   C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-06-16 19:59 . 2008-06-16 19:59   74,703   --a------   C:\WINDOWS\system32\mfc45.dll
2008-06-16 17:22 . 2008-06-16 17:22   143,104   --a------   C:\WINDOWS\system32\guard32.dll
2008-06-16 17:22 . 2008-06-16 17:22   87,056   --a------   C:\WINDOWS\system32\drivers\cmdguard.sys
2008-06-16 17:22 . 2008-06-16 17:22   24,208   --a------   C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-06-16 16:06 . 2008-06-16 16:18   327   --a------   C:\WINDOWS\CoDUO.INI
2008-06-16 15:51 . 2008-06-17 13:06   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2008-06-16 15:51 . 2008-06-16 15:51   1,409   --a------   C:\WINDOWS\QTFont.for
2008-06-16 15:29 . 2008-06-16 15:43   741   --a------   C:\WINDOWS\CoD.INI
2008-06-14 20:55 . 2008-06-14 20:55   <DIR>   d--------   C:\Program Files\DAEMON Tools Lite
2008-06-14 20:49 . 2008-06-14 20:49   717,296   --a------   C:\WINDOWS\system32\drivers\sptd.sys.58714599
2008-06-14 17:35 . 2008-06-14 17:35   <DIR>   d--------   C:\Program Files\Edmark.com Downloads
2008-06-14 17:35 . 1999-12-17 09:13   86,016   --a------   C:\WINDOWS\unvise32.exe
2008-06-13 13:42 . 2008-06-13 13:42   <DIR>   d--------   C:\Program Files\ReflexiveArcade
2008-06-12 10:55 . 2008-06-12 10:55   <DIR>   d--------   C:\Program Files\Windows Media Connect 2
2008-06-11 09:38 . 2008-04-14 18:00   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-11 09:38 . 2008-05-08 16:02   203,136   -----c---   C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-10 19:31 . 2008-06-10 19:31   <DIR>   d--------   C:\Program Files\IrfanView
2008-06-10 17:48 . 1994-12-06 01:00   12,800   --a------   C:\WINDOWS\system\WING32.DLL
2008-06-09 19:27 . 2002-01-28 14:32   45,056   --a------   C:\WINDOWS\system32\prnunins.exe
2008-06-09 19:26 . 2008-06-09 19:26   <DIR>   d--------   C:\Program Files\hp deskjet 5550 series
2008-06-09 19:26 . 2002-07-11 14:01   147,512   --a------   C:\WINDOWS\system32\hpzlnt06.dll
2008-06-09 19:26 . 2008-06-09 19:26   820   --a------   C:\WINDOWS\hpinfo.lnk
2008-06-09 19:22 . 2008-06-09 19:27   <DIR>   d--------   C:\Program Files\Hewlett-Packard
2008-06-04 23:37 . 2006-11-03 00:00   171,136   -rahs----   C:\grldr
2008-05-31 13:23 . 2008-04-28 15:53   805,400   -ra------   C:\WINDOWS\system32\tmp236.tmp
2008-05-31 13:23 . 2008-04-28 15:53   805,400   -ra------   C:\WINDOWS\system32\tmp235.tmp
2008-05-29 17:53 . 2006-12-14 20:47   782,336   -ra------   C:\WINDOWS\system32\tmp1E0.tmp
2008-05-28 15:00 . 2008-05-28 15:01   5,966,473   --a------   C:\WINDOWS\REGBK01.ZIP
2008-05-28 14:46 . 2008-06-02 17:10   60   --a------   C:\WINDOWS\WININIT.INI
2008-05-25 15:05 . 2006-06-22 19:44   2,201,224   --a------   C:\WINDOWS\system32\Flash9.ocx
2008-05-25 11:59 . 2008-05-25 11:59   <DIR>   d--------   C:\Program Files\NeoTheme
2008-05-24 14:29 . 2008-06-04 13:52   <DIR>   d--------   C:\$RECYCLE.BIN
2008-05-21 20:02 . 2008-05-21 20:02   <DIR>   d--------   C:\Program Files\PROnetworks
2008-05-21 16:18 . 2008-06-04 23:38   <DIR>   d--------   C:\Boot
2008-05-21 16:18 . 2008-01-21 04:22   333,203   -rahs----   C:\bootmgr
2008-05-21 16:18 . 2008-06-04 23:38   8,192   -ra-s----   C:\BOOTSECT.BAK
2008-05-21 13:34 . 2008-06-04 13:23   1,905   --a------   C:\WINDOWS\diagwrn.xml
2008-05-21 13:34 . 2008-06-04 13:23   1,905   --a------   C:\WINDOWS\diagerr.xml
2008-05-19 13:34 . 2006-10-26 19:56   32,592   --a------   C:\WINDOWS\system32\msonpmon.dll
