Prosim o kontrolu logu

[vyosek]

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[danielrk]

ComboFix 11-08-27.01 - Daniel 28.08.2011 18:46:15.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1145 [GMT 2:00]
Spuštěný z: c:\documents and settings\Daniel\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\_004071_.tmp.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 16:02 . 2011-08-28 16:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-28 15:41 . 2011-08-28 15:41 -------- d-----w- c:\documents and settings\Daniel\Local Settings\Data aplikací\Mozilla
2011-08-28 13:22 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-27 21:05 . 2011-08-28 13:31 -------- d-----w- c:\program files\trend micro
2011-08-27 21:05 . 2011-08-28 13:32 -------- d-----w- C:\rsit
2011-08-27 19:44 . 2011-08-27 19:44 -------- d-----w- c:\program files\Sophos
2011-08-27 14:00 . 2011-08-27 14:00 -------- d-----w- c:\program files\Logitech
2011-08-27 13:50 . 2011-08-27 13:50 -------- d-----w- c:\windows\system32\Adobe
2011-08-27 13:38 . 2011-08-27 13:38 -------- d-----w- c:\documents and settings\All Users\Uniblue
2011-08-27 13:07 . 2010-11-03 16:15 359016 ----a-w- c:\windows\vncutil.exe
2011-08-27 13:07 . 2011-08-15 14:47 60008 ----a-w- c:\windows\system32\RtkCoInstXP.dll
2011-08-27 13:07 . 2010-11-03 16:14 129640 ----a-w- c:\windows\RtkAudioService.exe
2011-08-27 13:06 . 2009-11-18 05:17 1395800 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2011-08-27 13:06 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2011-08-27 13:06 . 2011-07-11 12:17 1698408 ----a-w- c:\windows\RtlExUpd.dll
2011-08-26 19:55 . 2011-08-26 19:57 -------- d-----w- c:\program files\Easy Graphic Converter
2011-08-25 13:06 . 2011-08-25 13:06 -------- d-----w- c:\program files\iPod
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin8.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-08-25 13:02 . 2011-08-25 13:03 -------- d-----w- c:\program files\QuickTime
2011-08-23 12:46 . 2011-08-27 16:11 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Tropico 4
2011-08-23 11:50 . 2011-08-23 11:50 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Kalypso Media
2011-08-22 13:51 . 2011-08-22 13:51 -------- d-----w- c:\documents and settings\Daniel\Local Settings\Data aplikací\ESET
2011-08-22 10:39 . 2011-08-22 10:39 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Engelmann Media
2011-08-22 10:39 . 2011-08-22 10:39 -------- d-----w- c:\program files\Common Files\HDX4
2011-08-22 08:00 . 2011-02-23 14:54 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-08-22 07:59 . 2011-02-23 15:04 13496 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-08-12 12:00 . 2011-08-12 14:46 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Tropico 4 Demo
2011-08-12 09:56 . 2011-08-12 09:56 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\ESET
2011-08-11 20:41 . 2011-08-11 20:41 -------- d-----w- c:\program files\SystemRequirementsLab
2011-08-11 20:40 . 2011-08-11 20:40 -------- d-----w- c:\documents and settings\Daniel\SystemRequirementsLab
2011-08-11 07:48 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 07:47 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-09 19:08 . 2011-08-09 19:08 -------- d-----w- c:\program files\WMP Tag Plus
2011-08-09 19:08 . 2009-10-09 12:51 77824 ----a-w- c:\program files\Windows Media Player\wmp.dll
2011-07-31 06:51 . 2011-07-31 06:51 65536 ----a-w- c:\windows\system32\frapsvid.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-27 20:15 . 2010-10-09 16:42 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-08-27 20:15 . 2010-11-06 21:03 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-08-27 20:15 . 2010-10-09 16:41 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-27 19:47 . 2010-10-09 16:41 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-08-16 16:46 . 2010-10-05 10:05 6427240 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2011-08-09 14:14 . 2010-10-05 10:05 20055144 ----a-w- c:\windows\RTHDCPL.EXE
2011-08-04 14:59 . 2010-10-05 10:05 1493608 ----a-w- c:\windows\RtlUpd.exe
2011-08-03 11:49 . 2011-04-07 20:15 600680 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-03 11:49 . 2011-04-07 20:15 54272 ----a-w- c:\windows\system32\nvwddi.dll
2011-08-03 11:49 . 2011-04-07 20:15 13892200 ----a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:49 . 2011-04-07 20:15 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:49 . 2011-04-07 20:15 146024 ----a-w- c:\windows\system32\nvsvc32.exe
2011-08-03 11:49 . 2011-04-07 20:15 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-08-03 11:49 . 2011-01-07 18:58 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-08-03 11:49 . 2011-01-07 18:58 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-08-03 11:49 . 2011-01-07 18:58 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-08-03 11:49 . 2011-01-07 18:58 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-08-03 11:49 . 2011-01-07 18:58 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-08-03 11:49 . 2011-01-07 18:58 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-08-03 11:49 . 2011-01-07 18:58 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-08-03 11:49 . 2011-01-07 18:58 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-08-03 11:49 . 2010-11-12 17:47 914024 ----a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:49 . 2010-11-12 17:47 875112 ----a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:49 . 2010-11-05 22:27 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:49 . 2010-11-05 22:27 2387560 ----a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:49 . 2010-11-05 22:27 2090088 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:49 . 2010-11-05 22:27 17186816 ----a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:49 . 2008-05-16 18:31 5427200 ----a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:49 . 2008-05-16 18:31 4210816 ----a-w- c:\windows\system32\nv4_disp.dll
2011-08-03 11:49 . 2008-05-16 18:31 2404864 ----a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:49 . 2008-05-16 18:31 16191488 ----a-w- c:\windows\system32\nvoglnt.dll
