Dobrý den, od včera mi neustále padá internet (každých 10-20minut) v síťových připojeních to sice píše že jsem připojen ale internet nefunguje, jsem nucen zakázat a zase povolit připojení a nebo restartovat router. Četl jsem zde i jiné topicy ale žádný z nich mi nepomohl. Zde je log z programu RSIT. Děkuji za reakce a každou pomoc !
Logfile of random's system information tool 1.09 (written by random/random)
Run by Hans at 2011-11-26 12:31:12
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 4 GB (11%) free of 32 GB
Total RAM: 3326 MB (67% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:31:31, on 26.11.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Tunngle\Tunngle\TnglCtrl.exe
C:\Program Files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Samsung\AllShare\AllShareAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Documents and Settings\Hans\Data aplikací\QipGuard\QipGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Documents and Settings\Hans\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
D:\kies\Kies\KiesTrayAgent.exe
D:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files\QIP 2010\qip.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
E:\Apache\Apache2\bin\ApacheMonitor.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
E:\RSIT.exe
C:\Program Files\trend micro\Hans.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://tn.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tn.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Poskytovatel aplikace Windows Internet Explorer: TV Nova
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Hans\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\prxtbBit0.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Games\OFFICE~1\Office14\GROOVEEX.DLL
O2 - BHO: BitTorrentBar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\prxtbBit0.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Hans\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Games\OFFICE~1\Office14\URLREDIR.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Trillian Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\prxtbBit0.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [AllShareAgent] C:\Program Files\Samsung\AllShare\AllShareAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [QIP Internet Guardian] C:\Documents and Settings\Hans\Data aplikací\QipGuard\QipGuard.exe
O4 - HKCU\..\Run: [FlashGet 3] "C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" -minimize
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype Call Recorder] C:\Program Files\SkypeCallRecorder\SkypeCallRecorder.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Hans\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [KiesHelper] D:\kies\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesTrayAgent] D:\kies\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [KiesPDLR] D:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [Infium] "C:\Program Files\QIP 2010\qip.exe" /autorun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [Mapík 2011] C:\Documents and Settings\Hans\Data aplikací\TNS2011\CVS_11.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Monitor Apache Servers.lnk = E:\Apache\Apache2\bin\ApacheMonitor.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download all by FlashGet3 - C:\Program Files\FlashGet Network\FlashGet 3\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Program Files\FlashGet Network\FlashGet 3\GetUrl.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\Games\OFFICE~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://E:\Games\OFFICE~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Games\Office 10\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Games\Office 10\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Games\Office 10\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Games\Office 10\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - E:\Games\PokerStars\PokerStarsUpdate.exe (HKCU)
O15 - Trusted Zone: http://software.kuaiche.com
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apache2.2 - Unknown owner - D:\php\bin\httpd.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Samsung AllShare PC Service (SamsungAllShare) - Unknown owner - C:\Program Files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe
O23 - Service: SimpleSlideShowServer - Unknown owner - C:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe (file missing)
O23 - Service: TunngleService - Tunngle.net GmbH - D:\Tunngle\Tunngle\TnglCtrl.exe
--
End of file - 14989 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-854245398-1801674531-1007Core1cc93a43f5d634a.job
=========Mozilla firefox=========
ProfilePath - C:\Documents and Settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26, {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442, {20a82645-c095-46ed-80e3-08825760534b}:1.1, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=D:\Picc\Picasa3\npPicasa3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=E:\Games\OFFICE~1\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=E:\Games\OFFICE~1\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nexon.net/NxGame]
"Description"=Nexon Game Controller
"Path"=C:\Documents and Settings\All Users\Data aplikací\NexonUS\NGM\npNxGameUS.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ngm.nexoneu.com/NxGame]
"Description"=Nexon Game Controller 1.0.0.1
"Path"=C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\npNxGameeu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@protectdisc.com/NPMPDRM]
"Description"=MPDRM License Acquisition Plugin
"Path"=C:\Program Files\Common Files\mpDRM\NPMPDRM.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
C:\Program Files\Mozilla Firefox\components\
nsUpdateService.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
nsUpdateServiceStub.js
NetworkGeolocationProvider.js
nsUpdateTimerManager.js
nsBadCertHandler.js
compreg.dat
xpti.dat
browser.xpt
FeedConverter.js
brwsrcmp.dll
nsContentDispatchChooser.js
nsDownloadManagerUI.js
nsSidebar.js
nsUrlClassifierLib.js
nsFormAutoComplete.js
nsHandlerService.js
browserdirprovider.dll
nsINIProcessor.js
WebContentConverter.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsProxyAutoConfig.js
nsExtensionManager.js
nsSearchSuggestions.js
nsUrlClassifierListManager.js
pluginGlue.js
nsSetDefaultBrowser.js
nsTaggingService.js
nsTryToClose.js
nsWebHandlerApp.js
components.list
storage-mozStorage.js
txEXSLTRegExFunctions.js
jsconsole-clhandler.js
nsAddonRepository.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentPrefService.js
nsDefaultCLH.js
storage-Legacy.js
nsHelperAppDlg.js
nsLivemarkService.js
nsMicrosummaryService.js
nsPrivateBrowsingService.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSessionStartup.js
nsSessionStore.js
nsURLFormatter.js
C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt
npdeployJava1.dll
npnul32.dll
C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
C:\Documents and Settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b}
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - C:\PROGRA~1\ICQTOO~1\toolbaru.dll [2006-12-25 701952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-03-28 176936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - E:\Games\OFFICE~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
BitTorrentBar Toolbar - C:\Program Files\BitTorrentBar\prxtbBit0.dll [2011-03-28 176936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Hans\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-03-26 149968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-08-26 305328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll [2011-05-29 1007160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - E:\Games\OFFICE~1\Office14\URLREDIR.DLL [2010-02-28 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Trillian Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2011-07-26 1493160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-08-03 42272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-08-03 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-06-02 1018616]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Trillian Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2011-07-26 1493160]
{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - BitTorrentBar Toolbar - C:\Program Files\BitTorrentBar\prxtbBit0.dll [2011-03-28 176936]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\prxConduitEngine.dll [2011-03-28 176936]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2011-08-26 305328]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-10 16861184]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-08-12 1657376]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-08-17 13877248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-08-17 86016]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2009-09-30 718688]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-16 1164584]
"itype"=C:\Program Files\Microsoft IntelliType Pro\itype.exe [2009-01-07 1496968]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]
""= []
"ApnUpdater"=C:\Program Files\Ask.com\Updater\Updater.exe [2011-07-26 397992]
"AllShareAgent"=C:\Program Files\Samsung\AllShare\AllShareAgent.exe [2011-05-24 250768]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"QIP Internet Guardian"=C:\Documents and Settings\Hans\Data aplikací\QipGuard\QipGuard.exe [2010-03-29 181760]
"FlashGet 3"=C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe -minimize []
"PlayNC Launcher"= []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"NexonEULauncher"= []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-04-06 39408]
