prosim o pomoc

Zpráva

makysekp · #1 Příspěvek od **makysekp** » 26 Říj 2011 17:49

Dobrý den, moc prosím o pomoc, už jsem fakt na pokraji šílenství.
Po instalaci modemu od UPC a přechodu z free wifi (praha5.net) na kabel jsem poprve zaregistrovala několik infekcí trojského koně a nějaké červy. Co šlo, vyřešila jsem AVG. Poté začaly "blbnout" i externí disky, vytvořili se zástupci od všech složek, které nejdou otevřít jinak než přes TC. O data na discích nesmím přijít

(.
Při pokusu o otevření nějaké složky se objevuje hláška: Systém Windows nemůže najít položku ???recycler.exe. Ujistěte se, zda je název zadán správně, a akci opakujte. Je možné, že jsem si přes disky přenesla infekci i na notebook, kde mam windows vista home.

Připojuji log ze stolního PC, kde je momentalne pripojeny jeden externi disk. Prosiiiim, pomooooooc.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Marketa at 2011-10-26 18:41:07
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (7%) free of 36 GB
Total RAM: 1535 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:41:32, on 26.10.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\TrojanHunter 5.3\TrojanHunter.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\downloads\RSIT.exe
C:\Program Files\trend micro\Marketa.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2475029
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = devetsil.vse.cz:5555
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
O2 - BHO: CentrumczToolbar BHO - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Lišta Centrum.cz Toolbar - {D5D47440-0750-463D-BAEF-A47D02414806} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O3 - Toolbar: (no name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
O3 - Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MFARestart] "C:\Documents and Settings\All Users\Data aplikací\MFAData\pack\avgrunasx.exe" /usereg
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Marketa\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) -
O18 - Protocol: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - C:\Program Files\CentrumczToolbar\IEToolbar.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Print Spooler Monitor (PrtSmanm) - Unknown owner - C:\WINDOWS\system32\smsc.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe

--
End of file - 11160 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT24750 ... hSource=13"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, jqs@sun.com:1.0, Cetrumcz@igeared:1.203.023.002, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, engine@conduit.com:3.3.3.2, {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.8"
prefs.js - "keyword.URL" - "http://search.centrum.cz/index.php?tool ... m-1.0.0&q="

"Cetrumcz@igeared"=C:\Program Files\CentrumczToolbar\Firefox\Cetrumcz@igeared
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=C:\Program Files\AVG\AVG2012\Firefox4\

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=D:\petr\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3]
"Description"=Office Live Update v1.3
"Path"=C:\Program Files\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
stahuj@centrum.cz
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npdivx32.dll
npdivx32.xpt
npnul32.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
avg_igeared.xml
Cetrumcz_igeared.xml
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default\extensions\
avg@toolbar
ChoiceGuard@Microsoft
engine@conduit.com
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}

C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A}]
CentrumczToolbar BHO - C:\Program Files\CentrumczToolbar\IEToolbar.dll [2010-03-26 1286448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-09-27 2179936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-22 1451336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-15 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-07-17 691656]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
{D5D47440-0750-463D-BAEF-A47D02414806} - Lišta Centrum.cz Toolbar - C:\Program Files\CentrumczToolbar\IEToolbar.dll [2010-03-26 1286448]
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-22 1451336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe []
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"MFARestart"=C:\Documents and Settings\All Users\Data aplikací\MFAData\pack\avgrunasx.exe /usereg []
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2011-09-23 2404704]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2011-10-22 218440]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2004-08-17 159232]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"=C:\WINDOWS\system32\advpack.dll [2004-08-17 100352]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]
"Google Update"=C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-05-25 133104]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-07-04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"D:\petr\QIP Infium JadrisPack\infium.exe"="D:\petr\QIP Infium JadrisPack\infium.exe:*:Enabled:infium"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Documents and Settings\Marketa\Plocha\torrent\uTorrent\utorrent.exe"="C:\Documents and Settings\Marketa\Plocha\torrent\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Documents and Settings\Marketa\Plocha\BC\Nová složka (2)\Miranda IM\miranda32.exe"="C:\Documents and Settings\Marketa\Plocha\BC\Nová složka (2)\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe"="C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP"
"C:\Documents and Settings\Marketa\Data aplikací\2E.tmp"="C:\Documents and Settings\Marketa\Data aplikací\2E.tmp:*:C:\WINDOWS\aadrive32.exe"
"C:\WINDOWS\system32\smsc.exe"="C:\WINDOWS\system32\smsc.exe:*:Enabled:Microsoft Enabled"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.tscc"=tsccvid.dll