2011-08-03 11:49 . 2008-05-16 18:31 12542592 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-07-15 13:29 . 2006-03-02 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-08 14:02 . 2006-03-02 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 12:21 . 2011-07-06 12:21 311296 ----a-w- c:\windows\system32\EMRegSys.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-30 14:15 . 2010-10-05 10:05 891496 ----a-w- c:\windows\system32\RTSndMgr.CPL
2011-06-24 14:10 . 2010-10-05 09:54 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2006-03-02 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-03-02 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2006-03-02 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-12 16:53 . 2010-10-05 17:24 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-06 11:35 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2010-10-06 16:32 . 2010-10-06 16:32 6274424 ----a-w- c:\program files\Silverlight.exe
2011-08-12 06:10 . 2011-08-28 15:40 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-08-09 417112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m‘|\ü" [X]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"PAC7311_Monitor"="c:\windows\PixArt\PAC7311\Monitor.exe" [2006-11-03 319488]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 718688]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]
"iTunesHelper"="e:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-09 20055144]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 92168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2011-07-20 4393816]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Kamila\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G\COMMON\TWCU.exe [2010-10-5 1298432]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"e:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"e:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"e:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\Program Files\\Rockstar Games\\EFLC\\EFLC.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"e:\\Documents and Settings\\MW2 Multiplayer\\Call Of Duty Modern Warfare 2 MULTIPLAYER-AlterIWnet\\Cod4-MW2 AlterIW.net\\iw4mp.dat"=
"e:\\Documents and Settings\\MW2 Multiplayer\\Call Of Duty Modern Warfare 2 MULTIPLAYER-AlterIWnet\\Cod4-MW2 AlterIW.net\\iw4mp.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\pes2011.exe"=
"e:\\Program Files\\Atari\\TDU2\\TestDrive2.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"e:\\Program Files\\Atari\\TDU2\\UpLauncher.exe"=
"e:\\Program Files\\Atari\\TDU2\\_UpLauncher.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\ACBSP.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\ACBMP.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\AssassinsCreedBrotherhood.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\UPlayBrowser.exe"=
"e:\\Program Files\\Steam\\Steam.exe"=
"e:\\Program Files\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"e:\\Program Files\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"e:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Program Files\\Microsoft Games\\Age of Empires Online\\Spartan.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [22.8.2011 9:59 13496]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5.10.2010 18:57 691696]
R1 MpKsl0118afc8;MpKsl0118afc8;\??\c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{21DCAB05-F313-43E8-BCEB-C38990597B20}\MpKsl0118afc8.sys --> c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{21DCAB05-F313-43E8-BCEB-C38990597B20}\MpKsl0118afc8.sys [?]
R1 MpKsl77fe2030;MpKsl77fe2030;\??\c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{21DCAB05-F313-43E8-BCEB-C38990597B20}\MpKsl77fe2030.sys --> c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{21DCAB05-F313-43E8-BCEB-C38990597B20}\MpKsl77fe2030.sys [?]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [11.7.2011 17:31 328536]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [22.8.2011 9:59 820568]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11.7.2011 18:00 2255464]
R2 TunngleService;TunngleService;e:\program files\Tunngle\TnglCtrl.exe [31.10.2010 14:11 716024]
R3 PAC7311;Trust Webcam Live;c:\windows\system32\drivers\PA707UCM.SYS [14.3.2007 11:57 449024]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [22.8.2011 9:59 30368]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [22.8.2011 9:59 16080]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20.12.2010 22:07 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [27.8.2011 15:06 1691480]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20.12.2010 22:07 136176]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\2ABA.tmp --> c:\windows\system32\2ABA.tmp [?]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [25.3.2010 11:25 30969208]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 22:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 14:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [22.8.2011 9:59 239600]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-08-26 c:\windows\Tasks\ASC4_AutoCare.job
- c:\program files\IObit\Advanced SystemCare 4\AutoCare.exe [2011-07-11 14:38]
.
2011-08-28 c:\windows\Tasks\ASC4_AutoUpdate.job
- c:\program files\IObit\Advanced SystemCare 4\AutoUpdate.exe [2011-07-11 14:38]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-20 20:07]
.
2011-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-20 20:07]
.
2011-08-28 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2011-08-22 18:19]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\Daniel\Data aplikací\Mozilla\Firefox\Profiles\94hxaoo8.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-28 18:51
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\2ABA.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-484763869-1343024091-839522115-1006\Software\SecuROM\License information*]
"datasecu"=hex:3d,eb,27,6a,06,5b,14,6a,54,1f,f1,77,fe,f4,7b,f0,cd,86,9c,b2,3e,
9e,f8,1d,bb,2d,eb,df,b2,23,75,c3,2c,dd,73,74,de,7b,9b,a9,df,4b,b0,9c,b1,5b,\
"rkeysecu"=hex:ec,a5,9a,8b,b8,e1,49,95,94,a1,4c,02,31,64,7a,59
.
Celkový čas: 2011-08-28 18:53:15
ComboFix-quarantined-files.txt 2011-08-28 16:53
.
Před spuštěním: Volných bajtů: 13 540 442 112
Po spuštění: Volných bajtů: 14 925 955 072
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - A87519030E1CD0D88B67A84D6F1C66D3

