PC-HELP.CZ

Při startu se zobrazí okno : ipwins.exe - Součást nelze najít
------------------------------------------------
Aplikace nemohla být spuštěna,protože součást ipwins.dll nelze najít.
Potíže pravděpodobně odstraníte opětovnou instalací aplikace.
-----------------------------------------------------------------------------------------
Co s tím udělat? Nešlo by zkopírovat soubor z jiného PC?
Nevím k čemu soubor slouží,zatím jsem přišel na to,že nejde změnit pozadí plochy.

Děkuji předem za radu.

Vlož sem log z HijackThis

VIZ http://forums.techguy.org/security/5582 ... s-dll.html

Logfile of HijackThis v1.99.1
Scan saved at 16:39:14, on 10.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\updater.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\DĚDA\PROGRAMY\Phone\Skype.exe
D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
D:\DĚDA\PROGRAMY\Plugin Manager\SkypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\DĚDA\PROGRAMY\WinRAR\WinRAR.exe
C:\Documents and Settings\doma\Plocha\Hijack This\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\updater.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\DĚDA\PROGRAMY\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [FreeCall] "D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS1\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS2\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

Ukonči v TaskManageru (zmáčkni zároveň klávesy ctrl+alt+delete) otevře se ti okno a v něm se přepni na záložku Procesy a v ní ukonči:
updater.exe

Odinstaluj přes Přidat nebo Odebrat programy jestli tam bude (měl by se jmenovat):
IpWins nebo Ipwindows
případně pokud bys ho tam nenašel tak to zkus odinstalovat následovně: Start -> Spustit a do toho okna napiš toto: %ProgramFiles%\Ipwindows\Uninst.exe a dej Ok

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\updater.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe

po zaškrtnutí klikni na tlačítko Fix Checked

Pak smaž celý adresář označený červeně:
C:\Program Files\Ipwindows

Stáhni si Mwav. Proveď update a spusť prohlídku přes tlačítko Scan & Clean (nesmíš mít zatrhnutou volbu Scan Only). Pokud ještě něco najde tak to odstraní. Po ukončení prohlídky bude chtít možná restart tak ho povol.

Pak sem dej nový log z HJT.

Tue Apr 10 20:19:55 2007 => Offending file found: C:\WINDOWS\updater.exe
Tue Apr 10 20:19:55 2007 => System found infected with winfixer/errorsafe Adware (updater.exe)! Action taken: Entries Removed.
Tue Apr 10 20:19:55 2007 => Object "winfixer/errorsafe Adware" found in File System! Action Taken: Entries Removed.

Tue Apr 10 20:20:36 2007 => Offending file found: C:\WINDOWS\system32\unrar.dll
Tue Apr 10 20:20:36 2007 => System found infected with savenow Adware (C:\WINDOWS\system32\unrar.dll)! Action taken: Entries Removed.
Tue Apr 10 20:20:36 2007 => Object "savenow Adware" found in File System! Action Taken: Entries Removed.

Tue Apr 10 20:22:18 2007 => Scanning File C:\WINDOWS\System32\WScript.exe
Tue Apr 10 20:22:18 2007 => Clearing Internet Cache as Spyware/Adware found in system...
Tue Apr 10 20:22:22 2007 => Clearing Temporary sub-folders as Spyware/Adware found in system...
Tue Apr 10 20:22:42 2007 => ** Value in HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\main/Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
Tue Apr 10 20:22:42 2007 => ** Value in HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main/Start Page = http://www.seznam.cz/

Tue Apr 10 20:27:32 2007 => File C:\DOCUME~1\doma\LOCALS~1\TEMPOR~1\Content.IE5\GTYN0XQV\mmn[1].exe//PE_Patch.UPX//UPX infected by "SpamTool.Win32.Agent.af" Virus! Action Taken: File Renamed.

Tue Apr 10 20:26:25 2007 => File C:\DOCUME~1\doma\LOCALS~1\Temp\v4x3.ga2me//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.bls" Virus! Action Taken: File Deleted.

Tue Apr 10 20:25:55 2007 => File C:\DOCUME~1\doma\LOCALS~1\Temp\6.dllb infected by "Email-Worm.Win32.Zhelatin.co" Virus! Action Taken: File Deleted.

Tue Apr 10 20:25:38 2007 => File C:\WINDOWS\system32\vexg4am1et2.exe infected by "Email-Worm.Win32.Zhelatin.co" Virus! Action Taken: File Deleted.

Tue Apr 10 20:24:08 2007 => File C:\WINDOWS\system32\mmn.exe.exe//PE_Patch.UPX//UPX infected by "SpamTool.Win32.Agent.af" Virus! Action Taken: File Renamed.

Tue Apr 10 20:24:07 2007 => File C:\WINDOWS\system32\mmn.exe//PE_Patch.UPX//UPX infected by "SpamTool.Win32.Agent.af" Virus! Action Taken: File Renamed.

