Babylon Toolbar

[Mc_Murphy]

Stáhni a ulož na Plochu http://jpshortstuff.247fixes.com/SystemLook.exe nebo http://images.malwareremoval.com/jpshor ... emLook.exe

• Dvojklikem na ikonu program spusť.
• Do bílého okénka zkopíruj zelený text z následujícího bílého pole.

Kód: Vybrat vše

:filefind
KMService.*
tuuo.sys

:regfind
KMService
kvke
tuuo.sys

• Klikni na Look, po dokončení skenu na Tebe vyskočí log, zkopíruj mi ho sem.
• Log se také bude nacházet na Ploše, v souboru SystemLook.txt

[martin19822]

SystemLook 30.07.11 by jpshortstuff
Log created at 14:03 on 03/03/2012 by OFFICE
Administrator - Elevation successful

========== filefind ==========

Searching for "KMService.*"
No files found.

Searching for "tuuo.sys"
No files found.

========== regfind ==========

Searching for "KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KMSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KMSERVICE\0000]
"Service"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KMSERVICE\0000]
"DeviceDesc"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KMSERVICE\0000\Control]
"ActiveService"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMService]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMService]
"DisplayName"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMService\Parameters]
"Application"="C:\WINDOWS\KMService.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMService\Enum]
"0"="Root\LEGACY_KMSERVICE\0000"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_KMSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_KMSERVICE\0000]
"Service"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_KMSERVICE\0000]
"DeviceDesc"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\KMService]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\KMService]
"DisplayName"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\KMService\Parameters]
"Application"="C:\WINDOWS\KMService.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KMSERVICE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KMSERVICE\0000]
"Service"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KMSERVICE\0000]
"DeviceDesc"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KMSERVICE\0000\Control]
"ActiveService"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KMService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KMService]
"DisplayName"="KMService"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KMService\Parameters]
"Application"="C:\WINDOWS\KMService.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KMService\Enum]
"0"="Root\LEGACY_KMSERVICE\0000"

Searching for "kvke"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kvke]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\kvke]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kvke]

Searching for "tuuo.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kvke]
"ImagePath"="System32\drivers\tuuo.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\kvke]
"ImagePath"="System32\drivers\tuuo.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kvke]
"ImagePath"="System32\drivers\tuuo.sys"

-= EOF =-

[Mc_Murphy]

OK, takže aplikuj ještě jeden script pro OTM

Kód: Vybrat vše

:Commands
[EmptyTemp]

:Services
KMService
kvke

:Files
C:\WINDOWS\KMService.exe
tuuo.sys /s
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

[martin19822]

Babylon sa mi stale otvara vo vsetkych prehliadacoch..

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: OFFICE
->Temp folder emptied: 145728 bytes
->Temporary Internet Files folder emptied: 65536 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 27426773 bytes
->Google Chrome cache emptied: 110927536 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 721 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 505 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 18342 bytes

Total Files Cleaned = 132,00 mb

========== SERVICES/DRIVERS ==========
Service KMService stopped successfully!
Service KMService deleted successfully!
Service kvke stopped successfully!
Service kvke deleted successfully!
========== FILES ==========
File/Folder C:\WINDOWS\KMService.exe not found.
File/Folder tuuo.sys not found.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.

OTM by OldTimer - Version 3.1.19.0 log created on 03032012_160515

Files moved on Reboot...

Registry entries deleted on Reboot...

[Mc_Murphy]

Kua, chlape, Ty mi dáváš...

Poprosím tedy ještě o jeden scan SystemLookem:

Kód: Vybrat vše

:regfind
babylon

:filefind
*babylon.*

:folderfind
*babylon*

Postup stejný, jako předtím.

[martin19822]

Error: Unable to interpret <:regfind> in the current context!
Error: Unable to interpret <babylon> in the current context!
Error: Unable to interpret <:filefind> in the current context!
Error: Unable to interpret <*babylon.*> in the current context!
Error: Unable to interpret <:folderfind> in the current context!
Error: Unable to interpret <*babylon*> in the current context!