[vyosek]

Odinstalujte Advanced SystemCare 4 a IObit Malware Fighter a nasledne i vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "GEST"=-
  "NeroFilterCheck"=-
  "SSBkgdUpdate"=-
  "DivX Download Manager"=-
  "DivXUpdate"=-
  "SunJavaUpdateSched"=-
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "QuickTime Task"=-
  "iTunesHelper"=-
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "5985:TCP"=-
  
  Driver::
  MpKsl0118afc8
  MpKsl77fe2030
  gupdate
  gupdatem
  MEMSWEEP2
  
  File::
  c:\windows\system32\2ABA.tmp
  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
  C:\WINDOWS\tasks\ASC4_AutoCare.job
  C:\WINDOWS\tasks\ASC4_AutoUpdate.job
  C:\WINDOWS\tasks\AutoKMS.job
  C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
  C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1004Core.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1004UA.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1006Core.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1006UA.job
  C:\WINDOWS\tasks\SmartDefrag_Startup.job
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[danielrk]

tak jsem udelal jak jste mi radil, doporucil byste mi nejakou nahradu? .. mam jiz ccleaner a drive jsem mel i adaware, mel bych si ho znovu nainstalovat?
zde log:
ComboFix 11-08-27.01 - Daniel 28.08.2011 22:05:08.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2046.1207 [GMT 2:00]
Spuštěný z: c:\documents and settings\Daniel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Daniel\Plocha\CFScript.txt
.
FILE ::
"c:\windows\system32\2ABA.tmp"
"c:\windows\tasks\AppleSoftwareUpdate.job"
"c:\windows\tasks\ASC4_AutoCare.job"
"c:\windows\tasks\ASC4_AutoUpdate.job"
"c:\windows\tasks\AutoKMS.job"
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1004Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1004UA.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1006Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-839522115-1006UA.job"
"c:\windows\tasks\SmartDefrag_Startup.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\tasks\AppleSoftwareUpdate.job
c:\windows\tasks\GoogleUpdateTaskMachineCore.job
c:\windows\tasks\GoogleUpdateTaskMachineUA.job
c:\windows\tasks\SmartDefrag_Startup.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GUPDATE
-------\Legacy_MEMSWEEP2
-------\Legacy_MPKSL0118AFC8
-------\Legacy_MPKSL77FE2030
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_MEMSWEEP2
-------\Service_MpKsl0118afc8
-------\Service_MpKsl77fe2030
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-28 do 2011-08-28 )))))))))))))))))))))))))))))))
.
.
2011-08-28 16:02 . 2011-08-28 16:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-28 15:41 . 2011-08-28 15:41 -------- d-----w- c:\documents and settings\Daniel\Local Settings\Data aplikací\Mozilla
2011-08-28 13:22 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-27 21:05 . 2011-08-28 13:31 -------- d-----w- c:\program files\trend micro
2011-08-27 21:05 . 2011-08-28 13:32 -------- d-----w- C:\rsit
2011-08-27 19:44 . 2011-08-27 19:44 -------- d-----w- c:\program files\Sophos
2011-08-27 14:00 . 2011-08-27 14:00 -------- d-----w- c:\program files\Logitech
2011-08-27 13:50 . 2011-08-27 13:50 -------- d-----w- c:\windows\system32\Adobe
2011-08-27 13:38 . 2011-08-27 13:38 -------- d-----w- c:\documents and settings\All Users\Uniblue
2011-08-27 13:07 . 2010-11-03 16:15 359016 ----a-w- c:\windows\vncutil.exe
2011-08-27 13:07 . 2011-08-15 14:47 60008 ----a-w- c:\windows\system32\RtkCoInstXP.dll
2011-08-27 13:07 . 2010-11-03 16:14 129640 ----a-w- c:\windows\RtkAudioService.exe
2011-08-27 13:06 . 2009-11-18 05:17 1395800 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2011-08-27 13:06 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2011-08-27 13:06 . 2011-07-11 12:17 1698408 ----a-w- c:\windows\RtlExUpd.dll
2011-08-26 19:55 . 2011-08-26 19:57 -------- d-----w- c:\program files\Easy Graphic Converter
2011-08-25 13:06 . 2011-08-25 13:06 -------- d-----w- c:\program files\iPod
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin8.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-08-25 13:03 . 2011-08-25 13:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-08-25 13:02 . 2011-08-25 13:03 -------- d-----w- c:\program files\QuickTime
2011-08-23 12:46 . 2011-08-27 16:11 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Tropico 4
2011-08-23 11:50 . 2011-08-23 11:50 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Kalypso Media
2011-08-22 13:51 . 2011-08-22 13:51 -------- d-----w- c:\documents and settings\Daniel\Local Settings\Data aplikací\ESET
2011-08-22 10:39 . 2011-08-22 10:39 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Engelmann Media
2011-08-22 10:39 . 2011-08-22 10:39 -------- d-----w- c:\program files\Common Files\HDX4
2011-08-12 12:00 . 2011-08-12 14:46 -------- d-----w- c:\documents and settings\Daniel\Data aplikací\Tropico 4 Demo
2011-08-12 09:56 . 2011-08-12 09:56 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\ESET
2011-08-11 20:41 . 2011-08-11 20:41 -------- d-----w- c:\program files\SystemRequirementsLab
2011-08-11 20:40 . 2011-08-11 20:40 -------- d-----w- c:\documents and settings\Daniel\SystemRequirementsLab
2011-08-11 07:48 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 07:47 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-09 19:08 . 2011-08-09 19:08 -------- d-----w- c:\program files\WMP Tag Plus
2011-08-09 19:08 . 2009-10-09 12:51 77824 ----a-w- c:\program files\Windows Media Player\wmp.dll
2011-07-31 06:51 . 2011-07-31 06:51 65536 ----a-w- c:\windows\system32\frapsvid.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-27 20:15 . 2010-10-09 16:42 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-08-27 20:15 . 2010-11-06 21:03 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-08-27 20:15 . 2010-10-09 16:41 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-27 19:47 . 2010-10-09 16:41 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-08-16 16:46 . 2010-10-05 10:05 6427240 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2011-08-09 14:14 . 2010-10-05 10:05 20055144 ----a-w- c:\windows\RTHDCPL.EXE
2011-08-04 14:59 . 2010-10-05 10:05 1493608 ----a-w- c:\windows\RtlUpd.exe
2011-08-03 11:49 . 2011-04-07 20:15 600680 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-03 11:49 . 2011-04-07 20:15 54272 ----a-w- c:\windows\system32\nvwddi.dll
2011-08-03 11:49 . 2011-04-07 20:15 13892200 ----a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:49 . 2011-04-07 20:15 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:49 . 2011-04-07 20:15 146024 ----a-w- c:\windows\system32\nvsvc32.exe