2008-05-19 13:33 . 2008-05-19 13:33   <DIR>   d--------   C:\Program Files\MSBuild
2008-05-19 13:33 . 2008-05-19 13:33   <DIR>   d--------   C:\Program Files\Microsoft Works
2008-05-19 13:32 . 2008-05-19 13:32   <DIR>   d--------   C:\Program Files\Microsoft.NET
2008-05-19 13:31 . 2008-05-19 13:31   <DIR>   d--------   C:\Program Files\Microsoft Visual Studio 8
2008-05-19 13:30 . 2008-05-19 13:33   <DIR>   d--------   C:\WINDOWS\SHELLNEW
2008-05-19 13:29 . 2008-05-19 13:29   <DIR>   d--------   C:\MSOCache
2008-05-17 10:19 . 1996-11-05 16:13   299,008   --a------   C:\WINDOWS\uninst.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-17 12:01   ---------   d-----w   C:\Program Files\SpeedFan
2008-06-17 11:46   ---------   d-----w   C:\Program Files\FlashGet
2008-06-17 11:01   ---------   d-----w   C:\Program Files\Mozilla Thunderbird
2008-06-16 15:22   ---------   d-----w   C:\Program Files\Comodo
2008-06-16 14:18   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-06-12 11:19   ---------   d-----w   C:\Program Files\Opera
2008-06-12 09:06   ---------   d-----w   C:\Program Files\CCleaner
2008-06-11 13:29   22,328   ----a-w   C:\windows\system32\drivers\PnkBstrK.sys
2008-06-10 13:30   ---------   d-----w   C:\Program Files\Common Files\Wise Installation Wizard
2008-06-10 13:29   ---------   d-----w   C:\Program Files\Zoner
2008-06-10 13:28   ---------   d-----w   C:\Program Files\Tuning Car Studio
2008-06-10 13:23   ---------   d-----w   C:\Program Files\RivaTuner v2.06
2008-06-05 15:05   ---------   d-----w   C:\Program Files\Cyanide
2008-05-29 15:53   ---------   d-----w   C:\Program Files\OpenAL
2008-05-25 12:43   ---------   d-----w   C:\Program Files\Total Commander 7
2008-05-20 15:43   ---------   d-----w   C:\Program Files\Microsoft Silverlight
2008-05-15 18:44   ---------   d-----w   C:\Program Files\VirtualDub 1.7.7
2008-05-15 13:15   ---------   d-----w   C:\Program Files\Pivot Stickfigure Animator
2008-05-11 18:22   ---------   d-----w   C:\Program Files\nLite
2008-05-10 12:14   ---------   d-----w   C:\Program Files\AMD
2008-05-08 14:02   203,136   ----a-w   C:\windows\system32\drivers\rmcast.sys
2008-05-08 09:07   ---------   d-----w   C:\Program Files\Anti-Leech
2008-05-03 10:11   ---------   d-----w   C:\Program Files\Elaborate Bytes
2008-05-03 09:16   717,296   ----a-w   C:\windows\system32\drivers\sptd.sys.12704182
2008-05-02 14:58   ---------   d-----w   C:\Program Files\Kaspersky Lab
2008-04-28 12:13   4,950,891   ----a-w   C:\windows\REGBK00.ZIP
2008-04-20 18:22   ---------   d-----w   C:\Program Files\YouTube Downloader
2008-04-17 13:38   ---------   d-----w   C:\Program Files\Godlike Developers
2008-04-14 06:52   69,632   ----a-w   C:\windows\notepad.exe
2008-04-14 06:52   50,688   ----a-w   C:\windows\twain_32.dll
2008-04-14 06:52   33,280   ----a-w   C:\windows\Help\sstub.dll
2008-04-14 06:52   32,866   ------w   C:\windows\slrundll.exe
2008-04-14 06:52   283,648   ----a-w   C:\windows\winhlp32.exe
2008-04-14 06:52   279,040   ----a-w   C:\windows\Help\tshoot.dll
2008-04-14 06:52   147,968   ----a-w   C:\windows\regedit.exe
2008-04-14 06:52   10,752   ----a-w   C:\windows\hh.exe
2008-04-14 06:52   1,034,240   ----a-w   C:\windows\explorer.exe
2008-04-14 06:51   451,072   ----a-w   C:\windows\AppPatch\aclayers.dll
2008-04-14 06:51   39,424   ----a-w   C:\windows\AppPatch\acadproc.dll
2008-04-14 06:51   34,816   ----a-w   C:\windows\Help\sniffpol.dll