OTM by OldTimer - Version 3.1.19.0 log created on 03032012_164913

[martin19822]

sorry , dal som ti sem zly LOG. Uz pracujem na spravnom

[martin19822]

SystemLook 30.07.11 by jpshortstuff
Log created at 17:00 on 03/03/2012 by OFFICE
Administrator - Elevation successful

========== regfind ==========

Searching for "babylon"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
"DisplayName"="Search the web (Babylon)"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
"URL"="http://search.babylon.com/?q={searchTer ... 10dc39f1cf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Babylon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Babylon\Babylon Client]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar]
[HKEY_USERS\S-1-5-21-1202660629-413027322-1606980848-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
"DisplayName"="Search the web (Babylon)"
[HKEY_USERS\S-1-5-21-1202660629-413027322-1606980848-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
"URL"="http://search.babylon.com/?q={searchTer ... 10dc39f1cf"

========== filefind ==========

Searching for "*babylon.*"
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon\Setup\Babylon.dat --a---- 11205 bytes [17:53 29/02/2012] [14:06 27/12/2011] 8E6B33A7F03E2693A614002587A35DDD

========== folderfind ==========

Searching for "*babylon*"
C:\Documents and Settings\All Users\Application Data\Babylon d------ [17:53 29/02/2012]
C:\Documents and Settings\OFFICE\Application Data\Babylon d------ [17:53 29/02/2012]
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon d------ [17:53 29/02/2012]

-= EOF =-

[Mc_Murphy]

Hodil jsi script pro SystemLook do OTM. Stane se, v pohodě.

Tak si dáme ještě jeden script pro OTM a snad již bude hotovo.

Kód: Vybrat vše

:Commands
[EmptyTemp]

:Files
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon
C:\Documents and Settings\All Users\Application Data\Babylon
C:\Documents and Settings\OFFICE\Application Data\Babylon

:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Babylon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar]
[-HKEY_USERS\S-1-5-21-1202660629-413027322-1606980848-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]

[martin19822]

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: OFFICE
->Temp folder emptied: 532584 bytes
->Temporary Internet Files folder emptied: 55307 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 10858884 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 343 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 11,00 mb

========== FILES ==========
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon\Setup\HtmlScreens folder moved successfully.
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon\Setup folder moved successfully.
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Babylon folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Babylon folder moved successfully.
C:\Documents and Settings\OFFICE\Application Data\Babylon folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Babylon\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1202660629-413027322-1606980848-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

OTM by OldTimer - Version 3.1.19.0 log created

[Mc_Murphy]

Tak co, jak se chová PC a co prohlížeče?

[martin19822]

PC je mierne spomalene, neviem co sa mohlo stat
a prehliadace vyzeraju byt v pohode. Medzicasom som naistaloval Avast

[Mc_Murphy]

OK, hoď mi sem tedy aktuální log ze RSITu a já mrknu, jestli tam ještě něco nevisí.

[martin19822]