2011-08-03 11:49 . 2011-04-07 20:15 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrsel.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsth.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrseng.dll
2011-08-03 11:49 . 2011-01-07 18:58 126976 ----a-w- c:\windows\system32\nvrszht.dll
2011-08-03 11:49 . 2011-01-07 18:58 331776 ----a-w- c:\windows\system32\nvrshe.dll
2011-08-03 11:49 . 2011-01-07 18:58 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsru.dll
2011-08-03 11:49 . 2011-01-07 18:58 262144 ----a-w- c:\windows\system32\nvrshu.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrssl.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsda.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2011-08-03 11:49 . 2011-01-07 18:58 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2011-08-03 11:49 . 2011-01-07 18:58 335872 ----a-w- c:\windows\system32\nvrsar.dll
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrses.dll
2011-08-03 11:49 . 2011-01-07 18:58 278528 ----a-w- c:\windows\system32\nvrsde.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2011-08-03 11:49 . 2011-01-07 18:58 266240 ----a-w- c:\windows\system32\nvrsko.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrstr.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrssk.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrssv.dll
2011-08-03 11:49 . 2011-01-07 18:58 253952 ----a-w- c:\windows\system32\nvrsno.dll
2011-08-03 11:49 . 2011-01-07 18:58 249856 ----a-w- c:\windows\system32\nvrscs.dll
2011-08-03 11:49 . 2011-01-07 18:58 282624 ----a-w- c:\windows\system32\nvrsit.dll
2011-08-03 11:49 . 2011-01-07 18:58 274432 ----a-w- c:\windows\system32\nvrspt.dll
2011-08-03 11:49 . 2011-01-07 18:58 270336 ----a-w- c:\windows\system32\nvrsja.dll
2011-08-03 11:49 . 2011-01-07 18:58 258048 ----a-w- c:\windows\system32\nvrspl.dll
2011-08-03 11:49 . 2010-11-12 17:47 914024 ----a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:49 . 2010-11-12 17:47 875112 ----a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:49 . 2010-11-05 22:27 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:49 . 2010-11-05 22:27 2387560 ----a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:49 . 2010-11-05 22:27 2090088 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:49 . 2010-11-05 22:27 17186816 ----a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:49 . 2008-05-16 18:31 5427200 ----a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:49 . 2008-05-16 18:31 4210816 ----a-w- c:\windows\system32\nv4_disp.dll
2011-08-03 11:49 . 2008-05-16 18:31 2404864 ----a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:49 . 2008-05-16 18:31 16191488 ----a-w- c:\windows\system32\nvoglnt.dll
2011-08-03 11:49 . 2008-05-16 18:31 12542592 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-07-15 13:29 . 2006-03-02 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-08 14:02 . 2006-03-02 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 12:21 . 2011-07-06 12:21 311296 ----a-w- c:\windows\system32\EMRegSys.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-30 14:15 . 2010-10-05 10:05 891496 ----a-w- c:\windows\system32\RTSndMgr.CPL
2011-06-24 14:10 . 2010-10-05 09:54 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2006-03-02 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-03-02 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2006-03-02 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-12 16:53 . 2010-10-05 17:24 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-06 11:35 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2010-10-06 16:32 . 2010-10-06 16:32 6274424 ----a-w- c:\program files\Silverlight.exe
2011-08-12 06:10 . 2011-08-28 15:40 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-28_16.51.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-28 20:16 . 2011-08-28 20:16 16384 c:\windows\temp\Perflib_Perfdata_668.dat
+ 2011-08-28 18:57 . 2011-08-28 18:57 96768 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\5e66ba90ab2f24317ca76582f3ea3948\UIAutomationProvider.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 55808 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\6e07ebce857cb52cc1fb4212a4e8c7e9\System.Xaml.Hosting.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 35328 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Pres#\c42639bd8c7c7855c4d11be1f0ccdf97\System.Windows.Presentation.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 24064 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing\d2832ffc723096be07573dfbc3ba843a\System.Web.Routing.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 46592 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\cb126eadba572a941555f54558e8b415\System.Web.DynamicData.Design.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 71680 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Applicat#\3be20b4f9e9df41aaea426041f4f410a\System.Web.ApplicationServices.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 24576 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Abstract#\8f98fa01c446e44a05f10cb6d7b7bb69\System.Web.Abstractions.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 12288 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\6a4b5cf5fff1b8d26cc43ef9fa2e9e2a\System.ServiceModel.ServiceMoniker40.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 82432 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\3bea7a34d24b4dc1e3925b0b9bc9d45b\System.ServiceModel.Channels.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 78848 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn.Contra#\882adb9ad5e9b434ef926193f595e757\System.AddIn.Contract.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 37888 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Workflow.#\b038a87694a6694f6bf916175ce15543\Microsoft.Workflow.Compiler.ni.exe
+ 2011-08-28 18:57 . 2011-08-28 18:57 11776 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualC\7ee890ba3e1869ab04930948df453d3f\Microsoft.VisualC.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 44544 c:\windows\assembly\NativeImages_v4.0.30319_32\Accessibility\950b5b880e8d8af1709f06b6a1a854a0\Accessibility.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 9216 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Serializ#\1a890e72269abe36365d861bca8fca70\System.Xml.Serialization.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 9728 c:\windows\assembly\NativeImages_v4.0.30319_32\dfsvc\e335cdfdb3e46fb0f75cb2ce83dabf48\dfsvc.ni.exe