======List of files/folders created in the last 1 month======

2011-10-26 18:41:09 ----D---- C:\Program Files\trend micro
2011-10-26 18:41:07 ----D---- C:\rsit
2011-10-26 18:10:55 ----D---- C:\WINDOWS\pss
2011-10-26 17:33:31 ----R---- C:\WINDOWS\system32\streamhlp.dll
2011-10-26 17:33:30 ----D---- C:\Program Files\TrojanHunter 5.3
2011-10-26 17:18:42 ----A---- C:\autorun-remover.bat
2011-10-22 18:24:14 ----D---- C:\Documents and Settings\Marketa\Data aplikací\AVG2012
2011-10-22 18:22:55 ----D---- C:\Documents and Settings\Marketa\Data aplikací\AVG Secure Search
2011-10-22 18:22:49 ----D---- C:\Program Files\Common Files\AVG Secure Search
2011-10-22 18:22:45 ----D---- C:\Program Files\AVG Secure Search
2011-10-22 18:20:49 ----D---- C:\WINDOWS\system32\drivers\AVG
2011-10-22 18:20:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2012
2011-10-22 18:19:57 ----D---- C:\Program Files\AVG
2011-10-22 17:57:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Windows Genuine Advantage
2011-10-22 17:56:47 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvunace26.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\unacev2.dll
2011-10-22 17:41:34 ----D---- C:\Program Files\Trojan Remover
2011-10-22 17:41:34 ----D---- C:\Documents and Settings\Marketa\Data aplikací\Simply Super Software
2011-10-22 17:41:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Simply Super Software
2011-10-22 17:33:09 ----A---- C:\Documents and Settings\Marketa\Data aplikací\17.tmp
2011-10-22 17:33:07 ----A---- C:\Documents and Settings\Marketa\Data aplikací\14.tmp
2011-10-22 17:33:04 ----A---- C:\Documents and Settings\Marketa\Data aplikací\8.tmp
2011-10-22 16:42:04 ----A---- C:\Documents and Settings\Marketa\Data aplikací\8C5.tmp
2011-10-22 16:42:02 ----A---- C:\Documents and Settings\Marketa\Data aplikací\8C4.tmp
2011-10-22 16:41:59 ----A---- C:\Documents and Settings\Marketa\Data aplikací\8C3.tmp
2011-10-22 16:00:07 ----A---- C:\WINDOWS\ntbtlog.txt
2011-10-22 14:45:24 ----A---- C:\Documents and Settings\Marketa\Data aplikací\19.tmp
2011-10-22 14:45:21 ----A---- C:\Documents and Settings\Marketa\Data aplikací\18.tmp
2011-10-22 14:42:09 ----A---- C:\avenger.txt
2011-10-22 14:38:34 ----A---- C:\Documents and Settings\Marketa\Data aplikací\16.tmp
2011-10-22 14:38:31 ----A---- C:\Documents and Settings\Marketa\Data aplikací\15.tmp
2011-10-22 11:21:10 ----A---- C:\Documents and Settings\Marketa\Data aplikací\13.tmp
2011-10-22 11:21:08 ----A---- C:\Documents and Settings\Marketa\Data aplikací\F.tmp
2011-10-22 11:14:40 ----A---- C:\Documents and Settings\Marketa\Data aplikací\E.tmp
2011-10-22 11:14:34 ----A---- C:\Documents and Settings\Marketa\Data aplikací\B.tmp
2011-10-22 09:41:47 ----A---- C:\Documents and Settings\Marketa\Data aplikací\D.tmp
2011-10-22 09:41:44 ----A---- C:\Documents and Settings\Marketa\Data aplikací\C.tmp
2011-10-22 09:32:13 ----A---- C:\Documents and Settings\Marketa\Data aplikací\A.tmp
2011-10-22 09:32:11 ----A---- C:\Documents and Settings\Marketa\Data aplikací\9.tmp
2011-10-21 18:28:37 ----A---- C:\Documents and Settings\Marketa\Data aplikací\12.tmp
2011-10-21 18:28:34 ----A---- C:\Documents and Settings\Marketa\Data aplikací\11.tmp
2011-10-21 18:28:29 ----A---- C:\Documents and Settings\Marketa\Data aplikací\10.tmp
2011-10-21 18:24:03 ----A---- C:\Documents and Settings\Marketa\Data aplikací\7.tmp
2011-10-21 18:23:56 ----A---- C:\Documents and Settings\Marketa\Data aplikací\6.tmp
2011-10-21 18:23:51 ----A---- C:\Documents and Settings\Marketa\Data aplikací\5.tmp
2011-10-21 17:29:18 ----A---- C:\Documents and Settings\Marketa\Data aplikací\2E.tmp
2011-10-21 17:29:11 ----A---- C:\Documents and Settings\Marketa\Data aplikací\2D.tmp
2011-10-21 17:29:08 ----A---- C:\Documents and Settings\Marketa\Data aplikací\2C.tmp
2011-10-16 15:52:39 ----D---- C:\Program Files\ESET
2011-10-16 15:28:51 ----A---- C:\WINDOWS\system32\ConduitEngine.tmp
2011-10-16 15:28:15 ----D---- C:\Documents and Settings\Marketa\Data aplikací\PriceGong
2011-10-11 15:01:48 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys
2011-10-11 14:58:01 ----D---- C:\Program Files\HP Photo Creations
2011-10-11 14:58:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\HP Photo Creations
2011-10-11 14:57:57 ----D---- C:\Documents and Settings\Marketa\Data aplikací\HpUpdate
2011-10-11 14:57:51 ----A---- C:\WINDOWS\system32\HPScanMiniDrv_DJ2050_510g.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinksts8711LM.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinksts8711.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinkcoi8711.dll
2011-10-11 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\HP
2011-10-11 14:57:24 ----D---- C:\Program Files\HP
2011-10-11 14:53:56 ----D---- C:\WINDOWS\system32\NtmsData
2011-09-28 16:17:54 ----D---- C:\Documents and Settings\Marketa\Data aplikací\Imagic402

