Nelze zobrazit stránky microsoftu a antivirových společností

[msa]

Zdravím, mám 2 PC ani na jednom se nedostanu na jakoukoliv stránku microsoftu a na žádný web společnosti vyvíjející antivir, anti-malware, atp. I tak jsem tale dotlačil Malwarebytes Anti-Malware, která našel na obou "PUM.Hijack.System.Hidden".

Log z PC (logy jsou identické)

Kód: Vybrat vše

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.61.0.1400
www.malwarebytes.org

Verze databáze: v2012.05.25.02

Windows Server 2003 Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: SERVER-NOVOB [administrátor]

Ochrana: Povolena

25.5.2012 10:22:07
mbam-log-2012-05-25 (10-22-07).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 178411
Uplynulý čas: 1 minut, 41 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL|CheckedValue (PUM.Hijack.System.Hidden) -> Špatný: (0) Dobrý: (1) -> Umístnění do karantény a opravení se zdařilo.

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

Odstranil jsem havěť z obou strojů, ale problémy přetrvávají. Co teď? Díky za rady

[stell]

Zdravim
Msa, nedavaj log subory do code ,
dakujem.

1:vloz sem log z FRST, spust a stlac scan.
http://download.bleepingcomputer.com/farbar/FRST.exe

[msa]

Tak tady to je
Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 25-05-2012 02
Ran by Administrator at 25-05-2012 13:48:18
Running from C:\Documents and Settings\Administrator\Dokumenty\Downloads
Service Pack 2 (X86) OS Language: Czech
Attention: Could not load system hive.Chyba: Proces nem  pýˇstup k souboru, neboś jej pr vŘ vyu§ˇv  jině proces.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.

========================== Registry (Whitelisted) =============

HKU\Default User\...\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE [15360 2007-02-17] (Microsoft Corporation)
HKLM\...\Winlogon: [Userinit] [x]
HKLM\...\Winlogon: [Shell]

================================ Services (Whitelisted) ==================


========================== Drivers (Whitelisted) =============


========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-05-25 13:48 - 2012-05-25 13:48 - 0000000 ____D C:\FRST
2012-05-25 09:43 - 2012-05-25 09:43 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-05-25 09:43 - 2012-04-04 15:56 - 0022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-05-25 09:09 - 2012-05-25 09:09 - 0004797 ____A C:\Windows\KB943729.log
2012-05-25 09:09 - 2012-05-25 09:09 - 0000000 __HDC C:\Windows\$NtUninstallKB943729$
2012-05-23 09:13 - 2012-05-23 09:13 - 0000000 ____D C:\Program Files\PSPad editor
2012-05-23 09:04 - 2012-05-23 09:04 - 0000000 ____D C:\Program Files\WinRAR
2012-05-22 14:12 - 2012-05-22 14:12 - 0000000 ____D C:\Windows\System32\appmgmt
2012-05-22 08:45 - 2012-05-22 08:45 - 0000664 ____A C:\Windows\System32\d3d9caps.dat
2012-05-22 08:40 - 2012-05-25 13:45 - 0001058 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500UA.job
2012-05-22 08:40 - 2012-05-23 08:45 - 0001006 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500Core.job