+ 2011-08-28 19:00 . 2011-08-28 19:00 404992 c:\windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\fa698179758ac22ebdc9bcab2d0c9cf5\XamlBuildTask.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 356864 c:\windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\5bfa725651b1f83754f36c45ad54b99a\WsatConfig.ni.exe
+ 2011-08-28 19:00 . 2011-08-28 19:00 253952 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\1b8d986036465b9f0db4fbaf8876ad72\WindowsFormsIntegration.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 196096 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\7b9037ad1952bc81a382b2fcddd8320a\UIAutomationTypes.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 484352 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\08b935a4ef1b64faec4e9739db313298\UIAutomationClient.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 393216 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\0f5813c19bc6dc46e87c6beafb97d525\System.Xml.Linq.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 189440 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Inpu#\8681ad3f75515a261e7980d01ac5fa2e\System.Windows.Input.Manipulations.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 194560 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\a909682da215edd65837fef1ce93207c\System.Windows.Forms.DataVisualization.Design.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 224256 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.RegularE#\af4b18836c5b4e2678e08924f213f072\System.Web.RegularExpressions.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 865280 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\e72e810da832fcda1b2fa0e6706dbc7a\System.Web.Extensions.Design.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 335360 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\d9a842b9fe2cbec6ebbb7efd150b42f4\System.Web.Entity.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 297984 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity.D#\f1d846efc64b27d04c9006ee8cd48368\System.Web.Entity.Design.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 712192 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\8a1a44b50682f535e2d32c5bfdc37acf\System.Web.DynamicData.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 260608 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\c4cc1feb4dbd8d0e72a81608d657977b\System.Web.DataVisualization.Design.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 649728 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\5314989a2066877016eaac44f927092c\System.Transactions.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 221696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\b784695a620842be9b660769dd43c898\System.ServiceProcess.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 369664 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\8671670b07fb8597048ef4aae0a5ede4\System.ServiceModel.Routing.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 432640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\1a1cecc2d6bf1e2bc43553dbfac5ff57\System.ServiceModel.Activation.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 311296 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\e8452df7471e5ba24ca642b4c4e1ef37\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 771584 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\9c75c9bbe13787e1c8e6aad0f4a8e1aa\System.Runtime.Remoting.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 244736 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Cach#\1113d00ba5944ffe741f6ff82a38e545\System.Runtime.Caching.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 657408 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Net\0db265c571d2baf9c46511b9955fa7c4\System.Net.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 626176 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\5539ada158b0520c68ab8cbaa6dab8b2\System.Messaging.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 395264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management.I#\89a46fc2fa698580fd2fa81df5cd020a\System.Management.Instrumentation.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 413696 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\e022b746f10ca855a632ff405f7f1259\System.IO.Log.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 229888 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityMode#\a6518b3baf1d987d831c5fc1b295306d\System.IdentityModel.Selectors.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 236032 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\3c81550255199caad42b6927e52cbe20\System.EnterpriseServices.Wrapper.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 787456 c:\windows\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\3c81550255199caad42b6927e52cbe20\System.EnterpriseServices.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 913920 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\8227f92f9e71e619b541050995617717\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 470528 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\6ec8651192262a0732c9c187486e9fb9\System.DirectoryServices.Protocols.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 112640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Device\1652ce31226964496c1d5b5b4f69277e\System.Device.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 508928 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\adc8db2ff2762000a5a36614c7277dda\System.Data.Services.Design.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 134656 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.DataSet#\5b1934fc32b50e5a42a64999d0b27112\System.Data.DataSetExtensions.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 148480 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\7a2a83b1625f100331691f44b6e9c3ab\System.Configuration.Install.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\a3084fbf0204cd93a9d1e8722774f0b7\System.ComponentModel.DataAnnotations.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 617984 c:\windows\assembly\NativeImages_v4.0.30319_32\System.AddIn\6254a35e295c52224f7bdc9e5ac9c81f\System.AddIn.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 411136 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.D#\2b905c99ccccb248a7653fabe4b55b09\System.Activities.DurableInstancing.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 317952 c:\windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\51bdfe23e8b22bbed5fabfed9371b5b0\SMSvcHost.ni.exe