======List of files/folders modified in the last 1 month======

2011-10-26 18:41:12 ----D---- C:\WINDOWS\Prefetch
2011-10-26 18:41:09 ----D---- C:\Program Files
2011-10-26 18:28:12 ----SHD---- C:\RECYCLER
2011-10-26 18:11:50 ----SH---- C:\boot.ini
2011-10-26 18:11:50 ----A---- C:\WINDOWS\win.ini
2011-10-26 18:11:50 ----A---- C:\WINDOWS\system.ini
2011-10-26 18:10:55 ----D---- C:\WINDOWS
2011-10-26 18:08:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-10-26 18:08:50 ----D---- C:\WINDOWS\system32
2011-10-26 17:34:31 ----A---- C:\WINDOWS\NeroDigital.ini
2011-10-26 17:20:42 ----A---- C:\WINDOWS\wincmd.ini
2011-10-26 17:16:16 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-10-26 16:39:10 ----D---- C:\WINDOWS\Temp
2011-10-26 10:06:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2011-10-26 10:00:46 ----D---- C:\WINDOWS\system32\CatRoot2
2011-10-25 23:39:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-10-25 10:17:37 ----SHD---- C:\WINDOWS\Installer
2011-10-22 18:42:29 ----D---- C:\Program Files\GRETECH
2011-10-22 18:22:49 ----D---- C:\Program Files\Common Files
2011-10-22 18:22:15 ----HD---- C:\WINDOWS\inf
2011-10-22 18:22:15 ----D---- C:\WINDOWS\system32\drivers
2011-10-22 18:18:06 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-10-22 18:18:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Symantec
2011-10-22 18:16:41 ----D---- C:\Program Files\Common Files\Teleca Shared
2011-10-22 18:16:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Teleca
2011-10-22 18:11:23 ----D---- C:\Program Files\Mozilla Firefox
2011-10-22 18:07:26 ----D---- C:\Program Files\OpenOffice.org 2.4
2011-10-22 18:04:29 ----D---- C:\Program Files\Fotostar
2011-10-22 15:19:29 ----HD---- C:\Program Files\InstallShield Installation Information
2011-10-12 09:48:33 ----D---- C:\Documents and Settings\Marketa\Data aplikací\OpenOffice.org2
2011-10-11 14:57:51 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-10-11 14:57:50 ----D---- C:\WINDOWS\system32\CatRoot
2011-10-11 14:53:51 ----A---- C:\WINDOWS\Hposcv07.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2005-08-18 93568]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-07-23 717296]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-07-11 229840]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-07-04 3230720]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-07-11 16720]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-06 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-06 12928]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-02-15 47360]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 a3o5uc8w;a3o5uc8w; C:\WINDOWS\system32\drivers\a3o5uc8w.sys []
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys []
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys []
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys []
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys []
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-07-04 561152]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-09-12 5265248]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R2 vToolbarUpdater;vToolbarUpdater; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-22 246600]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-07-03 593920]
S2 PrtSmanm;Print Spooler Monitor; C:\WINDOWS\system32\smsc.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2011-08-13 69120]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 26 Říj 2011 18:00

Zdravim a pekny vecer preji

Doporucuji odinstalovat (pokud nepouzivate) toolbary (listy prohlizecu) v Přidat nebo odebrat programy

Doporucuji odinstalovat Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam - po ukonceni leceni tam dame lepsi nahradu

Trvate na antiviru AVG - u nas neni moc obliben - vysoka zatez systemu, slabsi detekce. Spise bych se priklanel k jeho vymene za Avast, Aviru ci MSE

Ty visty budou tez zrejme infikovane, poresime posleze

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

makysekp · #3 Příspěvek od **makysekp** » 26 Říj 2011 18:16

dobrý večer, děkuji vám za ochotu!
Tak toolbary by měly být pryč, stejně tak jako search&destroy.
AVG ráda odinstaluji, ale jelikož jsem ho stěží nainstalovala (ty viry mi dokonce i zavíraly stránky s odkazy např. i na online scanner), zatím ponechám.

Mam jen 2 usb porty, disku celkem 4, takze za momentik poslu log.

#4 Příspěvek od **vyosek** » 26 Říj 2011 18:18

Fajn, takze avg vymenime az na zaver

Zapojte dva disky, pustte USBFix a dejte log, pak zapojte dalsi dva a udeljte to same s USBFixem - log opet sem

makysekp · #5 Příspěvek od **makysekp** » 26 Říj 2011 18:28

tak první log dvou usb:

############################## | UsbFix 7.059 | [Deletion]

User: Marketa (Administrator) # MARKETA [ ]
Updated 16/09/2011 by El Desaparecido
Started at 19:21:00 | 26/10/2011
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: AMD Athlon(tm) 64 Processor 3000+
Systém Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 2
Internet Explorer 6.0.2900.2180

Windows Firewall: Enabled
Antivirus: AVG Anti-Virus Free Edition 2012 2012.0 [Enabled | Updated]
Firewall: AVG Firewall 10.0 [(!) Disabled]
RAM -> 1535 Mb
C:\ (%systemdrive%) -> Fixed drive # 35 Gb (2 Mb free - 7%) [] # NTFS
D:\ -> Fixed drive # 77 Gb (5 Mb free - 6%) [Storage] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> CD-ROM
H:\ -> Fixed drive # 75 Gb (62 Mb free - 83%) [Disk I.] # NTFS
I:\ -> Fixed drive # 298 Gb (30 Mb free - 10%) [Elements] # NTFS

################## | Files # Infected Folders |

Deleted ! C:\Documents and Settings\Marketa\Data aplikací\10.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\11.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\12.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\13.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\14.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\15.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\16.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\17.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\18.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\19.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\2C.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\2D.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\2E.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\5.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\6.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\7.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\8.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\8C3.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\8C4.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\8C5.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\9.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\A.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\B.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\C.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\D.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\E.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\F.tmp
Deleted ! C:\Documents and Settings\Marketa\Data aplikací\inst.exe
Deleted ! H:\System Volume Information.lnk
Deleted ! I:\Civilization 4 IV + ALL expansions [PC GAMES.lnk
Deleted ! I:\filmy.lnk
Deleted ! I:\fotky.lnk
Deleted ! I:\Microsoft Office 2007.lnk
Deleted ! I:\New Folder.lnk
Deleted ! I:\Nokia 6310i (Cable).lnk
Deleted ! I:\Petka.lnk
Deleted ! I:\System Volume Information.lnk
Deleted ! C:\WINDOWS\system32\msupdte.exe.vir
Deleted ! C:\WINDOWS\aadrive32.exe.vir
Deleted ! C:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! D:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! H:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! I:\$RECYCLE.BIN\S-1-5-21-2589338151-3814798718-1848005141-1000
Deleted ! I:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! I:\Recycler\S-1-5-21-2880976179-1131418188-2989438487-1005
Deleted ! I:\Recycler\S-1-5-21-3894602836-3277439761-1653462319-1005

(!) Temporary files deleted.