============ 3 Months Modified Files and Folders ===============

2012-05-25 13:48 - 2012-05-25 13:48 - 0000000 ____D C:\FRST
2012-05-25 13:45 - 2012-05-22 08:40 - 0001058 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500UA.job
2012-05-25 13:13 - 2010-07-13 16:40 - 0002345 ____A C:\Windows\System32\config\netlogon.dns
2012-05-25 13:13 - 2010-07-13 16:40 - 0002272 ____A C:\Windows\System32\config\netlogon.dnb
2012-05-25 13:13 - 2010-04-19 13:15 - 0746339 ____A C:\Windows\setupapi.log
2012-05-25 12:56 - 2010-04-19 13:11 - 0000000 ____D C:\Windows\System32\dhcp
2012-05-25 12:00 - 2010-04-19 13:17 - 1227768 ____A C:\Windows\System32\PerfStringBackup.INI
2012-05-25 12:00 - 2010-04-19 12:43 - 0000062 __ASH C:\Documents and Settings\Administrator\Local Settings\desktop.ini
2012-05-25 11:55 - 2010-04-19 12:17 - 0000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2012-05-25 11:55 - 2010-04-19 12:17 - 0000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2012-05-25 11:55 - 2010-04-19 12:17 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-05-25 11:55 - 2008-07-31 00:17 - 0047604 ____A C:\Windows\System32\ativvaxx.cap
2012-05-25 11:53 - 2010-07-13 16:30 - 0131072 ____A C:\Windows\System32\config\NTDS.Evt
2012-05-25 11:53 - 2010-07-13 16:30 - 0065536 ____A C:\Windows\System32\config\NtFrs.Evt
2012-05-25 11:53 - 2010-06-25 16:27 - 0065536 ____A C:\Windows\System32\config\DnsEvent.Evt
2012-05-25 11:53 - 2010-04-30 15:07 - 0262144 ____A C:\Windows\System32\config\ACEEvent.evt
2012-05-25 11:53 - 2010-04-19 12:43 - 0000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2012-05-25 11:53 - 2010-04-19 12:13 - 1814418 ____A C:\Windows\WindowsUpdate.log
2012-05-25 11:29 - 2010-07-13 16:39 - 0065536 ____A C:\Windows\NETLOGON.CHG
2012-05-25 09:43 - 2012-05-25 09:43 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-05-25 09:43 - 2010-04-19 13:17 - 0000000 ___RD C:\Documents and Settings\All Users\Plocha
2012-05-25 09:43 - 2010-04-19 13:15 - 0000000 __RHD C:\Documents and Settings\All Users\Data aplikací
2012-05-25 09:43 - 2010-04-19 12:43 - 0000000 __RHD C:\Documents and Settings\Administrator\Data aplikací
2012-05-25 09:09 - 2012-05-25 09:09 - 0004797 ____A C:\Windows\KB943729.log
2012-05-25 09:09 - 2012-05-25 09:09 - 0000000 __HDC C:\Windows\$NtUninstallKB943729$
2012-05-25 09:09 - 2010-04-19 13:54 - 0436392 ____A C:\Windows\nfsocm.log
2012-05-25 09:09 - 2010-04-19 13:54 - 0346235 ____A C:\Windows\netfx20.log
2012-05-25 09:09 - 2010-04-19 13:54 - 0185081 ____A C:\Windows\sfuocgen.log
2012-05-25 09:09 - 2010-04-19 13:54 - 0051414 ____A C:\Windows\AdfsOcm.log
2012-05-25 09:09 - 2010-04-19 13:54 - 0047902 ____A C:\Windows\ocwss.log
2012-05-25 09:09 - 2010-04-19 13:17 - 1358497 ____A C:\Windows\ocgen.log
2012-05-25 09:09 - 2010-04-19 13:17 - 1339688 ____A C:\Windows\iis6.log
2012-05-25 09:09 - 2010-04-19 13:17 - 1323563 ____A C:\Windows\FaxSetup.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0610742 ____A C:\Windows\uddisetup.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0561141 ____A C:\Windows\tsoc.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0547496 ____A C:\Windows\msmqinst.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0375526 ____A C:\Windows\comsetup.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0243973 ____A C:\Windows\certocm.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0237675 ____A C:\Windows\ntdtcsetup.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0219058 ____A C:\Windows\netfxocm.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0184611 ____A C:\Windows\aspnetocm.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0104699 ____A C:\Windows\LicenOc.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0060082 ____A C:\Windows\pop3oc.log
2012-05-25 09:09 - 2010-04-19 13:17 - 0003423 ____A C:\Windows\imsins.log
2012-05-25 09:09 - 2010-04-19 12:43 - 0000000 ____D C:\Documents and Settings\Administrator\Plocha
2012-05-25 08:53 - 2010-04-19 13:11 - 0000000 ____D C:\Windows\security
2012-05-24 09:36 - 2006-04-14 14:00 - 0002206 ____A C:\Windows\System32\wpa.dbl
2012-05-23 09:13 - 2012-05-23 09:13 - 0000000 ____D C:\Program Files\PSPad editor
2012-05-23 09:12 - 2010-07-02 11:23 - 0000000 ____D C:\Instal
2012-05-23 09:04 - 2012-05-23 09:04 - 0000000 ____D C:\Program Files\WinRAR
2012-05-23 08:57 - 2010-04-19 12:43 - 0000000 ___RD C:\Documents and Settings\Administrator\Dokumenty
2012-05-23 08:45 - 2012-05-22 08:40 - 0001006 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500Core.job
2012-05-23 08:33 - 2010-04-19 12:17 - 0002910 ____A C:\Windows\PFRO.log
2012-05-22 14:12 - 2012-05-22 14:12 - 0000000 ____D C:\Windows\System32\appmgmt
2012-05-22 08:45 - 2012-05-22 08:45 - 0000664 ____A C:\Windows\System32\d3d9caps.dat
2012-05-22 08:40 - 2010-04-19 12:43 - 0000000 ___HD C:\Documents and Settings\Administrator\Local Settings\Data aplikací
2012-05-21 13:37 - 2010-04-29 09:00 - 0001351 ____A C:\Windows\WINCMD.INI
2012-05-21 12:41 - 2010-07-13 16:40 - 0002412 _RASH C:\Documents and Settings\All Users\ntuser.pol
2012-05-21 08:57 - 2010-04-19 13:17 - 0004505 ____A C:\Windows\imsins.BAK
2012-04-04 15:56 - 2012-05-25 09:43 - 0022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe
[2010-04-29 10:15] - [2007-02-17 17:47] - 1054208 ____A (Microsoft Corporation) 8a981a02dcaeaf5cdccbb23924322b19

C:\Windows\System32\winlogon.exe
[2010-04-29 10:15] - [2007-02-17 17:48] - 0528384 ____A (Microsoft Corporation) 06b5c31d008facd5b33c5ef7c1ae4de0

C:\Windows\System32\svchost.exe
[2010-04-29 10:15] - [2007-02-17 17:48] - 0014848 ____A (Microsoft Corporation) 979d1325d4a7e827638991d3cddb497a

C:\Windows\System32\User32.dll
[2010-04-29 09:06] - [2008-07-29 10:21] - 0584192 ____A (Microsoft Corporation) 57295300a768f36d8bdaf0b5830fb6d0

C:\Windows\System32\userinit.exe
[2006-04-14 14:00] - [2007-02-17 17:48] - 0026112 ____A (Microsoft Corporation) 65ded424f5f46cf4073d656ac853ce3c

C:\Windows\System32\Drivers\volsnap.sys
[2006-04-14 14:00] - [2007-02-17 16:59] - 0153600 ____A (Microsoft Corporation) f2f21e9a8f3664aacf466c4f0e6c7615


==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!

========================= Memory info ======================

Percentage of memory in use: 17%
Total physical RAM: 4094.77 MB
Available physical RAM: 3370.62 MB
Total Pagefile: 5973.48 MB
Available Pagefile: 5264.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1994.92 MB

======================= Partitions =========================

2 Drive c: (System) (Fixed) (Total:10 GB) (Free:2.44 GB) NTFS
3 Drive d: (Data1) (Fixed) (Total:698.64 GB) (Free:698.51 GB) NTFS
4 Drive e: (Data2) (Fixed) (Total:688.63 GB) (Free:687.79 GB) NTFS

Disk ### Stav Velikost Voln‚ Dyn Gpt
-------- ---------- -------- ------- --- ---
Disk 0 Online 699 GB 0 B
Disk 1 Online 699 GB 0 B

Probˇh  ukonźenˇ programu DiskPart...

Partitions of Disk 0:
===============

Nynˇ je vybr n disk 0.

Oddˇl ### Typ Velikost Posunutˇ
--------- --------------- -------- --------
Oddˇl 1 Prim rnˇ 10 GB 32 KB
Oddˇl 2 Rozçˇýeně 689 GB 10 GB
Oddˇl 3 Logickě 689 GB 10 GB

Probˇh  ukonźenˇ programu DiskPart...

======================================================================================================

Partitions of Disk 1:
===============

Nynˇ je vybr n disk 1.

Oddˇl ### Typ Velikost Posunutˇ
--------- --------------- -------- --------
Oddˇl 1 Prim rnˇ 699 GB 32 KB

Probˇh  ukonźenˇ programu DiskPart...