+ 2011-08-28 18:57 . 2011-08-28 18:57 143360 c:\windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\ef32e2d63c908a8e4b21b30b2debcd03\SMDiagnostics.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 274432 c:\windows\assembly\NativeImages_v4.0.30319_32\MSBuild\64a9268d55968de5de016a1756208168\MSBuild.ni.exe
+ 2011-08-28 18:57 . 2011-08-28 18:57 303104 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\43eb12b6198092efc2b8a030ace2e3f2\Microsoft.VisualBasic.Compatibility.Data.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 418816 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\da0ae911ee95f4e67660e8e584ca8e7b\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 631808 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Uti#\03c96a7a85a19f01e803addb1895389b\Microsoft.Build.Utilities.v4.0.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 258048 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Fra#\48580b920520db0686fc349cd2d8ac50\Microsoft.Build.Framework.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 136192 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Con#\67d7b0e3c3241993e65944d6862fe3a3\Microsoft.Build.Conversion.v4.0.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 194048 c:\windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\8bd0bb7822eb2d50cb4c1a82a7f934e8\CustomMarshalers.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 475136 c:\windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\cebed376fcb55dc1cc4f6f647276f6d3\ComSvcConfig.ni.exe
+ 2011-08-28 18:56 . 2011-08-28 18:56 851968 c:\windows\assembly\NativeImages_v4.0.30319_32\AspNetMMCExt\ff3e8b1d3a969cea25a599790a2310fb\AspNetMMCExt.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 1063424 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClients#\e6474cae2445440fccb0e62e689e6c22\UIAutomationClientsideProviders.ni.dll
+ 2011-08-28 18:56 . 2011-08-28 18:56 1782272 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\cadbfd56dbffb78f67b92027bd56862e\System.Xaml.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 1223168 c:\windows\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\627971f71c1fe16a4035a016bc2814b7\System.WorkflowServices.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 1971712 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Run#\bf7556262165454ab418d88c737060f2\System.Workflow.Runtime.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 4462080 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Com#\82497353d1df546d9ea9b79598962200\System.Workflow.ComponentModel.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 2871808 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Act#\7316229449c0978b04aaab850a6ddaaf\System.Workflow.Activities.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 4545024 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\a216205660fa7dabec6af4a7c52956ee\System.Windows.Forms.DataVisualization.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1925632 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\92e03c0c449ccacc9d819207642047b3\System.Web.Services.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 2334208 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile\3c0286a66b8fadb9ed61bd997436a365\System.Web.Mobile.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 3126784 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\c70f09a8c98d77f187ea4411e24b8dc3\System.Web.Extensions.ni.dll
+ 2011-08-28 19:00 . 2011-08-28 19:00 4535808 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\83431493e6898edad6831cfc376ec47e\System.Web.DataVisualization.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 2012160 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Speech\86d3010efe01e554be5b8cd680fcfe2a\System.Speech.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1140736 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\f37365c0acb4b409a486f3aa4512a03e\System.ServiceModel.Discovery.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1392640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\a53b7bb4838c656363b29f79f708a0f0\System.ServiceModel.Activities.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1086464 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\a06883d82187f371b521c76e181dcca5\System.ServiceModel.Web.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 2647040 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\33b886ae33f78b046f90bda3dde2688e\System.Runtime.Serialization.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1021952 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\5c659e2195f712d6638b8536da384cda\System.Runtime.DurableInstancing.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1060864 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Printing\0751e44f42a603bfe153a4bbd124f62f\System.Printing.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1218560 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management\307dea1fa71faaa1c2dc0175487d9639\System.Management.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1072640 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\e1acefba94c07ca77d751b68bc3e33d3\System.IdentityModel.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1172992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\be3d47a08a8e4118e75e31a402259409\System.DirectoryServices.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1879040 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Deployment\864c2fd53f879fcd5f9b335cf49a66b4\System.Deployment.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 2026496 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services\bfc5fae2685212517b56c0cd6ea47351\System.Data.Services.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1343488 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\04f451f2d493483696f852bdce8c36e0\System.Data.Services.Client.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1189376 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.OracleC#\4946e8bb272baa775fb26ff95c369f81\System.Data.OracleClient.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 1424384 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity.#\2cb4da9cdf7931daff91c12aeef28695\System.Data.Entity.Design.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 4129792 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities\c527fa8c447a9edfeb14eeaf4af0a742\System.Activities.ni.dll