"Skype Call Recorder"=C:\Program Files\SkypeCallRecorder\SkypeCallRecorder.exe [2008-12-08 1180160]
"Google Update"=C:\Documents and Settings\Hans\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-06-06 136176]
"KiesHelper"=D:\kies\Kies\KiesHelper.exe [2011-08-01 958352]
"KiesTrayAgent"=D:\kies\Kies\KiesTrayAgent.exe [2011-08-01 3507088]
"KiesPDLR"=D:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe [2011-08-01 20880]
"Infium"=C:\Program Files\QIP 2010\qip.exe [2010-10-12 5810128]
"Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2011-09-04 3077528]
"Mapík 2011"=C:\Documents and Settings\Hans\Data aplikací\TNS2011\CVS_11.exe []
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Monitor Apache Servers.lnk - E:\Apache\Apache2\bin\ApacheMonitor.exe
C:\Documents and Settings\Hans\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=E:\Games\OFFICE~1\Office14\GROOVEEX.DLL [2011-06-12 4221328]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\BFBC2\BFBC2BetaUpdater.exe"="D:\BFBC2\BFBC2BetaUpdater.exe:*:Enabled:Battlefield Bad Company 2 - BETA"
"C:\WINDOWS\System32\PnkBstrA.exe"="C:\WINDOWS\System32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\System32\PnkBstrB.exe"="C:\WINDOWS\System32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\BFBC\BFBC2Updater.exe"="D:\BFBC\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2"
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"
"E:\Games\Battle forge\Bootstrapper.exe"="E:\Games\Battle forge\Bootstrapper.exe:*:Enabled:BattleForge™ Launcher"
"E:\Games\Battle forge\BattleForge.exe"="E:\Games\Battle forge\BattleForge.exe:*:Enabled:BattleForge™"
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe"="C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Downloader_Engine"
"C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Combat Arms EU\CombatArms.exe"="C:\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Combat Arms EU\NMService.exe"="C:\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\EA Sports\FIFA Online\NFE.exe"="C:\Program Files\EA Sports\FIFA Online\NFE.exe:*:Enabled:EA SPORTS™ FIFA Online"
"E:\Games\FIfa\NFE.exe"="E:\Games\FIfa\NFE.exe:*:Enabled:EA SPORTS™ FIFA Online"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"D:\Hry\Steam\Steam.exe"="D:\Hry\Steam\Steam.exe:*:Enabled:Steam"
"E:\Games\Worms\WA.exe"="E:\Games\Worms\WA.exe:*:Enabled:Worms Armageddon"
"E:\Sarcraft\StarCraft II\StarCraft II.exe"="E:\Sarcraft\StarCraft II\StarCraft II.exe:*:Enabled:Blizzard Launcher"
"E:\Games\qllods\Allods Online\bin\Launcher.exe"="E:\Games\qllods\Allods Online\bin\Launcher.exe:*:Enabled:Allods Online launcher.exe"
"E:\Games\qllods\Allods Online\bin\AOgame.exe"="E:\Games\qllods\Allods Online\bin\AOgame.exe:*:Enabled:Allods Online AOgame.exe"
"E:\Games\World of Warcraft\WoW-3.3.5.12213-to-3.3.5.12340-enGB-downloader.exe"="E:\Games\World of Warcraft\WoW-3.3.5.12213-to-3.3.5.12340-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"E:\Games\Office 10\Office14\GROOVE.EXE"="E:\Games\Office 10\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace"
"E:\Games\Office 10\Office14\ONENOTE.EXE"="E:\Games\Office 10\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote"
"E:\Games\Office 10\Office14\OUTLOOK.EXE"="E:\Games\Office 10\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Documents and Settings\Hans\Local Settings\Temp\RarSFX4\Pack\Keygen\Keygen.exe"="C:\Documents and Settings\Hans\Local Settings\Temp\RarSFX4\Pack\Keygen\Keygen.exe:*:Enabled:Keygen"
"C:\Combat Arms EU\Engine.exe"="C:\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"E:\Combat Arms EU\NMService.exe"="E:\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core"
"E:\abb\Binaries\Borderlands.exe"="E:\abb\Binaries\Borderlands.exe:*:Enabled:Borderlands"
"E:\Games\NFSHP\Launcher.exe"="E:\Games\NFSHP\Launcher.exe:*:Enabled:Need for Speed(TM) Hot Pursuit"
"D:\Hry\WoW\World of Warcraft\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe"="D:\Hry\WoW\World of Warcraft\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\Hry\WoW\World of Warcraft\Launcher.exe"="D:\Hry\WoW\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"D:\Hry\WoW\World of Warcraft\Launcher.patch.exe"="D:\Hry\WoW\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher"
"E:\LOTRC\Conquest.exe"="E:\LOTRC\Conquest.exe:*:Enabled:Game"
"E:\Games\NFSHP\NFS11.exe"="E:\Games\NFSHP\NFS11.exe:*:Enabled:Need for Speed(TM) Hot Pursuit Application"
"C:\Program Files\BitTorrent\BitTorrent.exe"="C:\Program Files\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent"
"E:\CODBO\Call of Duty - Black Ops\BlackOps.exe"="E:\CODBO\Call of Duty - Black Ops\BlackOps.exe:*:Enabled:BlackOps"
"C:\Program Files\SkypeCallRecorder\SkypeCallRecorder.exe"="C:\Program Files\SkypeCallRecorder\SkypeCallRecorder.exe:*:Disabled:SkypeCallRecorder"
"D:\Mass Efect 2\Mass Effect 2\Binaries\MassEffect2.exe"="D:\Mass Efect 2\Mass Effect 2\Binaries\MassEffect2.exe:*:Enabled:Mass Effect 2 Hra"
"D:\Mass Efect 2\Mass Effect 2\MassEffect2Launcher.exe"="D:\Mass Efect 2\Mass Effect 2\MassEffect2Launcher.exe:*:Enabled:Mass Effect 2 Spustit"
"D:\Hry\Steam\SteamApps\gandy99\counter-strike\hl.exe"="D:\Hry\Steam\SteamApps\gandy99\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"E:\Sarcraft\StarCraft II\Versions\Base17326\SC2.exe"="E:\Sarcraft\StarCraft II\Versions\Base17326\SC2.exe:*:Disabled:StarCraft II"
"E:\Sarcraft\StarCraft II\Versions\Base15405\SC2.exe"="E:\Sarcraft\StarCraft II\Versions\Base15405\SC2.exe:*:Disabled:StarCraft II"
"D:\Hry\Steam\SteamApps\COMMON\alien swarm\swarm.exe"="D:\Hry\Steam\SteamApps\COMMON\alien swarm\swarm.exe:*:Enabled:Alien Swarm"
"D:\Hry\Steam\SteamApps\COMMON\alien swarm\srcds.exe"="D:\Hry\Steam\SteamApps\COMMON\alien swarm\srcds.exe:*:Enabled:Alien Swarm Dedicated Server"
"D:\Hry\Steam\SteamApps\COMMON\shattered_horizon\client_exe\shattered_horizon.exe"="D:\Hry\Steam\SteamApps\COMMON\shattered_horizon\client_exe\shattered_horizon.exe:*:Enabled:Shattered Horizon"
"D:\Hry\Steam\SteamApps\COMMON\medal of honor beta\MoHMPGame.exe"="D:\Hry\Steam\SteamApps\COMMON\medal of honor beta\MoHMPGame.exe:*:Enabled:Medal of Honor Beta"
"D:\Hry\Steam\SteamApps\COMMON\medal of honor beta\Support\EA Help\Electronic_Arts_Technical_Support.htm"="D:\Hry\Steam\SteamApps\COMMON\medal of honor beta\Support\EA Help\Electronic_Arts_Technical_Support.htm:*:Enabled:Medal of Honor Beta"
"D:\Hry\Steam\SteamApps\gandy99\condition zero\hl.exe"="D:\Hry\Steam\SteamApps\gandy99\condition zero\hl.exe:*:Enabled:Counter-Strike: Condition Zero"
"D:\Hry\Steam\SteamApps\gandy99\deathmatch classic\hl.exe"="D:\Hry\Steam\SteamApps\gandy99\deathmatch classic\hl.exe:*:Enabled:Deathmatch Classic"
"D:\Hry\Steam\SteamApps\gandy99\day of defeat\hl.exe"="D:\Hry\Steam\SteamApps\gandy99\day of defeat\hl.exe:*:Enabled:Day of Defeat"
"E:\CAEU\Combat Arms EU\CombatArms.exe"="E:\CAEU\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\CAEU\Combat Arms EU\NMService.exe"="E:\CAEU\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core"
"D:\Hry\Steam\SteamApps\common\dragon age ii demo\DragonAge2Launcher.exe"="D:\Hry\Steam\SteamApps\common\dragon age ii demo\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Demo"
"D:\Hry\Steam\SteamApps\common\dragon age ii demo\docs\EA Help\Electronic_Arts_Technical_Support.htm"="D:\Hry\Steam\SteamApps\common\dragon age ii demo\docs\EA Help\Electronic_Arts_Technical_Support.htm:*:Enabled:Dragon Age II Demo"
"D:\Hry\Steam\SteamApps\GANDY99\counter-strike source\hl2.exe"="D:\Hry\Steam\SteamApps\GANDY99\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source"
"D:\Hry\Steam\SteamApps\COMMON\magicka\Magicka.exe"="D:\Hry\Steam\SteamApps\COMMON\magicka\Magicka.exe:*:Enabled:Magicka"
"D:\Hry\Steam\SteamApps\COMMON\left 4 dead 2\left4dead2.exe"="D:\Hry\Steam\SteamApps\COMMON\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"
"C:\Program Files\Google\Google Earth\client\googleearth.exe"="C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"
"E:\Games\Nová složka\World_of_Tanks_closed_Beta\WorldOfTanks.exe"="E:\Games\Nová složka\World_of_Tanks_closed_Beta\WorldOfTanks.exe:*:Enabled:World of Tanks"
"D:\Hry\BFF\BFP4f.exe"="D:\Hry\BFF\BFP4f.exe:*:Disabled:BFP4f"
"C:\Documents and Settings\All Users\Data aplikací\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Data aplikací\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"D:\Hry\Vind\Vindictus\en-US\NMService.exe"="D:\Hry\Vind\Vindictus\en-US\NMService.exe:*:Enabled:Nexon Messenger Core"
"D:\Hry\Vind\Vindictus\en-US\Vindictus.exe"="D:\Hry\Vind\Vindictus\en-US\Vindictus.exe:*:Enabled:Vindictus Launcher"
"D:\Hry\HLSW\hlsw.exe"="D:\Hry\HLSW\hlsw.exe:*:Enabled:HLSW Application"
"D:\Hry\CoD 6\Modern Warfare 2\iw4mp.exe"="D:\Hry\CoD 6\Modern Warfare 2\iw4mp.exe:*:Enabled:iw4mp"
"C:\Program Files\TeamViewer\Version6\TeamViewer.exe"="C:\Program Files\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"D:\Brink\Brink\brink.exe"="D:\Brink\Brink\brink.exe:*:Enabled:Brink"
"C:\WINDOWS\System32\muzapp.exe"="C:\WINDOWS\System32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"E:\Games\Steam\SteamApps\common\forsaken world\patcher.exe"="E:\Games\Steam\SteamApps\common\forsaken world\patcher.exe:*:Enabled:Forsaken World "
"E:\Games\Steam\SteamApps\common\global agenda live\Binaries\GlobalAgenda.exe"="E:\Games\Steam\SteamApps\common\global agenda live\Binaries\GlobalAgenda.exe:*:Enabled:TgGame Client"
"E:\Games\Steam\SteamApps\common\champions online\Champions Online.exe"="E:\Games\Steam\SteamApps\common\champions online\Champions Online.exe:*:Enabled:Champions Online: Free For All"
"E:\Games\Steam\SteamApps\gandy99\team fortress 2\hl2.exe"="E:\Games\Steam\SteamApps\gandy99\team fortress 2\hl2.exe:*:Enabled:hl2"