======================================================================================================
======================= End Of Log ==========================

[stell]

Typ: Rychlá kontrola
ok, zatial nevidim nic, pokracuj Malwarebytes, ale teraz nastav na Uplny sken, Log subor vloz sem

[msa]

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.61.0.1400
www.malwarebytes.org

Verze databáze: v2012.05.27.06

Windows Server 2003 Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: SERVER-NOVOB [administrátor]

Ochrana: Zakázána

28.5.2012 13:11:51
mbam-log-2012-05-28 (14-21-05).txt

Typ: Úplná kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 203426
Uplynulý čas: 59 minut, 24 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL|CheckedValue (PUM.Hijack.System.Hidden) -> Špatný: (0) Dobrý: (1) -> Žádná instrukce nebyla provedena.

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)


------
koukám, že tam pořád je i přes to, že jsem ho již předtím odstranil

[stell]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL (PUM.Hijack.System.Hidden) -> Špatný: (0) Dobrý: (1) -> Žádná instrukce nebyla provedena.

1:Otvor regedit a preklikaj sa tam ako je kluc.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
a na pravej strane zmen hodnotu 0 na 1,..
Pretoze tento kluc Skryva zlozky so skrytymi atributy.

2: spust TDSSKILLER a log vloz sem
NAVOD

[msa]

No dobře, ale jakou z těch hodnot? DefaultValue? Tam je "2".. a CheckValue je na "1"..

[stell]

CheckedValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL|CheckedValue

Ale ak je tam hodnota 1, potom ok, ale vsimni si ci si na spravnom mieste,HKEY_LOCAL_MACHINE

Potom pravy klik na zlozku SHOWALL, >.export, a skopiruj obsah exportu sem.

Vloz sem ten log z TDSSKILLER.

[msa]

Tak jsem se s tou hodnotou sekl... opraveno

Název klíče: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Název třídy: <BEZ TŘÍDY>
Čas posledního zápisu: 29.5.2012 - 13:16
Hodnota 0
Název: RegPath
Typ: REG_SZ
Údaje: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Hodnota 1
Název: Text
Typ: REG_SZ
Údaje: @shell32.dll,-30500

Hodnota 2
Název: Type
Typ: REG_SZ
Údaje: radio

Hodnota 3
Název: CheckedValue
Typ: REG_DWORD
Údaje: 0x1

Hodnota 4
Název: ValueName
Typ: REG_SZ
Údaje: Hidden

Hodnota 5
Název: DefaultValue
Typ: REG_DWORD
Údaje: 0x2

Hodnota 6
Název: HKeyRoot
Typ: REG_DWORD
Údaje: 0x80000001

Hodnota 7
Název: HelpID
Typ: REG_SZ
Údaje: shell.hlp#51105




----------
TDSSKILLER jsem stáhl (na jiném pc), ale tady ho za boha nemůžu pustit... Prý srpávná inicializace aplikace se nezdařila.

[stell]

TDSSKILLER skopiruj na C:\>.restart do nudzoveho rezimu a skus spustit.
stlac klaves Winlogo+R a vloz tento prikaz:
%comspec% /c ipconfig /all > c:\ipconfig.txt
Enter, c:\ipconfig.txt>.obsah vloz sem

[msa]

ipconfig zde...; TDSSKILLER mi nešel ani v nouzáku

Konfigurace protokolu IP systému Windows



Název hostitele . . . . . . . . . : server-novob

Primární přípona DNS. . . . . . . : novoborska.cz

Typ uzlu . . . . . . . . . . . . : neznámý

Povoleno směrování IP . . . . . . : Ne

WINS Proxy povoleno . . . . . . . : Ne

Prohledávací seznam přípon DNS. . : novoborska.cz



Adaptér sítě Ethernet Připojení k místní síti:



Přípona DNS podle připojení . . . :

Popis . . . . . . . . . . . . . . : Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller

Fyzická Adresa. . . . . . . . . . : 00-22-15-4B-4D-C2

Protokol DHCP povolen . . . . . . : Ne

Adresa IP . . . . . . . . . . . . : 192.168.13.5

Maska podsítě . . . . . . . . . . : 255.255.255.0

Výchozí brána . . . . . . . . . . : 192.168.13.254

Servery DNS . . . . . . . . . . . : 8.8.8.8

8.8.4.4

[stell]

Protokol DHCP povolen . . . . . . : Ne

DNS servery su OK, mas tam Google servery nastavene.
takze ty mas pevnu IP?/pretoze DHCP nie je povolene,

Jestliže nepoužíváte pevnou IP adresu, proxy atd., v sekci Start - Nastavení - Ovládací panely - Síťová připojení - Připojení k místní síti - Vlastnosti - Protokol sítě Internet (TCP/IP) - Vlastnosti zvolíme Získat adresu IP ze serveru DHCP automaticky . V opačném případě zadáme do volných řádků nastavení od poskytovatele internetu.

Vloz sem log z OTL:
Stáhněte OTL
http://oldtimer.geekstogo.com/OTL.exe
na plochu.
Spusťte, poté do spodního políčka vložte následující skript.
Označte položku Pro všechny uživatele.
Označte položky Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Klikněte na tlačítko Prohledat
Po dokončení, sem vložte logy OTL.Txt a Extras.txt

Kód: Vybrat vše

netsvcs
drivers32
savembr:0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
%systemroot%\system32\drivers\*.sys /5
%systemroot%\system32\drivers\*.sys /X
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\*.* /5
%systemroot%\system32\*.dll /lockedfiles
%ALLUSERSPROFILE%\Dáta aplikácií\*.*
%ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s
%APPDATA%\*.
%APPDATA%\*.*
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe

[msa]

OTL
----
OTL logfile created on: 31.5.2012 10:22:17 - Run 1
OTL by OldTimer - Version 3.2.44.0 Folder = C:\Documents and Settings\Administrator\Plocha
Windows Server 2003 Server 2003 R2 Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

4,00 Gb Total Physical Memory | 3,14 Gb Available Physical Memory | 78,62% Memory free
5,83 Gb Paging File | 4,97 Gb Available in Paging File | 85,14% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 10,00 Gb Total Space | 2,12 Gb Free Space | 21,17% Space Free | Partition Type: NTFS
Drive D: | 698,64 Gb Total Space | 698,52 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive E: | 688,63 Gb Total Space | 687,79 Gb Free Space | 99,88% Space Free | Partition Type: NTFS