+ 2011-08-28 18:58 . 2011-08-28 18:58 3757568 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.P#\5be7a4e9c92dff127c74c0d744b3f523\System.Activities.Presentation.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1547264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Activities.C#\1871f74f0a94ec1d26071dcc872d4189\System.Activities.Core.Presentation.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 2907136 c:\windows\assembly\NativeImages_v4.0.30319_32\ReachFramework\5d8782e167084ab1fced20b86cfb26e2\ReachFramework.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1640448 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationUI\de59faecd59acbc6caabecbd8efbbb50\PresentationUI.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1479168 c:\windows\assembly\NativeImages_v4.0.30319_32\PresentationBuildTa#\b965692300303e929e606607058750a2\PresentationBuildTasks.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1838080 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\ce05202cabbee87cda0b3df2e56a6b20\Microsoft.VisualBasic.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1139200 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\b0f72cb10afe8f554c7525a9eaa03419\Microsoft.VisualBasic.Compatibility.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1172480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\899c60052ad7e741dc444017cc907ca8\Microsoft.VisualBasic.Activities.Compiler.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1085952 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Transacti#\4376863f8deba766befd5d8e41316a91\Microsoft.Transactions.Bridge.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 2452480 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.JScript\2ceaa7403e2bdea36367a0a67d972f03\Microsoft.JScript.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 4247552 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build\d8824d6c40ba5bbd062a261151ed841d\Microsoft.Build.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 2877440 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Tas#\e4077b048089c2f0d59be7672489f58f\Microsoft.Build.Tasks.v4.0.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 1931264 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Build.Eng#\158cf4e5beb20a939d626f37655f0e1a\Microsoft.Build.Engine.ni.dll
+ 2011-08-28 18:57 . 2011-08-28 18:57 12067840 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web\26e3e55c9a32842d97d2a52e9b3e6161\System.Web.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 18058752 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\56df5c322f32e926eb46047f65d0a357\System.ServiceModel.ni.dll
+ 2011-08-28 18:59 . 2011-08-28 18:59 13346816 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\093195c829c13c7ad35cb3ad43b52b6a\System.Data.Entity.ni.dll
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"PAC7311_Monitor"="c:\windows\PixArt\PAC7311\Monitor.exe" [2006-11-03 319488]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 718688]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-09 20055144]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 92168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Kamila\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G\COMMON\TWCU.exe [2010-10-5 1298432]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"e:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"e:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"e:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\Program Files\\Rockstar Games\\EFLC\\EFLC.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"e:\\Documents and Settings\\MW2 Multiplayer\\Call Of Duty Modern Warfare 2 MULTIPLAYER-AlterIWnet\\Cod4-MW2 AlterIW.net\\iw4mp.dat"=
"e:\\Documents and Settings\\MW2 Multiplayer\\Call Of Duty Modern Warfare 2 MULTIPLAYER-AlterIWnet\\Cod4-MW2 AlterIW.net\\iw4mp.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2011\\pes2011.exe"=
"e:\\Program Files\\Atari\\TDU2\\TestDrive2.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"e:\\Program Files\\Atari\\TDU2\\UpLauncher.exe"=
"e:\\Program Files\\Atari\\TDU2\\_UpLauncher.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"e:\\Program Files\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\ACBSP.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\ACBMP.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\AssassinsCreedBrotherhood.exe"=
"e:\\Program Files\\Assassin's Creed Brotherhood\\UPlayBrowser.exe"=
"e:\\Program Files\\Steam\\Steam.exe"=
"e:\\Program Files\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"e:\\Program Files\\Battlefield Bad Company 2\\BFBC2Game.exe"=
"e:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Program Files\\Microsoft Games\\Age of Empires Online\\Spartan.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5.10.2010 18:57 691696]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11.7.2011 18:00 2255464]
R2 TunngleService;TunngleService;e:\program files\Tunngle\TnglCtrl.exe [31.10.2010 14:11 716024]
R3 PAC7311;Trust Webcam Live;c:\windows\system32\drivers\PA707UCM.SYS [14.3.2007 11:57 449024]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [27.8.2011 15:06 1691480]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [25.3.2010 11:25 30969208]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 22:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2.3.2006 14:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\Daniel\Data aplikací\Mozilla\Firefox\Profiles\94hxaoo8.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-28 22:16
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-484763869-1343024091-839522115-1006\Software\SecuROM\License information*]
"datasecu"=hex:3d,eb,27,6a,06,5b,14,6a,54,1f,f1,77,fe,f4,7b,f0,cd,86,9c,b2,3e,
9e,f8,1d,bb,2d,eb,df,b2,23,75,c3,2c,dd,73,74,de,7b,9b,a9,df,4b,b0,9c,b1,5b,\
"rkeysecu"=hex:ec,a5,9a,8b,b8,e1,49,95,94,a1,4c,02,31,64,7a,59
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(496)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1029\GrooveIntlResource.dll
e:\program files\iTunes\iTunesMiniPlayer.dll
e:\program files\iTunes\iTunesMiniPlayer.Resources\de.lproj\iTunesMiniPlayerLocalized.dll
e:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\TP-LINK\TL-WN321G\COMMON\RegistryWriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Brother\Brmfcmon\BrMfcmon.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Celkový čas: 2011-08-28 22:21:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-28 20:21
ComboFix2.txt 2011-08-28 16:53
.
Před spuštěním: Volných bajtů: 14 900 539 392
Po spuštění: Volných bajtů: 14 779 387 904
.
- - End Of File - - 3ADA6FACC848FC011F12544E6B2A3F28