"E:\Zaklínač\bin\witcher2.exe"="E:\Zaklínač\bin\witcher2.exe:*:Disabled:The Witcher 2: Assasins of Kings"
"E:\Zaklínač II\bin\witcher2.exe"="E:\Zaklínač II\bin\witcher2.exe:*:Disabled:The Witcher 2: Assasins of Kings"
"E:\wITCHER\bin\witcher2.exe"="E:\wITCHER\bin\witcher2.exe:*:Disabled:The Witcher 2: Assasins of Kings"
"E:\Witcher II\bin\witcher2.exe"="E:\Witcher II\bin\witcher2.exe:*:Disabled:The Witcher 2: Assasins of Kings"
"C:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe"="C:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe:*:Enabled:SimpleSlideShowServer"
"C:\Program Files\Samsung\AllShare\AllShare.exe"="C:\Program Files\Samsung\AllShare\AllShare.exe:*:Enabled:SamsungAllSharePCSW"
"C:\Program Files\Samsung\AllShare\AllShareAgent.exe"="C:\Program Files\Samsung\AllShare\AllShareAgent.exe:*:Enabled:SamsungAllShareAgent"
"C:\Program Files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe"="C:\Program Files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe:*:Enabled:SamsungAllShareServer"
"C:\Program Files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe"="C:\Program Files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe:*:Enabled:SamsungAllShareHttpServer"
"C:\Documents and Settings\Hans\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Hans\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"E:\Games\Steam\SteamApps\common\warincbattlezone\WarInc.exe"="E:\Games\Steam\SteamApps\common\warincbattlezone\WarInc.exe:*:Enabled:War Inc. Battlezone"
"D:\Hon\hon.exe"="D:\Hon\hon.exe:*:Enabled:Heroes of Newerth"
"E:\Games\Steam\SteamApps\gandy99\day of defeat\hl.exe"="E:\Games\Steam\SteamApps\gandy99\day of defeat\hl.exe:*:Enabled:Day of Defeat"
"D:\Hry\Heroes\Heroes In the Sky\HIS.EXE"="D:\Hry\Heroes\Heroes In the Sky\HIS.EXE:*:Enabled:his"
"D:\Tunngle\Tunngle\tnglctrl.exe"="D:\Tunngle\Tunngle\tnglctrl.exe:*:Enabled:Tunngle Service"
"D:\Tunngle\Tunngle\tunngle.exe"="D:\Tunngle\Tunngle\tunngle.exe:*:Enabled:Tunngle Client"
"C:\WINDOWS\System32\dplaysvr.exe"="C:\WINDOWS\System32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"D:\Hry\Stronghold\Stronghold Crusader\Stronghold Crusader\Stronghold Crusader.exe"="D:\Hry\Stronghold\Stronghold Crusader\Stronghold Crusader\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader"
"C:\Documents and Settings\Hans\Data aplikací\GameRanger\GameRanger\GameRanger.exe"="C:\Documents and Settings\Hans\Data aplikací\GameRanger\GameRanger\GameRanger.exe:*:Enabled:GameRanger"
"E:\Games\Steam\SteamApps\gandy99\counter-strike\hl.exe"="E:\Games\Steam\SteamApps\gandy99\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"E:\Games\Steam\SteamApps\common\spiral knights\java_vm\bin\javaw.exe"="E:\Games\Steam\SteamApps\common\spiral knights\java_vm\bin\javaw.exe:*:Enabled:Spiral Knights"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Combat Arms EU\CombatArms.exe"="C:\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Combat Arms EU\Engine.exe"="C:\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"E:\CAEU\Combat Arms EU\CombatArms.exe"="E:\CAEU\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\CAEU\Combat Arms EU\Engine.exe"="E:\CAEU\Combat Arms EU\Engine.exe:*Enabled:Engine.exe"
"E:\DO II demo\Dragon Age 2 Demo\bin_ship\DragonAge2Demo.exe"="E:\DO II demo\Dragon Age 2 Demo\bin_ship\DragonAge2Demo.exe:*:Enabled:Dragon Age II Demo"
"E:\DO II demo\Dragon Age 2 Demo\DragonAge2Launcher.exe"="E:\DO II demo\Dragon Age 2 Demo\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Demo Launcher"
"E:\Games\DA\Dragon Age 2\bin_ship\DragonAge2.exe"="E:\Games\DA\Dragon Age 2\bin_ship\DragonAge2.exe:*:Enabled:Dragon Age II"
"E:\Games\DA\Dragon Age 2\DragonAge2Launcher.exe"="E:\Games\DA\Dragon Age 2\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Launcher"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"E:\Games\SWTOR\Star Wars-The Old Republic\launcher.exe"="E:\Games\SWTOR\Star Wars-The Old Republic\launcher.exe:*:Enabled:Star Wars - The Old Republic"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i263_32.drv
"vidc.iv31"=Ir32_32.dll
"vidc.iv32"=Ir32_32.dll
"vidc.iv41"=Ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"vidc.XVID"=xvidvfw.dll
"vidc.DIV3"=DivXc32.dll
"vidc.DIV4"=DivXc32f.dll
"msacm.lameacm"=lameACM.acm
"vidc.3ivx"=3ivxVfWCodec.dll
"vidc.3iv2"=3ivxVfWCodec.dll
"msacm.divxa32"=divxa32.acm
"VIDC.HFYU"=huffyuv.dll
"VIDC.wmv3"=wmv9vcm.dll
"VIDC.i263"=i263_32.drv
"msacm.imc"=imc32.acm
"VIDC.IV40"=Ir41_32.ax
"VIDC.VP60"=vp6vfw.dll
"VIDC.VP61"=vp6vfw.dll
"VIDC.VP62"=vp6vfw.dll
"VIDC.VP31"=vp31vfw.dll
"vidc.MPG4"=Mpg4c32.dll
"vidc.MP42"=Mpg4c32.dll
"vidc.MP43"=Mpg4c32.dll
"msacm.ac3acm"=ac3acm.acm
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"VIDC.XFR1"=xfcodec.dll
"wave1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.FPS1"=frapsvid.dll
"vidc.mpeg"=bdmpegv.dll
"msacm.bdmpeg"=bdmpega.acm
======List of files/folders created in the last 1 month======
2011-11-26 12:31:12 ----D---- C:\rsit
2011-11-26 12:31:12 ----D---- C:\Program Files\trend micro
2011-11-26 12:11:30 ----SHD---- C:\FOUND.009
2011-11-26 10:28:08 ----D---- C:\Documents and Settings\Hans\Data aplikací\WinRAR
2011-11-26 10:09:14 ----SHD---- C:\FOUND.008
2011-11-26 09:19:07 ----D---- C:\Documents and Settings\Hans\Data aplikací\DivX
2011-11-26 00:48:22 ----SHD---- C:\FOUND.007
2011-11-25 16:02:36 ----SHD---- C:\FOUND.006
2011-11-24 15:38:40 ----SHD---- C:\FOUND.005
2011-11-19 09:13:17 ----D---- C:\Documents and Settings\Hans\Data aplikací\Mozilla
2011-11-16 19:25:46 ----D---- C:\Documents and Settings\Hans\Data aplikací\BSplayer
2011-11-15 16:20:18 ----SHD---- C:\FOUND.004
2011-11-12 16:59:01 ----D---- C:\Documents and Settings\Hans\Data aplikací\Sun
2011-11-12 16:48:53 ----D---- C:\Documents and Settings\Hans\Data aplikací\Macromedia
2011-11-12 15:24:41 ----D---- C:\Documents and Settings\Hans\Data aplikací\Adobe
2011-11-12 15:12:41 ----D---- C:\Documents and Settings\Hans\Data aplikací\QIP
2011-11-04 20:27:14 ----D---- C:\Documents and Settings\Hans\Data aplikací\Might & Magic Heroes VI
======List of files/folders modified in the last 1 month======
2011-11-26 10:46:10 ----A---- C:\WINDOWS\NeroDigital.ini
2011-11-23 16:40:44 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-11-13 09:46:14 ----A---- C:\WINDOWS\DUMP2990.tmp
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-07-12 45648]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2011-07-01 436792]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-01-13 29392]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-01-13 23632]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-01-13 294608]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-01-13 47440]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-01-13 100176]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-03-25 281760]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2010-03-25 25888]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-07-23 25280]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-17 4707328]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-08-17 7729568]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-31 117888]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle); C:\WINDOWS\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
R3 tenCapture;tenCapture; C:\WINDOWS\system32\DRIVERS\tenCapture.sys [2007-04-21 9344]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 amuo2ita;amuo2ita; C:\WINDOWS\system32\drivers\amuo2ita.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudbus.sys [2011-06-16 76088]
S3 dgderdrv;dgderdrv; C:\WINDOWS\System32\drivers\dgderdrv.sys [2011-06-07 20032]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 EagleXNt;EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\PC\LOCALS~1\Temp\KDP186.tmp []
S3 npkcrypt;npkcrypt; \??\E:\L2\system\npkcrypt.sys []
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [2011-06-16 181432]
S3 tap0901;tap0901; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2011-06-07 26112]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WinUSB;SAMSUNG Android USB Driver; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2006-11-02 39368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XDva365;XDva365; \??\C:\WINDOWS\system32\XDva365.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
R2 IISADMIN;Správa služby IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2008-04-14 15872]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-04 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-08-17 168004]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2011-04-07 75136]
R2 SamsungAllShare;Samsung AllShare PC Service; C:\Program Files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe [2011-05-24 7237024]
R2 TunngleService;TunngleService; D:\Tunngle\Tunngle\TnglCtrl.exe [2011-07-15 741624]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 Apache2.2;Apache2.2; D:\php\bin\httpd.exe -k runservice []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-01 135664]
S2 SimpleSlideShowServer;SimpleSlideShowServer; C:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe []
S2 W3SVC;Publikování na webu; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2008-04-14 15872]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-01 135664]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-04-06 182768]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; E:\Games\Office 10\Office14\GROOVE.EXE [2011-06-12 31125880]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2011-01-12 4266480]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Padá internet
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 119510
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Padá internet
Zdravím!