Computer Name: SERVER-NOVOB | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.05.31 10:21:07 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
PRC - [2012.05.23 03:56:51 | 001,240,088 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.04.15 11:43:20 | 007,797,112 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer.exe
PRC - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2009.02.17 10:19:33 | 000,449,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dns.exe
PRC - [2007.02.17 17:47:59 | 000,792,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntfrs.exe
PRC - [2007.02.17 17:47:47 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ismserv.exe
PRC - [2007.02.17 17:47:44 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.17 17:47:40 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dfssvc.exe
PRC - [2007.02.17 17:47:36 | 000,392,704 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe


========== Modules (No Company Name) ==========

MOD - [2012.05.23 03:56:50 | 000,441,880 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\19.0.1084.52\ppgooglenaclpluginchrome.dll
MOD - [2012.05.23 03:56:49 | 003,922,456 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\19.0.1084.52\pdf.dll
MOD - [2012.05.23 03:55:24 | 000,134,696 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\19.0.1084.52\avutil-51.dll
MOD - [2012.05.23 03:55:23 | 000,250,408 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\19.0.1084.52\avformat-54.dll
MOD - [2012.05.23 03:55:21 | 002,375,720 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\Application\19.0.1084.52\avcodec-54.dll
MOD - [2012.05.22 09:51:16 | 004,050,944 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\SwiftShader\1.0.0.2\libGLESv2.dll
MOD - [2012.05.22 09:51:16 | 000,100,864 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\SwiftShader\1.0.0.2\libEGL.dll
MOD - [2010.10.25 16:07:45 | 011,800,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\41f436dae3c8146752d06130f7331527\System.Web.ni.dll
MOD - [2010.10.25 16:03:56 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010.10.25 15:57:41 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\ab688d0f9f333ba117832726bfb589c1\System.Configuration.ni.dll
MOD - [2010.10.25 15:56:30 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\5ffa548547613dbc5a92f2c5b7cad196\Accessibility.ni.dll
MOD - [2010.10.25 15:55:03 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\a6dbe24cbfe3ab6b318ed3095cc572d8\System.Xml.ni.dll
MOD - [2010.10.25 15:54:50 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\439c466b60614915587c5273eaf0ca7f\System.Windows.Forms.ni.dll
MOD - [2010.10.25 15:54:30 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\dcc0244092fe52e6885b50be25ef3b31\System.Drawing.ni.dll
MOD - [2010.10.25 15:52:24 | 007,949,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\08ffa4d388d5f007869aa7651c458e7c\System.ni.dll
MOD - [2010.10.25 15:52:00 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\7bffd7ff2009f421fe5d229927588496\mscorlib.ni.dll
MOD - [2010.06.25 15:49:03 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_cs_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2010.06.25 15:49:00 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_cs_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.04.29 11:17:57 | 001,691,648 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3142.27162__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2010.04.29 11:17:57 | 000,483,328 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3142.27360__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2010.04.29 11:17:57 | 000,266,240 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3142.27118__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2010.04.29 11:17:57 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3142.27165__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2010.04.29 11:17:57 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3142.27155__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2010.04.29 11:17:57 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3142.27140__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2010.04.29 11:17:51 | 000,135,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3142.27362__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2010.04.29 11:17:51 | 000,090,112 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3142.27296__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2010.04.29 11:17:51 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3142.27133__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2010.04.29 11:17:49 | 000,438,272 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3142.27142__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2010.04.29 11:17:49 | 000,225,280 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3142.27166__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2010.04.29 11:17:48 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3119.30067__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2010.04.29 11:17:48 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3119.30096__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3119.30148__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2010.04.29 11:17:48 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3119.30169__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3119.30063__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2010.04.29 11:17:48 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3119.30065__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2010.04.29 11:17:48 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3119.30232__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3119.30127__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3119.30100__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3119.30089__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3119.30082__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3119.30092__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3119.30081__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3119.30117__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3119.30171__90ba9c70f846762e\DEM.OS.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3119.30128__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3119.30094__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3119.30139__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3119.30129__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3119.30104__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3119.30177__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3119.30120__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3119.30176__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2010.04.29 11:17:48 | 000,006,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2010.04.29 11:17:47 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2010.04.29 11:17:47 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3119.30130__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2010.04.29 11:17:47 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3119.30119__90ba9c70f846762e\APM.Foundation.dll
MOD - [2010.04.29 11:17:47 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3119.30093__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2010.04.29 11:17:45 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Eeu.resources\2.0.3142.27315_cs_90ba9c70f846762e\CLI.Component.Eeu.resources.dll
MOD - [2010.04.29 11:17:45 | 000,011,264 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3142.27393__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2010.04.29 11:17:45 | 000,006,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory.resources\2.0.3142.27111_cs_90ba9c70f846762e\CLI.Component.SkinFactory.resources.dll
MOD - [2010.04.29 11:17:45 | 000,005,120 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.3142.27338_cs_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll
MOD - [2010.04.29 11:17:44 | 000,999,424 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3142.27126__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2010.04.29 11:17:44 | 000,700,416 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Eeu\2.0.3142.27315__90ba9c70f846762e\CLI.Component.Eeu.dll