################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Adobe Reader Speed Launcher
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|MSConfig

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{e72d5a34-58e3-11dd-851e-806d6172696f}

################## | Listing |

[20/03/2011 - 12:25:19 | D ] C:\AHCache
[26/10/2011 - 17:08:56 | N | 101] C:\autorun-remover.bat
[22/10/2011 - 14:42:31 | N | 237346] C:\avenger.txt
[26/10/2011 - 18:11:50 | N | 211] C:\boot.ini
[25/10/2001 - 16:00:00 | N | 4952] C:\Bootfont.bin
[19/08/2008 - 18:55:35 | N | 1138] C:\ca.der
[22/07/2008 - 00:00:00 | N | 0] C:\CONFIG.SYS
[24/07/2008 - 00:00:00 | D ] C:\Documents and Settings
[11/07/2011 - 17:02:23 | D ] C:\Fotoalbum
[20/07/2008 - 00:00:00 | N | 0] C:\IO.SYS
[19/07/2008 - 00:00:00 | N | 0] C:\MSDOS.SYS
[15/11/2010 - 12:29:34 | RHD ] C:\MSOCache
[03/08/2004 - 22:38:34 | N | 47564] C:\NTDETECT.COM
[17/07/2008 - 00:00:00 | N | 250048] C:\ntldr
[26/10/2011 - 10:00:12 | ASH | 805306368] C:\pagefile.sys
[23/02/2009 - 11:09:15 | D ] C:\PollManager
[26/10/2011 - 19:09:57 | D ] C:\Program Files
[26/10/2011 - 19:25:12 | SHD ] C:\RECYCLER
[26/10/2011 - 18:41:40 | D ] C:\rsit
[19/03/2009 - 21:34:52 | SHD ] C:\System Volume Information
[25/10/2008 - 19:02:36 | D ] C:\Temp
[29/11/2009 - 22:07:10 | D ] C:\totalcmd
[26/10/2011 - 19:25:12 | D ] C:\UsbFix
[26/10/2011 - 19:26:59 | A | 3968] C:\UsbFix.txt
[26/10/2011 - 19:21:25 | D ] C:\WINDOWS
[22/10/2011 - 19:19:03 | D ] D:\$AVG
[09/12/2010 - 13:28:23 | D ] D:\02_DoubleCAD v3 Free
[13/08/2011 - 18:50:43 | N | 84058216] D:\02_DoubleCADv3Free.exe
[05/09/2008 - 14:44:15 | D ] D:\amy winehouse
[10/08/2011 - 19:23:12 | D ] D:\archiv_fotky
[26/10/2011 - 17:08:56 | N | 101] D:\autorun-remover.bat
[26/10/2011 - 17:25:34 | D ] D:\backup
[23/06/2011 - 19:38:17 | D ] D:\Be a King
[13/08/2011 - 14:05:41 | D ] D:\cad_07
[26/10/2011 - 19:20:50 | D ] D:\downloads
[05/09/2008 - 22:42:03 | N | 75833344] D:\Fotoalbum.ppt
[19/03/2011 - 18:49:23 | D ] D:\Games
[22/02/2009 - 15:08:43 | D ] D:\InetDataMeter
[03/02/2010 - 20:58:39 | D ] D:\Movies
[06/05/2010 - 13:13:41 | D ] D:\mp3
[01/07/2011 - 18:29:45 | D ] D:\petr
[23/06/2011 - 22:11:38 | D ] D:\pokus
[28/09/2011 - 16:12:32 | D ] D:\Programy
[26/10/2011 - 19:25:12 | SHD ] D:\RECYCLER
[25/01/2010 - 11:08:54 | D ] D:\Seriály
[16/10/2011 - 14:06:15 | N | 1865] D:\settings.txt
[19/03/2009 - 21:34:52 | SHD ] D:\System Volume Information
[26/10/2011 - 17:08:56 | N | 101] H:\autorun-remover.bat
[25/10/2011 - 20:39:32 | D ] H:\dexter
[30/09/2011 - 16:11:51 | N | 737531658] H:\Kuze,-kterou-nosim---La-Piel-Que-habito[Spanish].avi
[26/10/2011 - 19:25:12 | SHD ] H:\RECYCLER
[22/12/2008 - 18:23:22 | SHD ] H:\System Volume Information
[21/10/2011 - 20:33:22 | ASH | 7168] H:\Thumbs.db
[30/09/2011 - 14:09:25 | N | 1088447780] H:\Zrození-Planety-opic-2011---titulky.avi
[26/10/2011 - 16:55:58 | SHD ] I:\$RECYCLE.BIN
[16/01/2011 - 21:12:35 | N | 1597919] I:\3.mp3
[16/01/2011 - 21:11:10 | N | 2596] I:\AlbumArtSmall.jpg
[16/01/2011 - 21:11:12 | N | 10260] I:\AlbumArt_{42D4658B-7C62-4BB5-A520-0E6044250BEE}_Large.jpg
[16/01/2011 - 21:11:10 | N | 2596] I:\AlbumArt_{42D4658B-7C62-4BB5-A520-0E6044250BEE}_Small.jpg
[26/10/2011 - 17:08:56 | N | 101] I:\autorun-remover.bat
[16/08/2010 - 13:09:16 | D ] I:\Civilization 4 IV + ALL expansions [PC GAMES
[16/01/2011 - 21:11:13 | SH | 352] I:\desktop.ini
[25/10/2011 - 20:35:14 | D ] I:\dexter
[08/10/2011 - 21:11:42 | D ] I:\filmy
[13/12/2009 - 15:11:46 | N | 12023808] I:\FIT4FUN.ppt
[16/01/2011 - 21:11:12 | N | 10260] I:\Folder.jpg
[15/10/2011 - 19:22:42 | D ] I:\fotky
[16/08/2010 - 12:47:23 | D ] I:\hudba
[11/02/2011 - 07:29:24 | N | 4628050] I:\IMG_5689.JPG
[11/02/2011 - 07:29:34 | N | 4785048] I:\IMG_5690.JPG
[27/12/2010 - 16:31:02 | N | 5759719] I:\Linkin Park Waiting For The End.mp3
[15/11/2010 - 12:26:42 | D ] I:\Microsoft Office 2007
[12/01/2011 - 13:42:59 | D ] I:\New Folder
[21/06/2010 - 15:55:19 | D ] I:\Nokia 6310i (Cable)
[16/01/2011 - 21:12:34 | N | 3707352] I:\OFFICIAL Somewhere over the Rainbow - Israel IZ Kamakawiwo‘ole.mp3
[14/02/2011 - 15:23:25 | D ] I:\Petka
[26/10/2011 - 19:25:12 | SHD ] I:\RECYCLER
[15/08/2010 - 15:07:33 | SHD ] I:\System Volume Information
[19/03/2011 - 23:10:32 | ASH | 29696] I:\Thumbs.db
[05/05/2011 - 16:08:03 | N | 229232] I:\tl_08_09_2010.pdf
[05/05/2011 - 16:08:09 | N | 120738] I:\tl_08_2009.pdf