Poprosím o log z ComboFix.
Poprosím o log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se
jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine
aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,
pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k
nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Padá internet
Mazalo mi to celkem dost věcí, měl jsem obavy. Zde je Log
ComboFix 11-11-26.01 - Hans 26.11.2011 13:07:01.1.2 - FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2068 [GMT 1:00]
Spuštěný z: c:\documents and settings\Hans\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\Hans\LOCALS~1\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll
c:\documents and settings\Hans\Local Settings\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll
C:\Thumbs.db
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\Cache
c:\windows\system32\http_ss.log
c:\windows\system32\ijl11.dll
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\vbpng1.dll
c:\windows\WindowsUpdate.log
D:\install.exe
E:\111.exe
E:\setup.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-26 do 2011-11-26 )))))))))))))))))))))))))))))))
.
.
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- C:\rsit
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- c:\program files\trend micro
2011-11-26 11:11 . 2011-11-26 11:11 -------- d-----w- C:\FOUND.009
2011-11-26 09:09 . 2011-11-26 09:09 -------- d-----w- C:\FOUND.008
2011-11-26 08:19 . 2011-11-26 08:19 -------- d-----w- c:\documents and settings\Hans\Data aplikací\DivX
2011-11-25 23:48 . 2011-11-25 23:48 -------- d-----w- C:\FOUND.007
2011-11-25 15:02 . 2011-11-25 15:02 -------- d-----w- C:\FOUND.006
2011-11-24 14:38 . 2011-11-24 14:38 -------- d-----w- C:\FOUND.005
2011-11-22 15:21 . 2011-11-22 15:22 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Chromium
2011-11-21 15:53 . 2011-11-21 15:53 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Mozilla
2011-11-17 20:38 . 2011-11-17 20:38 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\SWTOR
2011-11-17 17:06 . 2011-11-17 17:06 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Adobe
2011-11-16 18:25 . 2011-11-16 18:25 -------- d-----w- c:\documents and settings\Hans\Data aplikací\BSplayer
2011-11-15 15:20 . 2011-11-15 15:20 -------- d-----w- C:\FOUND.004
2011-11-12 14:13 . 2011-11-12 14:13 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Alexander_Nikiforov
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\PMB Files
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Data aplikací\QIP
2011-11-04 19:27 . 2011-11-04 19:27 -------- d-----w- c:\documents and settings\Hans\Data aplikací\Might & Magic Heroes VI
2011-10-27 13:31 . 2004-10-22 01:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-10-27 13:31 . 2004-10-22 01:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-10-27 13:31 . 2004-10-22 01:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-10-27 13:31 . 2004-10-22 01:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-10-27 13:31 . 2004-10-22 01:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-10-27 13:31 . 2011-10-27 13:31 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-10-27 13:31 . 2011-10-27 13:31 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-13 08:46 . 2010-02-25 15:35 98304 ----a-w- c:\windows\DUMP2990.tmp
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2001-10-25 13:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2001-10-25 13:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 10:12 . 2008-04-14 05:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 15:10 . 2008-04-14 04:45 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 14:58 . 2011-09-05 14:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 17:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-28 17:22 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBit0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-07-26 17:23 1493160 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-26 1493160]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-26 1493160]
"{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP Internet Guardian"="c:\documents and settings\Hans\Data aplikací\QipGuard\QipGuard.exe" [2010-03-29 181760]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-06 39408]
"Skype Call Recorder"="c:\program files\SkypeCallRecorder\SkypeCallRecorder.exe" [2008-12-08 1180160]
"KiesHelper"="d:\kies\Kies\KiesHelper.exe" [2011-08-01 958352]
"KiesTrayAgent"="d:\kies\Kies\KiesTrayAgent.exe" [2011-08-01 3507088]
"KiesPDLR"="d:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-08-01 20880]
"Infium"="c:\program files\QIP 2010\qip.exe" [2010-10-12 5810128]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-09-04 3077528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-01-07 1496968]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-07-26 397992]
"AllShareAgent"="c:\program files\Samsung\AllShare\AllShareAgent.exe" [2011-05-24 250768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\PC\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Tom\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Hans\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Monitor Apache Servers.lnk - e:\apache\Apache2\bin\ApacheMonitor.exe [2005-10-9 41042]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\PnkBstrA.exe"=
"c:\\WINDOWS\\System32\\PnkBstrB.exe"=
"e:\\Games\\Battle forge\\Bootstrapper.exe"=
"e:\\Games\\Battle forge\\BattleForge.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"e:\\Games\\FIfa\\NFE.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"e:\\Games\\Worms\\WA.exe"=
"e:\\Sarcraft\\StarCraft II\\StarCraft II.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\Launcher.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\AOgame.exe"=
"e:\\Games\\Office 10\\Office14\\GROOVE.EXE"=
"e:\\Games\\Office 10\\Office14\\ONENOTE.EXE"=
"e:\\Games\\Office 10\\Office14\\OUTLOOK.EXE"=
"e:\\abb\\Binaries\\Borderlands.exe"=
"e:\\Games\\NFSHP\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.patch.exe"=
"e:\\Games\\NFSHP\\NFS11.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\SkypeCallRecorder\\SkypeCallRecorder.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\Sarcraft\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonUS\\NGM\\NGM.exe"=
"d:\\Hry\\HLSW\\hlsw.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"e:\\Witcher II\\bin\\witcher2.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareAgent.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\WiselinkPro.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\http_ss_win_pro.exe"=
"c:\\Documents and Settings\\Hans\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\WarInc.exe"=
"d:\\Hon\\hon.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\day of defeat\\hl.exe"=
"d:\\Hry\\Heroes\\Heroes In the Sky\\HIS.EXE"=
"d:\\Tunngle\\Tunngle\\tnglctrl.exe"=
"d:\\Tunngle\\Tunngle\\tunngle.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"d:\\Hry\\Stronghold\\Stronghold Crusader\\Stronghold Crusader\\Stronghold Crusader.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spiral knights\\java_vm\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spacechem - demo\\SpaceChem.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\deathmatch classic\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\condition zero\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\world in conflict - demo\\wic.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\DragonAge2Launcher.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\rsupdate.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\w3\\Warcraft III\\Warcraft III\\Warcraft III.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\magicka\\Magicka.exe"=
"c:\\squid\\sbin\\squid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike beta\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\hoard\\win32\\Reuben.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\crysis 2 - demo\\Bin32\\Crysis2Demo.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Games\\HVI\\Might & Magic Heroes VI.exe"=
"e:\\Games\\Star Wars-The Old Republic\\betatest\\retailclient\\swtor.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\solar 2\\Solar2.exe"=
"e:\\Games\\Star Wars-The Old Republic\\launcher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57974:TCP"= 57974:TCP:Pando Media Booster
"57974:UDP"= 57974:UDP:Pando Media Booster
"57727:TCP"= 57727:TCP:Pando Media Booster
"57727:UDP"= 57727:UDP:Pando Media Booster
"57147:TCP"= 57147:TCP:Pando Media Booster
"57147:UDP"= 57147:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.2.2010 16:38 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26.2.2010 9:57 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26.2.2010 9:57 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [23.4.2010 16:49 246520]
R2 SamsungAllShare;Samsung AllShare PC Service;c:\program files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe [24.5.2011 13:44 7237024]
R2 TunngleService;TunngleService;d:\tunngle\Tunngle\TnglCtrl.exe [7.8.2011 19:22 741624]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [7.8.2011 19:22 27136]