Tue Apr 10 20:23:18 2007 => File C:\WINDOWS\system32\dlh9jkd1q6.exe infected by "Email-Worm.Win32.Zhelatin.co" Virus! Action Taken: File Deleted.

Tue Apr 10 20:22:44 2007 => File C:\WINDOWS\b122.exe//stream//data0004 tagged as "not-a-virus:AdWare.Win32.Softomate.u". Action Taken: File Deleted.

Tue Apr 10 20:29:14 2007 => ***** Scanning complete. *****
Tue Apr 10 20:29:14 2007 => Total Objects Scanned: 28249
Tue Apr 10 20:29:14 2007 => Total Critical Objects: 13
Tue Apr 10 20:29:14 2007 => Total Disinfected Objects: 0
Tue Apr 10 20:29:14 2007 => Total Objects Renamed: 3
Tue Apr 10 20:29:14 2007 => Total Deleted Objects: 101
Tue Apr 10 20:29:14 2007 => Total Errors: 94
Tue Apr 10 20:29:14 2007 => Time Elapsed: 00:11:31
Tue Apr 10 20:29:14 2007 => Virus Database Date: 4/9/2007
Tue Apr 10 20:29:14 2007 => Virus Database Count: 292747

Tue Apr 10 20:29:14 2007 => Scan Completed.

Všechno by mělo být smazané.

Pročisti Pc ještě tímto: CCleaner (Čistič, Problémy)

a pak to zkus znovu projet Mwavem. Jestli bude u položky Total Critical Objects: 0
tak je to v pořádku a pokud nemáš další problémy tak je to vše pokud ne tak pak řekni. Pak sem ještě dej ten log z HJT.

HJT jěště před vyčičtěním:

Logfile of HijackThis v1.99.1
Scan saved at 22:06:05, on 10.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
D:\DĚDA\PROGRAMY\Phone\Skype.exe
D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
D:\DĚDA\PROGRAMY\Plugin Manager\SkypePM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\doma\Plocha\Hijack This\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\DĚDA\PROGRAMY\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [FreeCall] "D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS1\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS2\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

Ještě fixni v HJT toto:
Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
po zaškrtnutí klikni na tlačítko Fix Checked

Log už vypadá v pořádku ale bylo by dobré si doinstalovat pro lepší bezpečnost firewall.

Firewally zdarma:
Comodo - kvalitní, pokročilý, s mnoha funkcemi, originálně v angličtině, čeština by měla být asi až od verze 3 která by měla vyjít někdy během dubna
Kerio - přehledný, větší možnosti nastavení, náročnější na systémové prostředky, v češtině
ZoneAlarm - jednoduchý, kompatibilní, nenáročný na systémové prostředky, málo možností nastavení, v angličtině

Když používáš OpenOffice tak bych ti doporučil provést jeho update na verzi 2.2

Wed Apr 11 19:19:25 2007 => ***** Scanning complete. *****

Wed Apr 11 19:19:25 2007 => Total Objects Scanned: 23931
Wed Apr 11 19:19:25 2007 => Total Critical Objects: 0
Wed Apr 11 19:19:25 2007 => Total Disinfected Objects: 0
Wed Apr 11 19:19:25 2007 => Total Objects Renamed: 0
Wed Apr 11 19:19:25 2007 => Total Deleted Objects: 8
Wed Apr 11 19:19:25 2007 => Total Errors: 10
Wed Apr 11 19:19:25 2007 => Time Elapsed: 00:06:05
Wed Apr 11 19:19:25 2007 => Virus Database Date: 4/9/2007
Wed Apr 11 19:19:25 2007 => Virus Database Count: 292747

Wed Apr 11 19:19:25 2007 => Scan Completed.

Logfile of HijackThis v1.99.1
Scan saved at 19:32:02, on 11.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\DĚDA\PROGRAMY\Phone\Skype.exe
D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
D:\DĚDA\PROGRAMY\Plugin Manager\SkypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\doma\LOCALS~1\Temp\mexe.com
C:\DOCUME~1\doma\LOCALS~1\Temp\ScanningProcess.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\doma\Plocha\Hijack This\hijackthis\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\DĚDA\PROGRAMY\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [FreeCall] "D:\DĚDA\PROGRAMY\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS1\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O17 - HKLM\System\CS2\Services\Tcpip\..\{07F7BEBF-5124-42B5-B4BE-C6F1461C33B4}: NameServer = 80.251.252.138
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe


Nejde stále změnit pozadí na ploše,proč? Děti tam dali obrázek "Magic Kinder" a nejde to změnit.

Použil jsem podle rad z fóra "nnncleaner" a problém je vyřešen.
Děkuji všem za poskytnuté rady.