[vyosek]

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

• Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
  • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
  • prepnete se do zalozky Nastroje
  • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
  • Toto provedte se vsemi disky
• Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
  • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
  • Kliknete na Analyzovat
  • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
  • Postup provedte se vsemi disky
• Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
  • Vyhodou programku je, ze se neinstaluje
  • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
  • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
  • Probehne analyza disku a nasledne i defragmentace

CCleaner a Deffragler na cisteni PC staci

Napiste co PC

[danielrk]

T-Cleaner pise nasledujici: v pc byla nalezena slozka C:/windows/erdnt tato slozka je soucasti programu ERUNT slouziciho k zalohovani registru. do pc se vsak integruje s pouzitim combofixu a sdfixu
mam to smazat nebo ponechat?

[vyosek]

muzete smazat

[danielrk]

PC vypada lip , ale problem s google chrome pretrvava pise:
"Váš profil nelze správně otevřít. Některé funkce nemusí být správně dostupné. Zkontrolujte, zda profil existuje a zda máte oprávnění ke čtení a zápisu jeho obsahu."

[vyosek]

Reinstal G Chrome jste zkousel

[danielrk]

ano, pri prvnim spusteni vyskocila stejna chyba, po zavreni a opetovnem otevreni chyba zmizela, problem asi vyresen, dekuji vam za pomoc

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy


A na rozloucenou Vam zahraje nase kapela