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
I:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_MARKETA.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |

#6 Příspěvek od **vyosek** » 26 Říj 2011 18:34

Super, nyni ten z dalsich dvou a napiste co disky

makysekp · #7 Příspěvek od **makysekp** » 26 Říj 2011 18:35

dalsi dva

############################## | UsbFix 7.059 | [Deletion]

User: Marketa (Administrator) # MARKETA [ ]
Updated 16/09/2011 by El Desaparecido
Started at 19:30:35 | 26/10/2011
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: AMD Athlon(tm) 64 Processor 3000+
Systém Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 2
Internet Explorer 6.0.2900.2180

Windows Firewall: Enabled
Antivirus: AVG Anti-Virus Free Edition 2012 2012.0 [Enabled | Updated]
Firewall: AVG Firewall 10.0 [(!) Disabled]
RAM -> 1535 Mb
C:\ (%systemdrive%) -> Fixed drive # 35 Gb (606 Mb free - 2%) [] # NTFS
D:\ -> Fixed drive # 77 Gb (5 Mb free - 6%) [Storage] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> CD-ROM
H:\ -> Fixed drive # 75 Gb (974 Mb free - 1%) [External drive] # NTFS
I:\ -> Removable drive # 7 Gb (164 Mb free - 2%) [] # FAT32

################## | Files # Infected Folders |

Deleted ! H:\$RECYCLE.BIN.lnk
Deleted ! H:\DCIM.lnk
Deleted ! H:\Finance.lnk
Deleted ! H:\foto kniha.lnk
Deleted ! H:\golf.lnk
Deleted ! H:\Makoho cviky.lnk
Deleted ! H:\Michel.lnk
Deleted ! H:\music videos.lnk
Deleted ! H:\Music.lnk
Deleted ! H:\Pictures.lnk
Deleted ! H:\Setup Files.lnk
Deleted ! H:\Stellarium.lnk
Deleted ! H:\System Volume Information.lnk
Deleted ! H:\yxy.lnk
Deleted ! H:\Word Documents.lnk
Deleted ! C:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! D:\Recycler\S-1-5-21-2000478354-1677128483-682003330-1003
Deleted ! H:\$RECYCLE.BIN\S-1-5-21-1842359031-1422165434-2830116694-1000
Deleted ! H:\$RECYCLE.BIN\S-1-5-21-898318241-3151831850-2562964490-1000
Deleted ! H:\Recycler\S-1-5-21-1163395192-2942328611-1021817841-1003
Deleted ! H:\Recycler\S-1-5-21-1292428093-1060284298-1957994488-1003
Deleted ! H:\Recycler\S-1-5-21-1454471165-507921405-839522115-500
Deleted ! H:\Recycler\S-1-5-21-2880976179-1131418188-2989438487-1005
Deleted ! H:\autorun.inf

(!) Temporary files deleted.