MOD - [2010.04.29 11:17:44 | 000,417,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3142.27338__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2010.04.29 11:17:44 | 000,397,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3142.27148__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2010.04.29 11:17:44 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3142.27349__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2010.04.29 11:17:44 | 000,069,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3142.27109__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2010.04.29 11:17:44 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3142.27346__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2010.04.29 11:17:44 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3142.27108__90ba9c70f846762e\APM.Server.dll
MOD - [2010.04.29 11:17:44 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3142.27111__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2010.04.29 11:17:44 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3142.27108__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2010.04.29 11:17:44 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3119.30123__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2010.04.29 11:17:44 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3142.27106__90ba9c70f846762e\AEM.Server.dll
MOD - [2010.04.29 11:17:44 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3142.27379__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2010.04.29 11:17:44 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3119.30076__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2010.04.29 11:17:44 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3119.30101__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2010.04.29 11:17:44 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3119.30085__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2010.04.29 11:17:44 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2010.04.29 11:17:44 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3142.27348__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2010.04.29 11:17:44 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3119.30121__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2010.04.29 11:17:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3119.30121__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2010.04.29 11:17:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3119.30113__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2010.04.29 11:17:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3119.30074__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2010.04.29 11:17:44 | 000,014,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
MOD - [2010.04.29 11:17:44 | 000,013,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll
MOD - [2010.04.29 11:17:44 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3142.27105__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2008.06.23 13:58:36 | 000,016,384 | R--- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2007.02.17 17:45:27 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2009.03.21 16:09:02 | 000,161,513 | RHS- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\hwiwhtw.dll -- (fzmixibgc)
SRV - [2009.02.17 10:19:33 | 000,449,024 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dns.exe -- (DNS)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2007.02.17 17:48:12 | 000,071,168 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\tssdis.exe -- (Tssdis)
SRV - [2007.02.17 17:48:10 | 000,076,800 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\tlntsvr.exe -- (TlntSvr)
SRV - [2007.02.17 17:48:04 | 000,067,072 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rsopprov.exe -- (RSoPProv)
SRV - [2007.02.17 17:47:59 | 000,792,576 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ntfrs.exe -- (NtFrs)
SRV - [2007.02.17 17:47:56 | 000,111,104 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm)
SRV - [2007.02.17 17:47:56 | 000,111,104 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\netdde.exe -- (NetDDE)
SRV - [2007.02.17 17:47:51 | 000,032,768 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mnmsrvc.exe -- (mnmsrvc)
SRV - [2007.02.17 17:47:48 | 000,094,720 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\llssrv.exe -- (LicenseService)
SRV - [2007.02.17 17:47:47 | 000,040,448 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ismserv.exe -- (IsmServ)
SRV - [2007.02.17 17:47:46 | 000,157,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService) Služba modelu COM pro zápis na disk CD (IMAPI)
SRV - [2007.02.17 17:47:40 | 000,164,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dfssvc.exe -- (Dfs)
SRV - [2007.02.17 17:47:34 | 000,006,656 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\cisvc.exe -- (CiSvc)
SRV - [2007.02.17 17:47:25 | 000,008,192 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv)
SRV - [2007.02.17 17:47:09 | 000,348,672 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc) Načítání obrázků (WIA)
SRV - [2007.02.17 17:47:07 | 000,074,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\webclnt.dll -- (WebClient)
SRV - [2007.02.17 17:46:37 | 000,135,168 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes)
SRV - [2007.02.17 17:46:07 | 000,380,928 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\qmgr.dll -- (BITS)
SRV - [2007.02.17 17:45:28 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)
SRV - [2007.02.17 17:45:21 | 000,054,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)
SRV - [2007.02.17 17:44:49 | 000,024,576 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\ersvc.dll -- (ERSvc)
SRV - [2007.02.17 17:44:07 | 000,018,944 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)
SRV - [2007.02.17 17:43:34 | 001,595,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srmsvc.dll -- (SrmSvc)
SRV - [2006.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\trksvr.dll -- (TrkSvr)
SRV - [2006.04.14 14:00:00 | 000,032,256 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\clipsrv.exe -- (ClipSrv)
SRV - [2006.04.14 14:00:00 | 000,012,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\sacsvr.dll -- (sacsvr)
SRV - [2006.01.12 14:00:00 | 000,010,752 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\srmhost.exe -- (SrmReports)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Adapter | On_Demand | Unknown] -- -- (LicenseInfo)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2008.08.08 23:30:42 | 003,266,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.08.15 10:22:00 | 000,265,856 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2007.02.17 17:07:04 | 000,268,800 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2007.02.17 17:05:47 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\amdide.sys -- (AmdIde)
DRV - [2007.02.17 17:02:35 | 000,073,728 | ---- | M] (Microsoft Corporation) [Kernel | Unavailable | Unknown] -- C:\WINDOWS\System32\drivers\sacdrv.sys -- (sacdrv)
DRV - [2007.02.17 17:01:54 | 000,121,856 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia)
DRV - [2007.02.17 17:00:31 | 000,177,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wlbs.sys -- (WLBS)
DRV - [2007.02.17 16:55:04 | 000,088,064 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\quota.sys -- (Quota)
DRV - [2007.02.17 16:55:02 | 000,048,640 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\datascrn.sys -- (Datascrn)
DRV - [2007.02.17 08:29:24 | 000,151,040 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat)
DRV - [2007.02.17 08:29:24 | 000,065,536 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cdfs.sys -- (Cdfs)
DRV - [2007.02.17 08:14:59 | 000,043,520 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\arc.sys -- (arc)
DRV - [2007.02.17 08:14:58 | 000,023,552 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\hpcisss.sys -- (hpcisss)
DRV - [2007.02.17 08:02:56 | 000,069,120 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\clusdisk.sys -- (ClusDisk)
DRV - [2007.02.17 07:51:18 | 000,034,816 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\dfs.sys -- (DfsDriver)
DRV - [2007.02.17 07:50:33 | 000,067,584 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)
DRV - [2006.04.14 14:00:00 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)
DRV - [2006.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={ ... rer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)