R3 tenCapture;tenCapture;c:\windows\system32\drivers\tenCapture.sys [21.4.2007 15:15 9344]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S2 Apache2.2;Apache2.2;"d:\php\bin\httpd.exe" -k runservice --> d:\php\bin\httpd.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S2 SimpleSlideShowServer;SimpleSlideShowServer;"c:\program files\Samsung\AllShare\AllShareSlideShowService.exe" --> c:\program files\Samsung\AllShare\AllShareSlideShowService.exe [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [1.7.2011 23:41 76088]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [22.7.2011 22:42 20032]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp --> c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\games\Office 10\Office14\GROOVE.EXE [12.6.2011 10:15 31125880]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [1.7.2011 23:41 181432]
S3 XDva365;XDva365;\??\c:\windows\system32\XDva365.sys --> c:\windows\system32\XDva365.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-26 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-07-26 17:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://tn.cz
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyServer = localhost:3128
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download all by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
IE: Download by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\games\OFFICE~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\games\OFFICE~1\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: kuaiche.com\software
TCP: DhcpNameServer = 10.254.254.254 10.254.254.253
FF - ProfilePath - c:\documents and settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-FlashGet 3 - c:\program files\FlashGet Network\FlashGet 3\FlashGet3.exe
HKCU-Run-PlayNC Launcher - (no file)
HKCU-Run-NexonEULauncher - (no file)
HKCU-Run-Mapík 2011 - c:\documents and settings\Hans\Data aplikací\TNS2011\CVS_11.exe
AddRemove-Android SDK Tools - c:\program files\Android\android-sdk\uninstall.exe
AddRemove-Garena - c:\program files\Garena\uninst.exe
AddRemove-Half-Life Dedicated Server Update Tool - c:\progra~1\VALVE\HLSERVER\UNWISE.EXE
AddRemove-ImTOO Video to Audio Converter - c:\program files\ImTOO\Video to Audio Converter\Uninstall.exe
AddRemove-Steam App 18110 - d:\hry\Steam\steam.exe
AddRemove-Steam App 240 - d:\hry\Steam\steam.exe
AddRemove-Steam App 30 - d:\hry\Steam\steam.exe
AddRemove-Steam App 40 - d:\hry\Steam\steam.exe
AddRemove-Steam App 41300 - d:\hry\Steam\steam.exe
AddRemove-Steam App 42910 - d:\hry\Steam\steam.exe
AddRemove-Steam App 47770 - d:\hry\Steam\steam.exe
AddRemove-Steam App 550 - d:\hry\Steam\steam.exe
AddRemove-Steam App 630 - d:\hry\steam\steam.exe
AddRemove-Steam App 635 - d:\hry\Steam\steam.exe
AddRemove-Steam App 64030 - d:\hry\Steam\steam.exe
AddRemove-Texas Holdem Poker 3D Deluxe Edition DeLEGiON_is1 - d:\poker\Texas Holdem Poker 3D Deluxe Edition DeLEGiON\unins000.exe
AddRemove-Trillian - c:\program files\Trillian\Trillian.exe
AddRemove-Wizard101(UK)_is1 - c:\program files\Wizard101(UK)\unins000.exe
AddRemove-{4560A1FD-9C9B-4D9F-8EEA-A002A44CDEA0}_is1 - c:\documents and settings\Hans\Data aplikací\TNS2011\unins000.exe
AddRemove-{87686C21-8A15-4b4d-A3F1-11141D9BE094} - d:\hry\BFF\uninstaller.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-Facebook Plug-In - c:\documents and settings\Hans\Data aplikací\Facebook\uninstall.exe
AddRemove-GameRanger - c:\documents and settings\Hans\Data aplikací\GameRanger\GameRanger\GameRanger.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-26 13:19
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-854245398-1801674531-1007\Software\SecuROM\License information*]
"datasecu"=hex:58,e0,c7,8c,d4,11,89,af,6f,13,b6,fa,8f,31,c3,1a,ea,64,5b,78,17,
95,52,b0,52,9d,11,1d,01,8f,1e,0c,23,61,a0,fa,cd,59,4d,b6,48,8b,c1,d7,ce,96,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2104)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
e:\games\OFFICE~1\Office14\1029\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2011-11-26 13:23:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-26 12:23
.
Před spuštěním: 3 687 235 584
Po spuštění: 9 436 184 576
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - FEBA625E21CBCE45595EE25E440726D8
ComboFix 11-11-26.01 - Hans 26.11.2011 13:07:01.1.2 - FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2068 [GMT 1:00]
Spuštěný z: c:\documents and settings\Hans\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\Hans\LOCALS~1\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll
c:\documents and settings\Hans\Local Settings\Temp\3dcf2df1-2a83-477c-a7dd-858967792357\CliSecureRT.dll
C:\Thumbs.db
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\Cache
c:\windows\system32\http_ss.log
c:\windows\system32\ijl11.dll
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\vbpng1.dll
c:\windows\WindowsUpdate.log
D:\install.exe
E:\111.exe
E:\setup.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-26 do 2011-11-26 )))))))))))))))))))))))))))))))
.
.
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- C:\rsit
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- c:\program files\trend micro
2011-11-26 11:11 . 2011-11-26 11:11 -------- d-----w- C:\FOUND.009
2011-11-26 09:09 . 2011-11-26 09:09 -------- d-----w- C:\FOUND.008
2011-11-26 08:19 . 2011-11-26 08:19 -------- d-----w- c:\documents and settings\Hans\Data aplikací\DivX
2011-11-25 23:48 . 2011-11-25 23:48 -------- d-----w- C:\FOUND.007
2011-11-25 15:02 . 2011-11-25 15:02 -------- d-----w- C:\FOUND.006
2011-11-24 14:38 . 2011-11-24 14:38 -------- d-----w- C:\FOUND.005
2011-11-22 15:21 . 2011-11-22 15:22 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Chromium
2011-11-21 15:53 . 2011-11-21 15:53 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Mozilla
2011-11-17 20:38 . 2011-11-17 20:38 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\SWTOR
2011-11-17 17:06 . 2011-11-17 17:06 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Adobe
2011-11-16 18:25 . 2011-11-16 18:25 -------- d-----w- c:\documents and settings\Hans\Data aplikací\BSplayer
2011-11-15 15:20 . 2011-11-15 15:20 -------- d-----w- C:\FOUND.004
2011-11-12 14:13 . 2011-11-12 14:13 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Alexander_Nikiforov
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\PMB Files
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Data aplikací\QIP
2011-11-04 19:27 . 2011-11-04 19:27 -------- d-----w- c:\documents and settings\Hans\Data aplikací\Might & Magic Heroes VI
2011-10-27 13:31 . 2004-10-22 01:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-10-27 13:31 . 2004-10-22 01:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-10-27 13:31 . 2004-10-22 01:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-10-27 13:31 . 2004-10-22 01:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-10-27 13:31 . 2004-10-22 01:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-10-27 13:31 . 2011-10-27 13:31 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-10-27 13:31 . 2011-10-27 13:31 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-13 08:46 . 2010-02-25 15:35 98304 ----a-w- c:\windows\DUMP2990.tmp
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2001-10-25 13:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2001-10-25 13:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 10:12 . 2008-04-14 05:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 15:10 . 2008-04-14 04:45 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 14:58 . 2011-09-05 14:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 17:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-28 17:22 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBit0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-07-26 17:23 1493160 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-26 1493160]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-26 1493160]
"{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP Internet Guardian"="c:\documents and settings\Hans\Data aplikací\QipGuard\QipGuard.exe" [2010-03-29 181760]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-06 39408]
"Skype Call Recorder"="c:\program files\SkypeCallRecorder\SkypeCallRecorder.exe" [2008-12-08 1180160]
"KiesHelper"="d:\kies\Kies\KiesHelper.exe" [2011-08-01 958352]
"KiesTrayAgent"="d:\kies\Kies\KiesTrayAgent.exe" [2011-08-01 3507088]
"KiesPDLR"="d:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-08-01 20880]
"Infium"="c:\program files\QIP 2010\qip.exe" [2010-10-12 5810128]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-09-04 3077528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-01-07 1496968]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-07-26 397992]
"AllShareAgent"="c:\program files\Samsung\AllShare\AllShareAgent.exe" [2011-05-24 250768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\PC\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Tom\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Hans\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Monitor Apache Servers.lnk - e:\apache\Apache2\bin\ApacheMonitor.exe [2005-10-9 41042]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\PnkBstrA.exe"=
"c:\\WINDOWS\\System32\\PnkBstrB.exe"=
"e:\\Games\\Battle forge\\Bootstrapper.exe"=
"e:\\Games\\Battle forge\\BattleForge.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"e:\\Games\\FIfa\\NFE.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"e:\\Games\\Worms\\WA.exe"=
"e:\\Sarcraft\\StarCraft II\\StarCraft II.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\Launcher.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\AOgame.exe"=
"e:\\Games\\Office 10\\Office14\\GROOVE.EXE"=
"e:\\Games\\Office 10\\Office14\\ONENOTE.EXE"=
"e:\\Games\\Office 10\\Office14\\OUTLOOK.EXE"=
"e:\\abb\\Binaries\\Borderlands.exe"=