################## | Registry |

################## | Mountpoints2 |

################## | Listing |

[20/03/2011 - 12:25:19 | D ] C:\AHCache
[26/10/2011 - 17:08:56 | N | 101] C:\autorun-remover.bat
[26/10/2011 - 19:27:01 | RASHD ] C:\Autorun.inf
[22/10/2011 - 14:42:31 | N | 237346] C:\avenger.txt
[26/10/2011 - 18:11:50 | N | 211] C:\boot.ini
[25/10/2001 - 16:00:00 | N | 4952] C:\Bootfont.bin
[19/08/2008 - 18:55:35 | N | 1138] C:\ca.der
[22/07/2008 - 00:00:00 | N | 0] C:\CONFIG.SYS
[24/07/2008 - 00:00:00 | D ] C:\Documents and Settings
[11/07/2011 - 17:02:23 | D ] C:\Fotoalbum
[20/07/2008 - 00:00:00 | N | 0] C:\IO.SYS
[19/07/2008 - 00:00:00 | N | 0] C:\MSDOS.SYS
[15/11/2010 - 12:29:34 | RHD ] C:\MSOCache
[03/08/2004 - 22:38:34 | N | 47564] C:\NTDETECT.COM
[17/07/2008 - 00:00:00 | N | 250048] C:\ntldr
[26/10/2011 - 10:00:12 | ASH | 805306368] C:\pagefile.sys
[23/02/2009 - 11:09:15 | D ] C:\PollManager
[26/10/2011 - 19:09:57 | D ] C:\Program Files
[26/10/2011 - 19:32:49 | SHD ] C:\RECYCLER
[26/10/2011 - 18:41:40 | D ] C:\rsit
[19/03/2009 - 21:34:52 | SHD ] C:\System Volume Information
[25/10/2008 - 19:02:36 | D ] C:\Temp
[29/11/2009 - 22:07:10 | D ] C:\totalcmd
[26/10/2011 - 19:32:49 | D ] C:\UsbFix
[26/10/2011 - 19:32:49 | A | 2080] C:\UsbFix.txt
[26/10/2011 - 19:27:08 | N | 1770391] C:\UsbFix_Upload_Me_MARKETA.zip
[26/10/2011 - 19:21:25 | D ] C:\WINDOWS
[22/10/2011 - 19:19:03 | D ] D:\$AVG
[09/12/2010 - 13:28:23 | D ] D:\02_DoubleCAD v3 Free
[13/08/2011 - 18:50:43 | N | 84058216] D:\02_DoubleCADv3Free.exe
[05/09/2008 - 14:44:15 | D ] D:\amy winehouse
[10/08/2011 - 19:23:12 | D ] D:\archiv_fotky
[26/10/2011 - 17:08:56 | N | 101] D:\autorun-remover.bat
[26/10/2011 - 19:27:01 | RASHD ] D:\Autorun.inf
[26/10/2011 - 17:25:34 | D ] D:\backup
[23/06/2011 - 19:38:17 | D ] D:\Be a King
[13/08/2011 - 14:05:41 | D ] D:\cad_07
[26/10/2011 - 19:30:23 | D ] D:\downloads
[05/09/2008 - 22:42:03 | N | 75833344] D:\Fotoalbum.ppt
[19/03/2011 - 18:49:23 | D ] D:\Games
[22/02/2009 - 15:08:43 | D ] D:\InetDataMeter
[03/02/2010 - 20:58:39 | D ] D:\Movies
[06/05/2010 - 13:13:41 | D ] D:\mp3
[01/07/2011 - 18:29:45 | D ] D:\petr
[23/06/2011 - 22:11:38 | D ] D:\pokus
[28/09/2011 - 16:12:32 | D ] D:\Programy
[26/10/2011 - 19:32:49 | SHD ] D:\RECYCLER
[25/01/2010 - 11:08:54 | D ] D:\Seriály
[16/10/2011 - 14:06:15 | N | 1865] D:\settings.txt
[19/03/2009 - 21:34:52 | SHD ] D:\System Volume Information
[26/10/2011 - 19:32:46 | SHD ] H:\$RECYCLE.BIN
[22/10/2011 - 14:23:18 | D ] H:\AVG
[22/09/2011 - 22:26:41 | D ] H:\DCIM
[21/10/2011 - 19:06:25 | N | 578772992] H:\dexter-s04e09-cz_titulky-synch_arc.avi
[21/10/2011 - 19:47:33 | N | 577714176] H:\dexter-s04e10-cz_titulky-synch_arc.avi
[21/10/2011 - 20:21:26 | N | 573480960] H:\dexter-s04e11-cz_titulky-synch_arc.avi
[03/05/2010 - 20:08:27 | D ] H:\Finance
[22/09/2011 - 22:27:15 | D ] H:\foto kniha
[15/01/2008 - 13:54:14 | D ] H:\golf
[01/11/2007 - 21:35:59 | N | 262] H:\Istanbul_2007.cue
[21/09/2011 - 15:16:55 | D ] H:\Makoho cviky
[04/03/2010 - 14:27:58 | D ] H:\Michel
[03/05/2010 - 20:10:59 | D ] H:\Music
[18/05/2010 - 15:58:20 | D ] H:\music videos
[21/09/2011 - 15:12:15 | D ] H:\Pictures
[26/10/2011 - 19:32:49 | SHD ] H:\RECYCLER
[19/08/2008 - 14:22:38 | D ] H:\Setup Files
[15/01/2008 - 13:54:13 | D ] H:\Stellarium
[26/09/2007 - 21:13:58 | N | 3310134] H:\stellarium-0[1].5.1.zip
[09/04/2008 - 09:43:41 | SHD ] H:\System Volume Information
[06/02/2008 - 15:45:35 | D ] H:\yxy
[21/10/2011 - 22:07:43 | D ] H:\Word Documents
[12/12/2010 - 11:54:34 | N | 165] I:\~$Rozvrh LS 2011.xlsx
[07/10/2011 - 11:48:44 | D ] I:\New Folder
[07/10/2011 - 11:49:26 | D ] I:\DIPLOMKA
[08/10/2011 - 10:59:50 | D ] I:\Makroanalyza
[26/10/2011 - 17:52:42 | N | 103] I:\autorun-remover.bat

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
I:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_MARKETA.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |

#8 Příspěvek od **vyosek** » 26 Říj 2011 18:36

Fajn, co disky, uz jsou slozky citelne

makysekp · #9 Příspěvek od **makysekp** » 26 Říj 2011 18:40

Tak první disk ze 4: zbylo jen několik "skrytých složek"
$RECYCLE.BIN
Autorun.inf
System Volume Information
RECYCLER

Druhý disk: totez u techto slozek:
Autorun.inf
System Volume Information
RECYCLER

Treti disk:
$RECYCLE.BIN
Autorun.inf
System Volume Information
RECYCLER

Ctvrty:
Autorun.inf

makysekp · #10 Příspěvek od **makysekp** » 26 Říj 2011 18:41

totiž, takhle: disky jsou čitelné, složky ok, až na ty, co jsem psala...

#11 Příspěvek od **vyosek** » 26 Říj 2011 18:43

Uf, to jsem se lekl, ja myslel ze vam zmizly i ty s daty, o tech skrytych vim, ty jsou OK...
Autorun.inf je neskodny, byl vytvoren USBFixem aby nebylo mozne tam zapsat skodlivy autorun.inf

Poprosim o novy log z RSIT a budem mazat dale

Zatim vam to jde skvele

makysekp · #12 Příspěvek od **makysekp** » 26 Říj 2011 18:45

Logfile of random's system information tool 1.09 (written by random/random)
Run by Marketa at 2011-10-26 19:45:45
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 594 MB (2%) free of 36 GB
Total RAM: 1535 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:45:52, on 26.10.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\downloads\RSIT.exe
C:\Program Files\trend micro\Marketa.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = devetsil.vse.cz:5555
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
R3 - URLSearchHook: (no name) - {33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O3 - Toolbar: (no name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
O3 - Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll
O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MFARestart] "C:\Documents and Settings\All Users\Data aplikací\MFAData\pack\avgrunasx.exe" /usereg
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Marketa\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Print Spooler Monitor (PrtSmanm) - Unknown owner - C:\WINDOWS\system32\smsc.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe

--
End of file - 9126 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT24750 ... hSource=13"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, jqs@sun.com:1.0, Cetrumcz@igeared:1.203.023.002, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, engine@conduit.com:3.3.3.2, {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.8"
prefs.js - "keyword.URL" - "http://search.centrum.cz/index.php?tool ... m-1.0.0&q="

"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=C:\Program Files\AVG\AVG2012\Firefox4\

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Web Player
"Path"=D:\petr\DivX\DivX Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3]
"Description"=Office Live Update v1.3
"Path"=C:\Program Files\Microsoft\Office Live\npOLW.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
stahuj@centrum.cz
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npdivx32.dll
npdivx32.xpt
npnul32.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
avg_igeared.xml
Cetrumcz_igeared.xml
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default\extensions\
avg@toolbar
ChoiceGuard@Microsoft
engine@conduit.com
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}

C:\Documents and Settings\Marketa\Data aplikací\Mozilla\Firefox\Profiles\obzbs2sh.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-09-27 2179936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-22 1451336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-15 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
{D5D47440-0750-463D-BAEF-A47D02414806}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll [2011-10-22 1451336]
{32099AAC-C132-4136-9E9A-4E364A424E17}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"MFARestart"=C:\Documents and Settings\All Users\Data aplikací\MFAData\pack\avgrunasx.exe /usereg []
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2011-09-23 2404704]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2011-10-22 218440]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"=C:\WINDOWS\system32\advpack.dll [2004-08-17 100352]
""= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Marketa\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-05-25 133104]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-07-04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0
"NoDriveAutoRun"=3

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"D:\petr\QIP Infium JadrisPack\infium.exe"="D:\petr\QIP Infium JadrisPack\infium.exe:*:Enabled:infium"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Documents and Settings\Marketa\Plocha\torrent\uTorrent\utorrent.exe"="C:\Documents and Settings\Marketa\Plocha\torrent\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Documents and Settings\Marketa\Plocha\BC\Nová složka (2)\Miranda IM\miranda32.exe"="C:\Documents and Settings\Marketa\Plocha\BC\Nová složka (2)\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe"="C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\USBSetup.exe:LocalSubNet:Enabled:Instalace zařízení HP"
"C:\Documents and Settings\Marketa\Data aplikací\2E.tmp"="C:\Documents and Settings\Marketa\Data aplikací\2E.tmp:*:C:\WINDOWS\aadrive32.exe"
"C:\WINDOWS\system32\smsc.exe"="C:\WINDOWS\system32\smsc.exe:*:Enabled:Microsoft Enabled"
"C:\Program Files\AVG\AVG2012\avgmfapx.exe"="C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2012\avgnsx.exe"="C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2012\avgdiagex.exe"="C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostika 2012"
"C:\Program Files\AVG\AVG2012\avgemcx.exe"="C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Obecná kontrola pošty"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.tscc"=tsccvid.dll

======List of files/folders created in the last 1 month======

2011-10-26 19:34:34 ----RASHD---- C:\Autorun.inf
2011-10-26 19:11:41 ----A---- C:\UsbFix.txt
2011-10-26 19:11:38 ----D---- C:\UsbFix
2011-10-26 18:41:09 ----D---- C:\Program Files\trend micro
2011-10-26 18:41:07 ----D---- C:\rsit
2011-10-26 18:10:55 ----D---- C:\WINDOWS\pss
2011-10-26 17:33:31 ----R---- C:\WINDOWS\system32\streamhlp.dll
2011-10-26 17:33:30 ----D---- C:\Program Files\TrojanHunter 5.3
2011-10-26 17:18:42 ----N---- C:\autorun-remover.bat
2011-10-22 18:24:14 ----D---- C:\Documents and Settings\Marketa\Data aplikací\AVG2012
2011-10-22 18:22:55 ----D---- C:\Documents and Settings\Marketa\Data aplikací\AVG Secure Search
2011-10-22 18:22:49 ----D---- C:\Program Files\Common Files\AVG Secure Search
2011-10-22 18:22:45 ----D---- C:\Program Files\AVG Secure Search
2011-10-22 18:20:49 ----D---- C:\WINDOWS\system32\drivers\AVG
2011-10-22 18:20:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2012
2011-10-22 18:19:57 ----D---- C:\Program Files\AVG
2011-10-22 17:57:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Windows Genuine Advantage
2011-10-22 17:56:47 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvunace26.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2011-10-22 17:41:36 ----A---- C:\WINDOWS\system32\unacev2.dll
2011-10-22 17:41:34 ----D---- C:\Program Files\Trojan Remover
2011-10-22 17:41:34 ----D---- C:\Documents and Settings\Marketa\Data aplikací\Simply Super Software
2011-10-22 17:41:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Simply Super Software
2011-10-22 16:00:07 ----A---- C:\WINDOWS\ntbtlog.txt
2011-10-22 14:42:09 ----N---- C:\avenger.txt
2011-10-16 15:52:39 ----D---- C:\Program Files\ESET
2011-10-16 15:28:51 ----A---- C:\WINDOWS\system32\ConduitEngine.tmp
2011-10-16 15:28:15 ----D---- C:\Documents and Settings\Marketa\Data aplikací\PriceGong
2011-10-11 15:01:48 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys
2011-10-11 14:58:01 ----D---- C:\Program Files\HP Photo Creations
2011-10-11 14:58:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\HP Photo Creations
2011-10-11 14:57:57 ----D---- C:\Documents and Settings\Marketa\Data aplikací\HpUpdate
2011-10-11 14:57:51 ----A---- C:\WINDOWS\system32\HPScanMiniDrv_DJ2050_510g.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinksts8711LM.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinksts8711.dll
2011-10-11 14:57:48 ----A---- C:\WINDOWS\system32\hpinkcoi8711.dll
2011-10-11 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\HP
2011-10-11 14:57:24 ----D---- C:\Program Files\HP
2011-10-11 14:53:56 ----D---- C:\WINDOWS\system32\NtmsData
2011-09-28 16:17:54 ----D---- C:\Documents and Settings\Marketa\Data aplikací\Imagic402