========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Administrator\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Administrator\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Administrator\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Administrator\Local Settings\Data aplikac\u00ED\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Vyhled\u00E1v\u00E1n\u00ED Google = C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006.04.14 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 2905288671 (MUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = novoborska.cz
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{15ECB72F-FC26-4920-BFDD-455553C10DFC}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A255DA24-D38B-47F4-A75F-00E6D96C0E44}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O29 - HKLM SecurityProviders - (pwdssp.dll) - C:\WINDOWS\System32\pwdssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.04.19 12:14:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\Shell - "" = AutoRun
O33 - MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - C:\WINDOWS\System32\ias.dll (Microsoft Corporation)
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Sacsvr - C:\WINDOWS\system32\sacsvr.dll (Microsoft Corporation)
NetSvcs: TrkSvr - C:\WINDOWS\system32\trksvr.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: fzmixibgc - C:\WINDOWS\system32\hwiwhtw.dll ()

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 30 Days ==========

[2012.05.31 10:21:02 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2012.05.31 08:55:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012.05.29 15:10:29 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012.05.29 13:44:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Data aplikací\Common Files
[2012.05.29 13:43:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\MFAData
[2012.05.28 10:15:09 | 000,000,000 | ---D | C] -- C:\Program Files\LSoft Technologies Inc
[2012.05.28 10:15:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Active@ Partition Manager
[2012.05.28 10:00:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\PartitionGuru
[2012.05.28 10:00:37 | 000,000,000 | ---D | C] -- C:\Program Files\PartitionGuru
[2012.05.25 13:48:15 | 000,000,000 | ---D | C] -- C:\FRST
[2012.05.25 09:43:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
[2012.05.25 09:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Malwarebytes' Anti-Malware
[2012.05.25 09:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
[2012.05.25 09:43:51 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.25 09:43:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.05.25 09:09:27 | 000,702,840 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Plocha\Windows-KB943729-x86-ENU.exe
[2012.05.25 09:08:14 | 000,887,160 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Plocha\Windows-KB943729-x64-ENU.exe
[2012.05.23 09:13:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\PSpad
[2012.05.23 09:13:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\PSPad editor
[2012.05.23 09:13:29 | 000,000,000 | ---D | C] -- C:\Program Files\PSPad editor
[2012.05.23 09:04:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Plocha\ad_user
[2012.05.23 09:04:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\WinRAR
[2012.05.23 09:04:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Nabídka Start\Programy\WinRAR
[2012.05.23 09:04:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\WinRAR
[2012.05.23 09:04:23 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.05.23 08:57:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dokumenty\Downloads
[2012.05.22 14:12:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2012.05.22 08:42:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Nabídka Start\Programy\Google Chrome
[2012.05.22 08:40:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.05.31 10:23:36 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.05.31 10:21:07 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Plocha\OTL.exe
[2012.05.31 09:45:00 | 000,001,058 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500UA.job
[2012.05.31 09:19:30 | 000,003,229 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\vytvoreni uzivatele.bat
[2012.05.31 09:05:04 | 000,510,878 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2012.05.31 09:05:04 | 000,508,852 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.31 09:05:04 | 000,103,860 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2012.05.31 09:05:04 | 000,087,548 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.31 09:00:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.31 09:00:28 | 000,047,604 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012.05.31 08:58:50 | 000,000,208 | -HS- | M] () -- C:\boot.ini
[2012.05.31 08:58:31 | 002,127,448 | ---- | M] () -- C:\dfer.exe
[2012.05.30 11:54:14 | 000,000,049 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\test.bat
[2012.05.30 10:44:48 | 000,065,536 | ---- | M] () -- C:\WINDOWS\NETLOGON.CHG
[2012.05.30 09:24:28 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\PUTTY.RND
[2012.05.30 09:05:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.05.29 13:02:35 | 000,001,346 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2012.05.28 09:21:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.28 08:45:01 | 000,001,006 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500Core.job
[2012.05.25 09:43:53 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes Anti-Malware.lnk
[2012.05.25 09:09:31 | 000,702,840 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Plocha\Windows-KB943729-x86-ENU.exe
[2012.05.25 09:08:17 | 000,887,160 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Plocha\Windows-KB943729-x64-ENU.exe
[2012.05.23 10:16:47 | 000,000,002 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\a
[2012.05.23 09:13:31 | 000,000,697 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\PSPad.lnk
[2012.05.22 10:40:26 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\Administrator\Dokumenty\Default.rdp
[2012.05.21 12:41:45 | 000,002,412 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.05.21 08:57:25 | 000,004,505 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.05.31 10:23:36 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.05.31 08:54:15 | 002,127,448 | ---- | C] () -- C:\dfer.exe
[2012.05.28 15:28:50 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\PUTTY.RND
[2012.05.25 09:43:53 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes Anti-Malware.lnk
[2012.05.23 09:13:31 | 000,000,697 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\PSPad.lnk
[2012.05.22 14:31:51 | 000,000,002 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\a
[2012.05.22 11:37:50 | 000,000,049 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\test.bat
[2012.05.22 11:00:00 | 000,003,229 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\vytvoreni uzivatele.bat
[2012.05.22 10:40:26 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Administrator\Dokumenty\Default.rdp
[2012.05.22 08:45:05 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.05.22 08:40:28 | 000,001,058 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500UA.job
[2012.05.22 08:40:27 | 000,001,006 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3408372328-283728665-3668875644-500Core.job
[2010.07.12 14:35:01 | 000,004,626 | ---- | C] () -- C:\WINDOWS\System32\dhcpctrs.ini
[2010.07.02 11:29:46 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.06.25 16:27:46 | 000,024,120 | ---- | C] () -- C:\WINDOWS\System32\dnsperf.ini
[2010.06.25 15:48:42 | 000,001,311 | ---- | C] () -- C:\WINDOWS\System32\dfsmgmt.dll.config

========== LOP Check ==========

[2011.05.30 16:32:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\TeamViewer
[2010.04.29 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\TMP
[2012.05.29 13:44:35 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\Common Files
[2012.05.29 13:43:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\MFAData
[2012.05.28 05:45:00 | 000,032,470 | ---- | M] () -- C:\WINDOWS\Tasks\SchedLgU.Txt

========== Purity Check ==========



========== Custom Scans ==========

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2007.02.17 17:47:37 | 000,015,360 | ---- | M] (Microsoft Corporation)
"Google Update" = "C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c -- [2012.05.22 08:40:26 | 000,116,648 | ---- | M] (Google Inc.)

< %systemroot%\system32\drivers\*.sys /5 >

< %systemroot%\system32\drivers\*.sys /X >
[2008.08.08 21:52:00 | 000,053,248 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2erec.dll

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\*.* /5 >
[2012.05.31 09:00:28 | 000,047,604 | ---- | M] () -- C:\WINDOWS\system32\ativvaxx.cap
[2012.05.30 09:05:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2012.05.31 09:05:04 | 000,103,860 | ---- | M] () -- C:\WINDOWS\system32\perfc005.dat
[2012.05.31 09:05:04 | 000,087,548 | ---- | M] () -- C:\WINDOWS\system32\perfc009.dat
[2012.05.31 09:05:04 | 000,510,878 | ---- | M] () -- C:\WINDOWS\system32\perfh005.dat
[2012.05.31 09:05:04 | 000,508,852 | ---- | M] () -- C:\WINDOWS\system32\perfh009.dat
[2012.05.31 09:05:04 | 001,227,768 | ---- | M] () -- C:\WINDOWS\system32\PerfStringBackup.INI
[2012.05.28 09:21:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.21 16:09:02 | 000,161,513 | RHS- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\hwiwhtw.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %ALLUSERSPROFILE%\Dáta aplikácií\*.* >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s >

< %APPDATA%\*. >
[2010.05.03 12:50:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Adobe
[2010.04.30 15:07:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\ATI
[2010.04.19 12:43:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Identities
[2010.05.03 12:50:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
[2012.05.25 09:43:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
[2010.04.19 12:43:55 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
[2012.05.23 14:25:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\PSpad
[2011.02.11 12:45:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Skype
[2010.07.02 11:29:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\skypePM
[2011.05.30 16:32:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\TeamViewer
[2010.04.29 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\TMP
[2012.05.23 09:04:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\WinRAR