"e:\\Games\\NFSHP\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.patch.exe"=
"e:\\Games\\NFSHP\\NFS11.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\SkypeCallRecorder\\SkypeCallRecorder.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\Sarcraft\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonUS\\NGM\\NGM.exe"=
"d:\\Hry\\HLSW\\hlsw.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"e:\\Witcher II\\bin\\witcher2.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareAgent.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\WiselinkPro.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\http_ss_win_pro.exe"=
"c:\\Documents and Settings\\Hans\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\WarInc.exe"=
"d:\\Hon\\hon.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\day of defeat\\hl.exe"=
"d:\\Hry\\Heroes\\Heroes In the Sky\\HIS.EXE"=
"d:\\Tunngle\\Tunngle\\tnglctrl.exe"=
"d:\\Tunngle\\Tunngle\\tunngle.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"d:\\Hry\\Stronghold\\Stronghold Crusader\\Stronghold Crusader\\Stronghold Crusader.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spiral knights\\java_vm\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spacechem - demo\\SpaceChem.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\deathmatch classic\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\condition zero\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\world in conflict - demo\\wic.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\DragonAge2Launcher.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\rsupdate.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\w3\\Warcraft III\\Warcraft III\\Warcraft III.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\magicka\\Magicka.exe"=
"c:\\squid\\sbin\\squid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike beta\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\hoard\\win32\\Reuben.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\crysis 2 - demo\\Bin32\\Crysis2Demo.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Games\\HVI\\Might & Magic Heroes VI.exe"=
"e:\\Games\\Star Wars-The Old Republic\\betatest\\retailclient\\swtor.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\solar 2\\Solar2.exe"=
"e:\\Games\\Star Wars-The Old Republic\\launcher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57974:TCP"= 57974:TCP:Pando Media Booster
"57974:UDP"= 57974:UDP:Pando Media Booster
"57727:TCP"= 57727:TCP:Pando Media Booster
"57727:UDP"= 57727:UDP:Pando Media Booster
"57147:TCP"= 57147:TCP:Pando Media Booster
"57147:UDP"= 57147:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.2.2010 16:38 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26.2.2010 9:57 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26.2.2010 9:57 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [23.4.2010 16:49 246520]
R2 SamsungAllShare;Samsung AllShare PC Service;c:\program files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe [24.5.2011 13:44 7237024]
R2 TunngleService;TunngleService;d:\tunngle\Tunngle\TnglCtrl.exe [7.8.2011 19:22 741624]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [7.8.2011 19:22 27136]
R3 tenCapture;tenCapture;c:\windows\system32\drivers\tenCapture.sys [21.4.2007 15:15 9344]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S2 Apache2.2;Apache2.2;"d:\php\bin\httpd.exe" -k runservice --> d:\php\bin\httpd.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S2 SimpleSlideShowServer;SimpleSlideShowServer;"c:\program files\Samsung\AllShare\AllShareSlideShowService.exe" --> c:\program files\Samsung\AllShare\AllShareSlideShowService.exe [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [1.7.2011 23:41 76088]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [22.7.2011 22:42 20032]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp --> c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\games\Office 10\Office14\GROOVE.EXE [12.6.2011 10:15 31125880]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [1.7.2011 23:41 181432]
S3 XDva365;XDva365;\??\c:\windows\system32\XDva365.sys --> c:\windows\system32\XDva365.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-26 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-07-26 17:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://tn.cz
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyServer = localhost:3128
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download all by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
IE: Download by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\games\OFFICE~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\games\OFFICE~1\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: kuaiche.com\software
TCP: DhcpNameServer = 10.254.254.254 10.254.254.253
FF - ProfilePath - c:\documents and settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-FlashGet 3 - c:\program files\FlashGet Network\FlashGet 3\FlashGet3.exe
HKCU-Run-PlayNC Launcher - (no file)
HKCU-Run-NexonEULauncher - (no file)
HKCU-Run-Mapík 2011 - c:\documents and settings\Hans\Data aplikací\TNS2011\CVS_11.exe
AddRemove-Android SDK Tools - c:\program files\Android\android-sdk\uninstall.exe
AddRemove-Garena - c:\program files\Garena\uninst.exe
AddRemove-Half-Life Dedicated Server Update Tool - c:\progra~1\VALVE\HLSERVER\UNWISE.EXE
AddRemove-ImTOO Video to Audio Converter - c:\program files\ImTOO\Video to Audio Converter\Uninstall.exe
AddRemove-Steam App 18110 - d:\hry\Steam\steam.exe
AddRemove-Steam App 240 - d:\hry\Steam\steam.exe
AddRemove-Steam App 30 - d:\hry\Steam\steam.exe
AddRemove-Steam App 40 - d:\hry\Steam\steam.exe
AddRemove-Steam App 41300 - d:\hry\Steam\steam.exe
AddRemove-Steam App 42910 - d:\hry\Steam\steam.exe
AddRemove-Steam App 47770 - d:\hry\Steam\steam.exe
AddRemove-Steam App 550 - d:\hry\Steam\steam.exe
AddRemove-Steam App 630 - d:\hry\steam\steam.exe
AddRemove-Steam App 635 - d:\hry\Steam\steam.exe
AddRemove-Steam App 64030 - d:\hry\Steam\steam.exe
AddRemove-Texas Holdem Poker 3D Deluxe Edition DeLEGiON_is1 - d:\poker\Texas Holdem Poker 3D Deluxe Edition DeLEGiON\unins000.exe
AddRemove-Trillian - c:\program files\Trillian\Trillian.exe
AddRemove-Wizard101(UK)_is1 - c:\program files\Wizard101(UK)\unins000.exe
AddRemove-{4560A1FD-9C9B-4D9F-8EEA-A002A44CDEA0}_is1 - c:\documents and settings\Hans\Data aplikací\TNS2011\unins000.exe
AddRemove-{87686C21-8A15-4b4d-A3F1-11141D9BE094} - d:\hry\BFF\uninstaller.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-Facebook Plug-In - c:\documents and settings\Hans\Data aplikací\Facebook\uninstall.exe
AddRemove-GameRanger - c:\documents and settings\Hans\Data aplikací\GameRanger\GameRanger\GameRanger.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-26 13:19
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-854245398-1801674531-1007\Software\SecuROM\License information*]
"datasecu"=hex:58,e0,c7,8c,d4,11,89,af,6f,13,b6,fa,8f,31,c3,1a,ea,64,5b,78,17,
95,52,b0,52,9d,11,1d,01,8f,1e,0c,23,61,a0,fa,cd,59,4d,b6,48,8b,c1,d7,ce,96,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2104)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
e:\games\OFFICE~1\Office14\1029\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2011-11-26 13:23:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-26 12:23
.
Před spuštěním: 3 687 235 584
Po spuštění: 9 436 184 576
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - FEBA625E21CBCE45595EE25E440726D8
-
Rudy
- Site Admin
- Příspěvky: 119510
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Padá internet
To ano, ale co kus, to šmejd. Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:Mazalo mi to celkem dost věcí, měl jsem obavy.
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.KillAll::
Collect::
c:\windows\system32\XDva365.sys
Folder::
c:\program files\ConduitEngine
c:\program files\Ask.com
Driver::
XDva365
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApnUpdater"=-
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Padá internet
Nyní vypadá log takto. Ale obávám se že problém není v PC ale routeru, jelikož jsem kabel int. kabel z routeru přepojil do PC a internet zatím funguje. Takže podle všeho budu muset koupit nový router. Nebo mě vyvedete z omylu?
Re: Padá internet
ComboFix 11-11-26.01 - Hans 27.11.2011 2:11.2.2 - FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2655 [GMT 1:00]
Spuštěný z: c:\documents and settings\Hans\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Hans\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_2e.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\precache.exe
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\Updater\config.xml
c:\program files\Ask.com\Updater\Updater.exe
c:\program files\Ask.com\UpdateTask.exe
c:\program files\ConduitEngine
c:\program files\ConduitEngine\appContextMenu.xml
c:\program files\ConduitEngine\ConduitEngine.dll
c:\program files\ConduitEngine\ConduitEngineHelper.exe
c:\program files\ConduitEngine\ConduitEngineUninstall.exe
c:\program files\ConduitEngine\engineContextMenu.xml
c:\program files\ConduitEngine\EngineSettings.json
c:\program files\ConduitEngine\INSTALL.LOG
c:\program files\ConduitEngine\ldrConduitEngine.dll
c:\program files\ConduitEngine\prxConduitEngine.dll
c:\program files\ConduitEngine\toolbar.cfg
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_XDVA365
-------\Service_XDva365
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-27 do 2011-11-27 )))))))))))))))))))))))))))))))
.
.