======List of files/folders modified in the last 1 month======

2011-10-26 19:36:49 ----A---- C:\WINDOWS\NeroDigital.ini
2011-10-26 19:36:38 ----D---- C:\WINDOWS\Prefetch
2011-10-26 19:35:11 ----D---- C:\WINDOWS\Temp
2011-10-26 19:32:49 ----SHD---- C:\RECYCLER
2011-10-26 19:21:25 ----D---- C:\WINDOWS\system32
2011-10-26 19:21:25 ----D---- C:\WINDOWS
2011-10-26 19:09:57 ----D---- C:\Program Files
2011-10-26 19:09:31 ----D---- C:\Program Files\DAEMON Tools Toolbar
2011-10-26 19:07:26 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-10-26 19:07:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-10-26 18:51:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2011-10-26 18:11:50 ----N---- C:\boot.ini
2011-10-26 18:11:50 ----A---- C:\WINDOWS\win.ini
2011-10-26 18:11:50 ----A---- C:\WINDOWS\system.ini
2011-10-26 18:08:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-10-26 17:20:42 ----A---- C:\WINDOWS\wincmd.ini
2011-10-26 17:16:16 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-10-26 10:00:46 ----D---- C:\WINDOWS\system32\CatRoot2
2011-10-25 23:39:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-10-25 10:17:37 ----SHD---- C:\WINDOWS\Installer
2011-10-22 18:42:29 ----D---- C:\Program Files\GRETECH
2011-10-22 18:22:49 ----D---- C:\Program Files\Common Files
2011-10-22 18:22:15 ----HD---- C:\WINDOWS\inf
2011-10-22 18:22:15 ----D---- C:\WINDOWS\system32\drivers
2011-10-22 18:18:06 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-10-22 18:18:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Symantec
2011-10-22 18:16:41 ----D---- C:\Program Files\Common Files\Teleca Shared
2011-10-22 18:16:34 ----D---- C:\Documents and Settings\All Users\Data aplikací\Teleca
2011-10-22 18:11:23 ----D---- C:\Program Files\Mozilla Firefox
2011-10-22 18:07:26 ----D---- C:\Program Files\OpenOffice.org 2.4
2011-10-22 18:04:29 ----D---- C:\Program Files\Fotostar
2011-10-22 15:19:29 ----HD---- C:\Program Files\InstallShield Installation Information
2011-10-12 09:48:33 ----D---- C:\Documents and Settings\Marketa\Data aplikací\OpenOffice.org2
2011-10-11 14:57:51 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-10-11 14:57:50 ----D---- C:\WINDOWS\system32\CatRoot
2011-10-11 14:53:51 ----A---- C:\WINDOWS\Hposcv07.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2005-08-18 93568]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-07-23 717296]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-07-11 229840]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-07-04 3230720]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-07-11 16720]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-06 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-06 12928]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-02-15 47360]
S3 a3o5uc8w;a3o5uc8w; C:\WINDOWS\system32\drivers\a3o5uc8w.sys []
S3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys []
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys []
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys []
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys []
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-07-09 39424]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-09-12 5265248]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-07-04 561152]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-07-03 593920]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-02-02 153376]
S2 PrtSmanm;Print Spooler Monitor; C:\WINDOWS\system32\smsc.exe []
S2 vToolbarUpdater;vToolbarUpdater; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-22 246600]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2011-08-13 69120]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

makysekp · #13 Příspěvek od **makysekp** » 26 Říj 2011 18:54

jeste mam prosim dotaz, jak presne poznam, ze se jedna o toolbar? (v pridat nebo odebrat programy). Zadala jsem si do "hledat" toolbar a vysypalo se toho fakt dost...

#14 Příspěvek od **vyosek** » 26 Říj 2011 18:55

Uvolnete nejake volne misto na disku, system se nam dusi, alespon tak 5 giga by bylo vhodnych

Podle logu jsou tam jen zbytky po toolbarech, odpalim je ve skriptu

Stahnete OTM (viz muj podpis)

Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:commands
[RESETHOSTS]
[CLEARALLRESTOREPOINTS]
[EMPTYTEMP]
[EMPTYFLASH]

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
"{33CD02D0-8C93-4926-A2FE-2CE72CE7DF1A}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=-
"{D5D47440-0750-463D-BAEF-A47D02414806}"=-
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"=-
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"iTunesHelper"=-
"SunJavaUpdateSched"=-
"Adobe ARM"=-
"MFARestart"=-
"KernelFaultCheck"=-
"HP Software Update"=-
"UserFaultCheck"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"=-
""=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
"MSMSGS"=-
"SpybotSD TeaTimer"=-
"ctfmon.exe"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\Marketa\Data aplikací\2E.tmp"=-

:files
C:\Program Files\TrojanHunter 5.3
C:\autorun-remover.bat
C:\Program Files\ESET
C:\WINDOWS\system32\ConduitEngine.tmp
C:\Documents and Settings\Marketa\Data aplikací\PriceGong
C:\Program Files\DAEMON Tools Toolbar
C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
C:\Documents and Settings\Marketa\Data aplikací\*.tmp
C:\Program Files\Spybot - Search & Destroy
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1677128483-682003330-1003UA.job
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

makysekp · #15 Příspěvek od **makysekp** » 26 Říj 2011 19:08

už to čistim, zatím jen přesouvám na D, bude to chtít někdy poté detailnější čistku

VIRY.CZ

prosim o pomoc

prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc

Re: prosim o pomoc