< %APPDATA%\*.* >
[2010.04.19 13:17:21 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\desktop.ini

< %APPDATA%\*.exe /s >
[2010.04.29 11:16:08 | 000,009,158 | R--- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe

< %SYSTEMDRIVE%\*.exe >
[2012.05.31 08:58:31 | 002,127,448 | ---- | M] () -- C:\dfer.exe
[2007.02.17 17:47:53 | 000,094,720 | ---- | M] (Microsoft Corporation) -- C:\msizap.exe

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\dfer.exe:SummaryInformation

< End of report >


Extras
---
OTL Extras logfile created on: 31.5.2012 10:22:17 - Run 1
OTL by OldTimer - Version 3.2.44.0 Folder = C:\Documents and Settings\Administrator\Plocha
Windows Server 2003 Server 2003 R2 Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

4,00 Gb Total Physical Memory | 3,14 Gb Available Physical Memory | 78,62% Memory free
5,83 Gb Paging File | 4,97 Gb Available in Paging File | 85,14% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 10,00 Gb Total Space | 2,12 Gb Free Space | 21,17% Space Free | Partition Type: NTFS
Drive D: | 698,64 Gb Total Space | 698,52 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive E: | 688,63 Gb Total Space | 687,79 Gb Free Space | 99,88% Space Free | Partition Type: NTFS

Computer Name: SERVER-NOVOB | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5289:TCP" = 5289:TCP:*:Enabled:vkozj

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01EC295B-894D-C237-C3EF-057391108781}" = ccc-core-static
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07F2FF07-B79D-0987-20FB-51AC823F1FC1}" = CCC Help French
"{08FB2B8E-F9A2-4E02-CD1C-051D23F9E9E1}" = Skins
"{09DD1D66-F75C-2F7A-E8C7-505047D668FC}" = CCC Help Czech
"{0A9314B8-F27C-5F9F-679B-FDDE1FBBDD46}" = Catalyst Control Center Localization Korean
"{13E9DED2-DE9D-D096-446E-D996121F8E64}" = CCC Help Portuguese
"{15F57136-1A9D-DE65-A713-12CD6916A8A0}" = Catalyst Control Center Graphics Previews Common
"{16FA721D-BCA4-F0E8-936D-169D2E3708BA}" = ccc-core-preinstall
"{180B0C96-6B37-938C-5819-E0ABEE7EBD91}" = CCC Help Dutch
"{186B7F39-6E74-3CAB-9F6A-B4DE305CE4AA}" = Catalyst Control Center Localization Turkish
"{19C17A13-F7BC-A054-C3DA-183822F75CA6}" = CCC Help Chinese Standard
"{1C8A36FD-7D97-71D4-D1C9-78CEBC79B5CC}" = Catalyst Control Center Localization Portuguese
"{24F795E7-B436-F647-41C7-078E38F77F13}" = CCC Help Spanish
"{2AA3EBFE-05FF-CF26-6221-7ED1E5BB5689}" = Catalyst Control Center Graphics Full New
"{2AD40E66-CA95-B489-4792-FD453DB6E28F}" = Catalyst Control Center Localization Swedish
"{2E48DBCF-97E1-61BA-4EB5-8E292F660C53}" = Catalyst Control Center Localization German
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{438A7572-849F-1905-2CFB-4F20D954C6B2}" = CCC Help Polish
"{47310DCB-1E1D-CEBE-56C5-32EA9DFF5A3C}" = Catalyst Control Center Localization Chinese Traditional
"{497224D2-896F-96B8-544E-98430BE808FF}" = Catalyst Control Center Localization Finnish
"{4C83F00F-DDFC-F93E-047B-131A9F2357B4}" = CCC Help Danish
"{4FEFA618-9F53-123D-7B33-6271213AB85D}" = CCC Help English
"{527DD85F-5A88-CEF9-7978-E3EE9A8ACC3C}" = Catalyst Control Center Graphics Full Existing
"{57548D89-1B88-8B1B-8010-573F8614810D}" = Catalyst Control Center Graphics Light
"{5BEBC286-7AB5-5712-EB20-37EB28F01C28}" = Catalyst Control Center Localization Hungarian
"{5C349075-28B9-B7E3-2919-EE6A2989B293}" = Catalyst Control Center Localization Russian
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5F004F6B-6BBE-19BD-5D2B-A1EEEB4AF686}" = CCC Help Italian
"{61BE3872-BDCB-B9B9-9D30-4EF2889EB00E}" = CCC Help Swedish
"{662D7DBB-D5CB-DA5F-5ABC-24CCFA9B63CE}" = Catalyst Control Center Localization Chinese Standard
"{671B6A58-8F67-2A2F-6FEB-AB84D59380C8}" = CCC Help Russian
"{76A191B0-09F3-AFD7-91A2-77C15C10DF6D}" = CCC Help German
"{7BBBB3DF-4EE5-2A13-C1C5-FB26E788CBC1}" = Catalyst Control Center Localization Polish
"{7F947BFE-C2DF-4779-9909-5BEE746BD0C4}" = Microsoft .NET Framework 2.0 Language Pack - CSY
"{82BF80DB-8F2F-F327-EDF4-1544EFD473B7}" = CCC Help Turkish
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8B67B3F8-9945-5D34-5FC5-C9812B457FE6}" = Catalyst Control Center Core Implementation
"{8F60FD25-428F-8590-53C6-B922E34BBCB6}" = CCC Help Finnish
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5AA2C03-5046-FE41-4E4B-C052A8217616}" = Catalyst Control Center Localization Czech
"{A658D1A7-DC4B-4095-7DA7-BEF1B8C7FF91}" = CCC Help Chinese Traditional
"{A98E3354-AD08-427C-A0AC-32221A3E6598}" = Active@ Partition Manager
"{AED17FA7-FEF8-1A4D-5500-268582E25D70}" = Catalyst Control Center Localization Thai
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C38E7E0A-1CEF-09FA-FEAB-A5CD6B370FF8}" = Catalyst Control Center Localization Japanese
"{C4D2C5A4-6813-7895-0449-FAF7AB24B5BC}" = Catalyst Control Center Localization Italian
"{C746C909-7505-3FD3-AF67-3F1899D0BB01}" = Catalyst Control Center Localization Danish
"{CB1E7E1F-8A09-E028-CC6F-28BC788CDEB1}" = CCC Help Korean
"{CB9ED9B2-50BE-AF74-B433-8EA8E8D40574}" = Catalyst Control Center Localization French
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFE147EF-0E6B-8FE3-9A58-153E4168AD51}" = CCC Help Greek
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D32EE7F4-81A0-E840-FE65-ECB6BFD3EF24}" = Catalyst Control Center Localization Greek
"{D60BE5B8-1948-643F-EBB1-55ADCAC3CAF6}" = Catalyst Control Center Localization Spanish
"{DC982951-4BF5-85F4-08CB-4C62C8BD641B}" = CCC Help Norwegian
"{DDC0D950-9ECD-1F3C-33CD-F85F1DC077BA}" = CCC Help Thai
"{E2901E0C-A12F-003C-FCF0-F1EEABFA0A97}" = CCC Help Japanese
"{E2C347CC-4783-5F74-4387-68DA700D0652}" = CCC Help Hungarian
"{EA4BE234-FAFB-F0EA-9C61-4B3673D37279}" = Catalyst Control Center Localization Dutch
"{FA3A247D-437A-455E-A88F-7EB6E5F9E799}" = Catalyst Control Center - Branding
"{FC4FF5F4-2265-4E18-8BBC-12CBA9794388}_is1" = PartitionGuru Free
"{FCF16D15-B9D1-187F-C970-CC14AA0FBA1B}" = Catalyst Control Center Localization Norwegian
"{FFED12B7-FD5E-FA7B-AF50-9E858AAE0EC8}" = ccc-utility
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = Softarová utilita ATI - Odinstalovat
"ATI Display Driver" = ATI Display Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware verze 1.61.0.1400
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 2.0 Language Pack - CSY" = Microsoft .NET Framework 2.0 Language Pack - CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoFiltre" = PhotoFiltre
"PSPad editor_is1" = PSPad editor
"TeamViewer 6" = TeamViewer 6
"WIC" = Windows Imaging Component
"Windows Server 2003 Service Pack" = Windows Server 2003 Service Pack 2
"WinRAR archiver" = WinRAR 4.11 (32-bit)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 30.5.2012 5:55:43 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 30.5.2012 5:58:15 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 30.5.2012 5:58:15 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 30.5.2012 5:58:15 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 30.5.2012 5:58:15 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 30.5.2012 6:00:55 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 30.5.2012 6:00:55 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 30.5.2012 6:00:55 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 30.5.2012 6:00:55 | Computer Name = SERVER-NOVOB | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Error - 31.5.2012 2:57:15 | Computer Name = SERVER-NOVOB | Source = VSS | ID = 8211
Description = Chyba služby Stínová kopie svazku: Modul pro zápis s názvem WMI Writer
a ID {a6ad56c2-b509-4e6c-bb19-49d8f43532f0} se pokusil o přihlášení v nouzovém
režimu.