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- C:\rsit
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- c:\program files\trend micro
2011-11-26 11:11 . 2011-11-26 11:11 -------- d-----w- C:\FOUND.009
2011-11-26 09:09 . 2011-11-26 09:09 -------- d-----w- C:\FOUND.008
2011-11-26 08:19 . 2011-11-26 08:19 -------- d-----w- c:\documents and settings\Hans\Data aplikací\DivX
2011-11-25 23:48 . 2011-11-25 23:48 -------- d-----w- C:\FOUND.007
2011-11-25 15:02 . 2011-11-25 15:02 -------- d-----w- C:\FOUND.006
2011-11-24 14:38 . 2011-11-24 14:38 -------- d-----w- C:\FOUND.005
2011-11-22 15:21 . 2011-11-22 15:22 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Chromium
2011-11-21 15:53 . 2011-11-21 15:53 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Mozilla
2011-11-17 20:38 . 2011-11-17 20:38 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\SWTOR
2011-11-17 17:06 . 2011-11-17 17:06 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Adobe
2011-11-16 18:25 . 2011-11-16 18:25 -------- d-----w- c:\documents and settings\Hans\Data aplikací\BSplayer
2011-11-15 15:20 . 2011-11-15 15:20 -------- d-----w- C:\FOUND.004
2011-11-12 14:13 . 2011-11-12 14:13 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Alexander_Nikiforov
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\PMB Files
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Data aplikací\QIP
2011-11-04 19:27 . 2011-11-04 19:27 -------- d-----w- c:\documents and settings\Hans\Data aplikací\Might & Magic Heroes VI
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-13 08:46 . 2010-02-25 15:35 98304 ----a-w- c:\windows\DUMP2990.tmp
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2001-10-25 13:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2001-10-25 13:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 10:12 . 2008-04-14 05:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 15:10 . 2008-04-14 04:45 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 14:58 . 2011-09-05 14:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-11-26_12.17.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-27 01:20 . 2011-11-27 01:20 16384 c:\windows\Temp\Perflib_Perfdata_5cc.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-28 17:22 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBit0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP Internet Guardian"="c:\documents and settings\Hans\Data aplikací\QipGuard\QipGuard.exe" [2010-03-29 181760]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-06 39408]
"Skype Call Recorder"="c:\program files\SkypeCallRecorder\SkypeCallRecorder.exe" [2008-12-08 1180160]
"KiesHelper"="d:\kies\Kies\KiesHelper.exe" [2011-08-01 958352]
"KiesTrayAgent"="d:\kies\Kies\KiesTrayAgent.exe" [2011-08-01 3507088]
"KiesPDLR"="d:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-08-01 20880]
"Infium"="c:\program files\QIP 2010\qip.exe" [2010-10-12 5810128]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-09-04 3077528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-01-07 1496968]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"AllShareAgent"="c:\program files\Samsung\AllShare\AllShareAgent.exe" [2011-05-24 250768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\PC\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Tom\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Hans\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Monitor Apache Servers.lnk - e:\apache\Apache2\bin\ApacheMonitor.exe [2005-10-9 41042]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\PnkBstrA.exe"=
"c:\\WINDOWS\\System32\\PnkBstrB.exe"=
"e:\\Games\\Battle forge\\Bootstrapper.exe"=
"e:\\Games\\Battle forge\\BattleForge.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"e:\\Games\\FIfa\\NFE.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"e:\\Games\\Worms\\WA.exe"=
"e:\\Sarcraft\\StarCraft II\\StarCraft II.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\Launcher.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\AOgame.exe"=
"e:\\Games\\Office 10\\Office14\\GROOVE.EXE"=
"e:\\Games\\Office 10\\Office14\\ONENOTE.EXE"=
"e:\\Games\\Office 10\\Office14\\OUTLOOK.EXE"=
"e:\\abb\\Binaries\\Borderlands.exe"=
"e:\\Games\\NFSHP\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.patch.exe"=
"e:\\Games\\NFSHP\\NFS11.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\SkypeCallRecorder\\SkypeCallRecorder.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\Sarcraft\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonUS\\NGM\\NGM.exe"=
"d:\\Hry\\HLSW\\hlsw.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"e:\\Witcher II\\bin\\witcher2.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareAgent.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\WiselinkPro.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\http_ss_win_pro.exe"=
"c:\\Documents and Settings\\Hans\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\WarInc.exe"=
"d:\\Hon\\hon.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\day of defeat\\hl.exe"=
"d:\\Hry\\Heroes\\Heroes In the Sky\\HIS.EXE"=
"d:\\Tunngle\\Tunngle\\tnglctrl.exe"=
"d:\\Tunngle\\Tunngle\\tunngle.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"d:\\Hry\\Stronghold\\Stronghold Crusader\\Stronghold Crusader\\Stronghold Crusader.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spiral knights\\java_vm\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spacechem - demo\\SpaceChem.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\deathmatch classic\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\condition zero\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\world in conflict - demo\\wic.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\DragonAge2Launcher.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\rsupdate.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\w3\\Warcraft III\\Warcraft III\\Warcraft III.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\magicka\\Magicka.exe"=
"c:\\squid\\sbin\\squid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike beta\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\hoard\\win32\\Reuben.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\crysis 2 - demo\\Bin32\\Crysis2Demo.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Games\\HVI\\Might & Magic Heroes VI.exe"=
"e:\\Games\\Star Wars-The Old Republic\\betatest\\retailclient\\swtor.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\solar 2\\Solar2.exe"=
"e:\\Games\\Star Wars-The Old Republic\\launcher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57974:TCP"= 57974:TCP:Pando Media Booster
"57974:UDP"= 57974:UDP:Pando Media Booster
"57727:TCP"= 57727:TCP:Pando Media Booster
"57727:UDP"= 57727:UDP:Pando Media Booster
"57147:TCP"= 57147:TCP:Pando Media Booster
"57147:UDP"= 57147:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.2.2010 16:38 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26.2.2010 9:57 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26.2.2010 9:57 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [23.4.2010 16:49 246520]
R2 SamsungAllShare;Samsung AllShare PC Service;c:\program files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe [24.5.2011 13:44 7237024]
R2 TunngleService;TunngleService;d:\tunngle\Tunngle\TnglCtrl.exe [7.8.2011 19:22 741624]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [7.8.2011 19:22 27136]
R3 tenCapture;tenCapture;c:\windows\system32\drivers\tenCapture.sys [21.4.2007 15:15 9344]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S2 Apache2.2;Apache2.2;"d:\php\bin\httpd.exe" -k runservice --> d:\php\bin\httpd.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S2 SimpleSlideShowServer;SimpleSlideShowServer;"c:\program files\Samsung\AllShare\AllShareSlideShowService.exe" --> c:\program files\Samsung\AllShare\AllShareSlideShowService.exe [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [1.7.2011 23:41 76088]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [22.7.2011 22:42 20032]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp --> c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\games\Office 10\Office14\GROOVE.EXE [12.6.2011 10:15 31125880]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [1.7.2011 23:41 181432]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://tn.cz
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyServer = localhost:3128
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download all by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
IE: Download by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\games\OFFICE~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\games\OFFICE~1\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: kuaiche.com\software
TCP: Interfaces\{B9F188AD-E6F0-4163-8C3B-C874612602AD}: NameServer = 10.254.254.254,10.254.254.253
FF - ProfilePath - c:\documents and settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-conduitEngine - c:\program files\ConduitEngine\ConduitEngineUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-27 02:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-854245398-1801674531-1007\Software\SecuROM\License information*]
"datasecu"=hex:58,e0,c7,8c,d4,11,89,af,6f,13,b6,fa,8f,31,c3,1a,ea,64,5b,78,17,
95,52,b0,52,9d,11,1d,01,8f,1e,0c,23,61,a0,fa,cd,59,4d,b6,48,8b,c1,d7,ce,96,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2464)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
e:\games\OFFICE~1\Office14\1029\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2011-11-27 02:25:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-27 01:25
ComboFix2.txt 2011-11-26 12:23
.
Před spuštěním: 9 201 025 024
Po spuštění: 9 084 370 944
.
- - End Of File - - DB95DDBBD08913C6C16F07B394857553
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2655 [GMT 1:00]
Spuštěný z: c:\documents and settings\Hans\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Hans\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_2e.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\precache.exe
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\Updater\config.xml
c:\program files\Ask.com\Updater\Updater.exe
c:\program files\Ask.com\UpdateTask.exe
c:\program files\ConduitEngine
c:\program files\ConduitEngine\appContextMenu.xml
c:\program files\ConduitEngine\ConduitEngine.dll
c:\program files\ConduitEngine\ConduitEngineHelper.exe
c:\program files\ConduitEngine\ConduitEngineUninstall.exe
c:\program files\ConduitEngine\engineContextMenu.xml
c:\program files\ConduitEngine\EngineSettings.json
c:\program files\ConduitEngine\INSTALL.LOG
c:\program files\ConduitEngine\ldrConduitEngine.dll
c:\program files\ConduitEngine\prxConduitEngine.dll
c:\program files\ConduitEngine\toolbar.cfg
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_XDVA365
-------\Service_XDva365
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-27 do 2011-11-27 )))))))))))))))))))))))))))))))
.
.