Logfile of random's system information tool 1.09 (written by random/random)
Run by OFFICE at 2012-03-03 18:49:12
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 9 GB (50%) free of 18 GB
Total RAM: 1503 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:49:27, on 3.3.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LGScsiCommandService.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\OFFICE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\OFFICE\Desktop\RSIT.exe
C:\Program Files\trend micro\OFFICE.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cas.sk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: LG SCSI command service (LGScsiCommandService) - Mobile Leader Co.,Ltd. - C:\WINDOWS\system32\LGScsiCommandService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 4591 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-02-23 998560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-11-10 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-02-23 998560]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-02-23 4031368]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-11 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"D:\Programy instalacie\Winamp\winamp.exe"="D:\Programy instalacie\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Programy instalacie\opera.exe"="D:\Programy instalacie\opera.exe:*:Enabled:Opera Internet Browser"
"D:\Programy instalacie\VLC\vlc.exe"="D:\Programy instalacie\VLC\vlc.exe:*:Enabled:VLC media player"
"D:\Programy instalacie\CorelDRAW Graphics Suite X5\Programs\CorelDRW.exe"="D:\Programy instalacie\CorelDRAW Graphics Suite X5\Programs\CorelDRW.exe:*:Enabled:CorelDRAW(R)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-03-03 18:49:13 ----D---- C:\Program Files\trend micro
2012-03-03 18:49:12 ----D---- C:\rsit
2012-03-03 18:06:08 ----D---- C:\_OTM
2012-03-03 17:59:03 ----A---- C:\Program Files\avast! Free Antivirus.lnk
2012-03-03 17:59:02 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-03-03 17:59:01 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-03-03 17:58:57 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-03-03 17:58:56 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-03-03 17:58:55 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-03-03 17:58:54 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-03-03 17:58:54 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-03-03 17:58:53 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-03-03 17:57:32 ----A---- C:\WINDOWS\avastSS.scr
2012-03-03 17:57:30 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-03-03 17:56:18 ----D---- C:\Program Files\AVAST Software
2012-03-03 17:47:42 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2012-02-29 18:30:08 ----D---- C:\Documents and Settings\All Users\Application Data\ReaConverter
2012-02-29 18:29:42 ----D---- C:\Documents and Settings\OFFICE\Application Data\RCP 6
2012-02-27 15:21:38 ----D---- C:\AppleStyle.sk
2012-02-20 11:13:58 ----D---- C:\superzima.sk
2012-02-19 18:35:36 ----HD---- C:\WINDOWS\PIF
2012-02-19 18:32:29 ----D---- C:\eShopy Group.com
2012-02-19 15:39:11 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2012-02-16 07:58:54 ----N---- C:\WINDOWS\system32\iacenc.dll
2012-02-15 08:21:21 ----D---- C:\WINDOWS\Minidump
2012-02-10 15:14:23 ----D---- C:\Program Files\Common Files\Java
2012-02-10 15:13:08 ----A---- C:\WINDOWS\system32\javaws.exe
2012-02-10 15:13:08 ----A---- C:\WINDOWS\system32\javaw.exe
2012-02-10 15:13:08 ----A---- C:\WINDOWS\system32\java.exe
2012-02-05 15:22:31 ----D---- C:\Program Files\OpenOffice.org 3
2012-02-05 15:19:44 ----D---- C:\Program Files\OpenOffice.org 3.2 (sk) Installation Files
2012-02-04 13:19:06 ----D---- C:\Program Files\Common Files\Protexis
2012-02-04 11:55:16 ----D---- C:\Program Files\Common Files\Corel