2008-04-14 06:51   245,248   ----a-w   C:\windows\AppPatch\acspecfc.dll
2008-04-14 06:51   141,312   ----a-w   C:\windows\AppPatch\aclua.dll
2008-04-14 06:51   116,224   ----a-w   C:\windows\AppPatch\acxtrnal.dll
2008-04-14 06:51   1,852,928   ----a-w   C:\windows\AppPatch\acgenral.dll
2008-03-24 14:17   90,786   ----a-w   C:\windows\wubi-uninstall.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 15:08 2289664]
"RAMSaverPro"="C:\Program Files\Godlike Developers\RAM Saver Pro\ramsaverpro.exe" [2008-04-16 13:38 156192]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2008-04-14 08:52 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]
"Fraps"="C:\FRAPS\FRAPS.EXE" [2007-11-21 20:49 3182248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-27 04:47 16208384 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"amd_dc_opt"="C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 16:42 106496]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-03-20 18:40 213936]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 18:40 86960]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 18:40 213936]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"VirtualCloneDrive"="C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 15:21 94208]
"HPDJ Taskbar Utility"="C:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 14:01 188416]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\cfp.exe" [2008-06-16 17:22 1655552]
"combofix"="C:\windows\system32\CF18453.exe" [2008-04-14 08:52 390144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Janko^Nabídka Start^Programy^Po spuštění^Styler.lnk]
backup=C:\WINDOWS\pss\Styler.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTCheck]
--------- 2007-10-25 13:51 380928 C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2007-07-17 12:03 868352 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
--a------ 2007-05-11 03:08 2512392 C:\WINDOWS\system32\oodtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QIP2005]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-03-01 07:10 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"D:\\HRY\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 sfdrv02;FrontLine Environment Driver (v2);C:\windows\system32\drivers\sfdrv02.sys [2006-09-11 13:57]
R0 sfsync05;FrontLine Synchronization Driver (v5);C:\windows\system32\drivers\sfsync05.sys [2006-08-11 18:09]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\windows\system32\DRIVERS\cmdguard.sys [2008-06-16 17:22]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\windows\system32\DRIVERS\cmdhlp.sys [2008-06-16 17:22]
R2 acedrv11;acedrv11;C:\WINDOWS\system32\drivers\acedrv11.sys [2008-01-23 10:19]
R3 AmdTools;AMD Special Tools Driver;C:\windows\system32\DRIVERS\AmdTools.sys [2007-04-05 16:56]
R3 PSched;Plánovač paketů technologie QoS;C:\windows\system32\DRIVERS\psched.sys [2008-04-14 00:26]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\windows\system32\DRIVERS\usbohci.sys [2008-04-14 00:15]
S2 sfrem02;FrontLine Drivers Auto Removal (v2);C:\windows\system32\sfrem02.exe svc []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-14 00:15]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 16:13:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-06-17 16:15:51 - machine was rebooted [Janko]
ComboFix-quarantined-files.txt  2008-06-17 14:15:47

           Adresářů:    12,   Volných bajtů: 18,668,654,592