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- C:\rsit
2011-11-26 11:31 . 2011-11-26 11:31 -------- d-----w- c:\program files\trend micro
2011-11-26 11:11 . 2011-11-26 11:11 -------- d-----w- C:\FOUND.009
2011-11-26 09:09 . 2011-11-26 09:09 -------- d-----w- C:\FOUND.008
2011-11-26 08:19 . 2011-11-26 08:19 -------- d-----w- c:\documents and settings\Hans\Data aplikací\DivX
2011-11-25 23:48 . 2011-11-25 23:48 -------- d-----w- C:\FOUND.007
2011-11-25 15:02 . 2011-11-25 15:02 -------- d-----w- C:\FOUND.006
2011-11-24 14:38 . 2011-11-24 14:38 -------- d-----w- C:\FOUND.005
2011-11-22 15:21 . 2011-11-22 15:22 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Chromium
2011-11-21 15:53 . 2011-11-21 15:53 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Mozilla
2011-11-17 20:38 . 2011-11-17 20:38 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\SWTOR
2011-11-17 17:06 . 2011-11-17 17:06 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Adobe
2011-11-16 18:25 . 2011-11-16 18:25 -------- d-----w- c:\documents and settings\Hans\Data aplikací\BSplayer
2011-11-15 15:20 . 2011-11-15 15:20 -------- d-----w- C:\FOUND.004
2011-11-12 14:13 . 2011-11-12 14:13 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\Alexander_Nikiforov
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Local Settings\Data aplikací\PMB Files
2011-11-12 14:12 . 2011-11-12 14:12 -------- d-----w- c:\documents and settings\Hans\Data aplikací\QIP
2011-11-04 19:27 . 2011-11-04 19:27 -------- d-----w- c:\documents and settings\Hans\Data aplikací\Might & Magic Heroes VI
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-13 08:46 . 2010-02-25 15:35 98304 ----a-w- c:\windows\DUMP2990.tmp
2011-09-26 10:41 . 2008-07-29 18:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 10:41 . 2001-10-25 13:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 10:41 . 2001-10-25 13:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 10:12 . 2008-04-14 05:51 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 15:10 . 2008-04-14 04:45 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-05 14:58 . 2011-09-05 14:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-05-03 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-11-26_12.17.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-27 01:20 . 2011-11-27 01:20 16384 c:\windows\Temp\Perflib_Perfdata_5cc.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-28 17:22 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBit0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBit0.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QIP Internet Guardian"="c:\documents and settings\Hans\Data aplikací\QipGuard\QipGuard.exe" [2010-03-29 181760]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-06 39408]
"Skype Call Recorder"="c:\program files\SkypeCallRecorder\SkypeCallRecorder.exe" [2008-12-08 1180160]
"KiesHelper"="d:\kies\Kies\KiesHelper.exe" [2011-08-01 958352]
"KiesTrayAgent"="d:\kies\Kies\KiesTrayAgent.exe" [2011-08-01 3507088]
"KiesPDLR"="d:\kies\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-08-01 20880]
"Infium"="c:\program files\QIP 2010\qip.exe" [2010-10-12 5810128]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-09-04 3077528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-01-07 1496968]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
"AllShareAgent"="c:\program files\Samsung\AllShare\AllShareAgent.exe" [2011-05-24 250768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\PC\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Tom\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\Hans\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Monitor Apache Servers.lnk - e:\apache\Apache2\bin\ApacheMonitor.exe [2005-10-9 41042]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\PnkBstrA.exe"=
"c:\\WINDOWS\\System32\\PnkBstrB.exe"=
"e:\\Games\\Battle forge\\Bootstrapper.exe"=
"e:\\Games\\Battle forge\\BattleForge.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"e:\\Games\\FIfa\\NFE.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"e:\\Games\\Worms\\WA.exe"=
"e:\\Sarcraft\\StarCraft II\\StarCraft II.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\Launcher.exe"=
"e:\\Games\\qllods\\Allods Online\\bin\\AOgame.exe"=
"e:\\Games\\Office 10\\Office14\\GROOVE.EXE"=
"e:\\Games\\Office 10\\Office14\\ONENOTE.EXE"=
"e:\\Games\\Office 10\\Office14\\OUTLOOK.EXE"=
"e:\\abb\\Binaries\\Borderlands.exe"=
"e:\\Games\\NFSHP\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\WoW-3.3.5.12340-x86-Win-enGB-BKGND-downloader.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.exe"=
"d:\\Hry\\WoW\\World of Warcraft\\Launcher.patch.exe"=
"e:\\Games\\NFSHP\\NFS11.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\SkypeCallRecorder\\SkypeCallRecorder.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"d:\\Mass Efect 2\\Mass Effect 2\\MassEffect2Launcher.exe"=
"e:\\Sarcraft\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonUS\\NGM\\NGM.exe"=
"d:\\Hry\\HLSW\\hlsw.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"e:\\Witcher II\\bin\\witcher2.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareAgent.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\WiselinkPro.exe"=
"c:\\Program Files\\Samsung\\AllShare\\AllShareDMS\\http_ss_win_pro.exe"=
"c:\\Documents and Settings\\Hans\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\WarInc.exe"=
"d:\\Hon\\hon.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\day of defeat\\hl.exe"=
"d:\\Hry\\Heroes\\Heroes In the Sky\\HIS.EXE"=
"d:\\Tunngle\\Tunngle\\tnglctrl.exe"=
"d:\\Tunngle\\Tunngle\\tunngle.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"d:\\Hry\\Stronghold\\Stronghold Crusader\\Stronghold Crusader\\Stronghold Crusader.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spiral knights\\java_vm\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\spacechem - demo\\SpaceChem.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\deathmatch classic\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\condition zero\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\swarm.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\world in conflict - demo\\wic.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\DragonAge2Launcher.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\dragon age ii demo\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"e:\\Games\\Steam\\SteamApps\\common\\warincbattlezone\\rsupdate.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\w3\\Warcraft III\\Warcraft III\\Warcraft III.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\magicka\\Magicka.exe"=
"c:\\squid\\sbin\\squid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Games\\Steam\\SteamApps\\gandy99\\counter-strike beta\\hl.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\hoard\\win32\\Reuben.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\crysis 2 - demo\\Bin32\\Crysis2Demo.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"e:\\Games\\HVI\\Might & Magic Heroes VI.exe"=
"e:\\Games\\Star Wars-The Old Republic\\betatest\\retailclient\\swtor.exe"=
"e:\\Games\\Steam\\SteamApps\\common\\solar 2\\Solar2.exe"=
"e:\\Games\\Star Wars-The Old Republic\\launcher.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57974:TCP"= 57974:TCP:Pando Media Booster
"57974:UDP"= 57974:UDP:Pando Media Booster
"57727:TCP"= 57727:TCP:Pando Media Booster
"57727:UDP"= 57727:UDP:Pando Media Booster
"57147:TCP"= 57147:TCP:Pando Media Booster
"57147:UDP"= 57147:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.2.2010 16:38 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26.2.2010 9:57 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26.2.2010 9:57 17744]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [23.4.2010 16:49 246520]
R2 SamsungAllShare;Samsung AllShare PC Service;c:\program files\Samsung\AllShare\AllShareDMS\WiselinkPro.exe [24.5.2011 13:44 7237024]
R2 TunngleService;TunngleService;d:\tunngle\Tunngle\TnglCtrl.exe [7.8.2011 19:22 741624]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [7.8.2011 19:22 27136]
R3 tenCapture;tenCapture;c:\windows\system32\drivers\tenCapture.sys [21.4.2007 15:15 9344]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S2 Apache2.2;Apache2.2;"d:\php\bin\httpd.exe" -k runservice --> d:\php\bin\httpd.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S2 SimpleSlideShowServer;SimpleSlideShowServer;"c:\program files\Samsung\AllShare\AllShareSlideShowService.exe" --> c:\program files\Samsung\AllShare\AllShareSlideShowService.exe [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [1.7.2011 23:41 76088]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [22.7.2011 22:42 20032]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp --> c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 20:16 135664]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\games\Office 10\Office14\GROOVE.EXE [12.6.2011 10:15 31125880]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [1.7.2011 23:41 181432]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
2011-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 19:16]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://tn.cz
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Settings,ProxyServer = localhost:3128
uSearchAssistant = hxxp://search.qip.ru/ie
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download all by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
IE: Download by FlashGet3 - c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\games\OFFICE~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\games\OFFICE~1\Office14\ONBttnIE.dll/105
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: kuaiche.com\software
TCP: Interfaces\{B9F188AD-E6F0-4163-8C3B-C874612602AD}: NameServer = 10.254.254.254,10.254.254.253
FF - ProfilePath - c:\documents and settings\Hans\Data aplikací\Mozilla\Firefox\Profiles\1i6e1uq4.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-conduitEngine - c:\program files\ConduitEngine\ConduitEngineUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-27 02:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\PC\LOCALS~1\Temp\KDP186.tmp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-854245398-1801674531-1007\Software\SecuROM\License information*]
"datasecu"=hex:58,e0,c7,8c,d4,11,89,af,6f,13,b6,fa,8f,31,c3,1a,ea,64,5b,78,17,
95,52,b0,52,9d,11,1d,01,8f,1e,0c,23,61,a0,fa,cd,59,4d,b6,48,8b,c1,d7,ce,96,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2464)
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
e:\games\OFFICE~1\Office14\1029\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Samsung\AllShare\AllShareDMS\http_ss_win_pro.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2011-11-27 02:25:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-27 01:25
ComboFix2.txt 2011-11-26 12:23
.
Před spuštěním: 9 201 025 024
Po spuštění: 9 084 370 944
.
- - End Of File - - DB95DDBBD08913C6C16F07B394857553
-
Rudy
- Site Admin
- Příspěvky: 119510
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Padá internet
Asi takto: PC jsme vyčistitli od virů, což je základ pro to, abychom mohli řešit věci další. Zkuste router restartovat. a pak vyzkoušet. Pokud by se to nenapravilo, je problém v něm. Buď hardwarový, nebo chybné nastavení.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?