======List of files/folders modified in the last 1 month======

2012-03-03 18:49:19 ----D---- C:\WINDOWS\Prefetch
2012-03-03 18:49:13 ----RD---- C:\Program Files
2012-03-03 18:18:13 ----D---- C:\WINDOWS\Temp
2012-03-03 18:07:44 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-03-03 17:59:02 ----D---- C:\WINDOWS\system32\drivers
2012-03-03 17:58:25 ----SHD---- C:\WINDOWS\Installer
2012-03-03 17:58:21 ----SHD---- C:\Config.Msi
2012-03-03 17:58:20 ----D---- C:\WINDOWS\WinSxS
2012-03-03 17:57:32 ----D---- C:\WINDOWS
2012-03-03 17:57:30 ----D---- C:\WINDOWS\system32
2012-03-03 17:56:18 ----D---- C:\Documents and Settings\All Users\Application Data\AVAST Software
2012-03-03 17:46:25 ----D---- C:\Documents and Settings\OFFICE\Application Data\Winamp
2012-03-03 16:26:18 ----D---- C:\Documents and Settings\OFFICE\Application Data\Mozilla
2012-03-03 16:25:50 ----SD---- C:\WINDOWS\Tasks
2012-03-03 16:25:07 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-03-03 16:25:06 ----HD---- C:\WINDOWS\inf
2012-03-03 16:25:02 ----D---- C:\WINDOWS\system32\CatRoot2
2012-03-03 16:25:00 ----D---- C:\Program Files\Common Files
2012-03-03 11:00:29 ----D---- C:\Program Files\The KMPlayer
2012-03-01 16:44:12 ----SHD---- C:\System Volume Information
2012-03-01 16:44:12 ----D---- C:\WINDOWS\system32\Restore
2012-03-01 16:43:49 ----D---- C:\WINDOWS\system32\drivers\etc
2012-03-01 12:02:04 ----D---- C:\Documents and Settings\OFFICE\Application Data\SoftGrid Client
2012-03-01 09:39:00 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-02-29 19:44:26 ----D---- C:\Documents and Settings\OFFICE\Application Data\Skype
2012-02-29 19:05:33 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2012-02-28 20:10:04 ----D---- C:\Documents and Settings\OFFICE\Application Data\TP
2012-02-28 20:07:31 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-02-26 15:28:50 ----RSD---- C:\WINDOWS\Fonts
2012-02-20 19:14:26 ----D---- C:\WINDOWS\SoftwareDistribution
2012-02-19 18:35:49 ----D---- C:\Moj prvy WEB
2012-02-19 15:51:38 ----D---- C:\Documents and Settings\OFFICE\Application Data\Apple Computer
2012-02-16 16:43:45 ----D---- C:\WINDOWS\Microsoft.NET
2012-02-16 16:43:35 ----RSD---- C:\WINDOWS\assembly
2012-02-16 12:50:46 ----D---- C:\WINDOWS\Debug
2012-02-16 09:04:55 ----A---- C:\WINDOWS\system32\MRT.exe
2012-02-16 09:04:30 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-02-16 09:03:58 ----D---- C:\Program Files\Internet Explorer
2012-02-16 09:03:21 ----HD---- C:\WINDOWS\$hf_mig$
2012-02-10 16:18:16 ----D---- C:\Documents and Settings\OFFICE\Application Data\Opera
2012-02-10 15:13:01 ----D---- C:\Program Files\Java
2012-02-06 08:37:07 ----D---- C:\WINDOWS\system32\CatRoot
2012-02-05 12:56:19 ----D---- C:\Program Files\MSBuild
2012-02-05 12:54:43 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2012-02-05 12:51:08 ----D---- C:\Program Files\Common Files\System
2012-02-05 12:51:07 ----A---- C:\WINDOWS\win.ini
2012-02-04 14:08:34 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2012-02-04 13:19:05 ----D---- C:\Documents and Settings\All Users\Application Data\Corel
2012-02-04 11:20:27 ----D---- C:\Documents and Settings\OFFICE\Application Data\Corel

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;NEC FireWarden OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2011-03-04 45648]
R0 sisagp;SiS AGP Filter; C:\WINDOWS\system32\DRIVERS\SISAGPX.sys [2003-01-13 30720]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-02-23 24920]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-02-23 35672]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-02-23 610648]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-02-23 337112]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-02-23 53848]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2003-10-03 11264]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-02-23 20696]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-02-23 95704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2004-01-07 432384]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S2 Scutum50;Scutum50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\Scutum50.sys []
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys []
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys []
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys []
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys []
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-02-23 44768]
R2 LGScsiCommandService;LG SCSI command service; C:\WINDOWS\system32\LGScsiCommandService.exe [2010-04-12 47616]
R2 PSI_SVC_2;Protexis Licensing V2; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2009-07-24 189728]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS\system32\spupdsvc.exe [2009-01-07 26144]
S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Mc_Murphy]

Další script pro OTM:

Kód: Vybrat vše

:Commands
[EmptyTemp]

:Files
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}"=-

Ale to jsou opravdu jen drobnosti, jinak tam už nic nevidím.

Nemáš na Ploše příliš veliké soubory - filmy, MP3, instalace atd.? Velikost Plochy by neměla přesáhnout 300 MB, jinak se bude systém zpomalovat.
Provádíš jednou za čas defragmentaci disků? Pokud ne, doporučím Ti na to na konci dobrý prográmek, až dočistíme po utilitách, které jsme použili.