           Adres ý…:    14,   Volněch bajt…: 18,693,185,536

231   --- E O F ---   2008-06-12 05:17:55


HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:20, on 17. 6. 2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\windows\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\windows\system32\PnkBstrA.exe
C:\windows\Explorer.EXE
C:\windows\RTHDCPL.EXE
C:\windows\system32\ctfmon.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Comodo\Firewall\cfp.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Godlike Developers\RAM Saver Pro\ramsaverpro.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\Total Commander 7\TOTALCMD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [RAMSaverPro] C:\Program Files\Godlike Developers\RAM Saver Pro\ramsaverpro.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Stiahnuť položku pomocou FlashGetu - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Stiahnuť všetky položky pomocou FlashGetu - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198343395531
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/SU/SU1.5/ocx/15034/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{072000B5-690D-4A38-905B-AD5983B47BCB}: NameServer = 217.119.113.244,217.119.113.245
O17 - HKLM\System\CCS\Services\Tcpip\..\{1228490F-768D-4F91-843A-49264F42978E}: NameServer = 217.119.113.244,217.119.113.245
O17 - HKLM\System\CS1\Services\Tcpip\..\{072000B5-690D-4A38-905B-AD5983B47BCB}: NameServer = 217.119.113.244,217.119.113.245
O17 - HKLM\System\CS2\Services\Tcpip\..\{072000B5-690D-4A38-905B-AD5983B47BCB}: NameServer = 217.119.113.244,217.119.113.245
O17 - HKLM\System\CS3\Services\Tcpip\..\{072000B5-690D-4A38-905B-AD5983B47BCB}: NameServer = 217.119.113.244,217.119.113.245
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:  C:\windows\system32\guard32.dll
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\windows\system32\sfrem02.exe

--
End of file - 8519 bytes

Objekt "kazaa Spyware/Adware" nalezen v souborovém systému! Provedené akce: Záznam odstraněn.
Objekt "backdoor (ircbot) trojans Spyware/Adware" nalezen v souborovém systému! Provedené akce: Záznam odstraněn.
Objekt "backdoor (ircbot) trojans Spyware/Adware" nalezen v souborovém systému! Provedené akce: Záznam odstraněn.
Objekt "spyware.expresskeylog Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Záznam odstraněn.
Objekt "combo Spyware/Adware" nalezen v souborovém systému! Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{125F0ACC-D3FC-402B-8D96-27F6E46D00D5}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{45D68F08-56A0-4412-BB0F-8492BE978AC7}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{558CD0A7-0548-4220-88FE-01CC1477DF61}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{5AC9F44E-06C7-41E3-A464-37177AB9105D}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{7C3E3706-8FBD-4169-9726-0A47FBF9D32A}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{901C63FD-6673-47A6-9B5F-B13E3EBFA470}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{C3CE4CED-46B0-407E-A703-7A83AAE02A36}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{DBE84DB2-1794-4244-9859-9B720CA89B4D}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{F00E58A1-57C5-4858-BA7A-08B5B8D249BC}". Provedené akce: Záznam odstraněn.
Záznam "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" odkazuje na neplatný objekt "{F68E3631-68ED-4970-8D77-B81FE83AA6A1}". Provedené akce: Záznam odstraněn.