========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Jinak ano pevnou IP mám

[stell]

Pocitac je infikovany smejdom Conficker, teda ak mas v sieti viacej pocitacov tak vsetky su infikovane s tymto smejdom.

Teraz sprav toto:
spust OTL, nastavenie nechaj tak ako je, dole do okna vloz tento script a klikni na gombik OPRAVIT>[.RunFix.]
Log po restarte vloz sem.

Kód: Vybrat vše

:OTL
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3408372328-283728665-3668875644-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
SRV - [2009.03.21 16:09:02 | 000,161,513 | RHS- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\hwiwhtw.dll -- (fzmixibgc)
O33 - MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\Shell - "" = AutoRun
O33 - MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
NetSvcs: fzmixibgc - C:\WINDOWS\system32\hwiwhtw.dll ()
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
@Alternate Data Stream - 88 bytes -> C:\dfer.exe:SummaryInformation
:services
fzmixibgc
vkozj
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5289:TCP" =-

:files
c:\windows\SET*.tmp
C:\WINDOWS\system32\hwiwhtw.dll
:Commands
[resethosts]
[emptytemp]
[clearallrestorepoints]
[start explorer]
[Reboot]

Potom pokracuj podla mojho navodu z mojho blogu,, Log subory postupne vkladaj sem
Ak Dajaky program nepojde vynechaj a pokracuj dalej,a potom napis ze aky program nevedel si spustit, pretoze mas tu Windows server 2003, tak nie som si isty ci vsetky programy pojdu.
NAVOD>>
http://www.viruskasino.com/2011/08/conficker.html

[msa]

log z OTL
--------

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\S-1-5-21-3408372328-283728665-3668875644-500\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKEY_USERS\S-1-5-21-3408372328-283728665-3668875644-500\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3408372328-283728665-3668875644-500\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Service fzmixibgc stopped successfully!
Service fzmixibgc deleted successfully!
File move failed. C:\WINDOWS\system32\hwiwhtw.dll scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17343192-a639-11e1-8f49-0022154b4dc2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17343192-a639-11e1-8f49-0022154b4dc2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17343192-a639-11e1-8f49-0022154b4dc2}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
fzmixibgc removed from NetSvcs value successfully!
File move failed. C:\WINDOWS\system32\hwiwhtw.dll scheduled to be moved on reboot.
C:\WINDOWS\SET11.tmp deleted successfully.
C:\WINDOWS\SET12.tmp deleted successfully.
C:\WINDOWS\SET13.tmp deleted successfully.
C:\WINDOWS\SET27.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET7.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
ADS C:\dfer.exe:SummaryInformation deleted successfully.
========== SERVICES/DRIVERS ==========
Error: No service named fzmixibgc was found to stop!
Service\Driver key fzmixibgc not found.
Error: No service named vkozj was found to stop!
Service\Driver key vkozj not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\5289:TCP deleted successfully.
========== FILES ==========
File\Folder c:\windows\SET*.tmp not found.
File move failed. C:\WINDOWS\system32\hwiwhtw.dll scheduled to be moved on reboot.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 159261345 bytes
->Temporary Internet Files folder emptied: 8720168 bytes
->Google Chrome cache emptied: 248201560 bytes
->Flash cache emptied: 2230 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18745056 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23894882 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 4980 bytes

Total Files Cleaned = 438,00 mb

System Restore Service not available.

OTL by OldTimer - Version 3.2.44.0 log created on 06012012_085433

Files\Folders moved on Reboot...
C:\WINDOWS\system32\hwiwhtw.dll moved successfully.

Registry entries deleted on Reboot...




---------
záplaty pro WS 2003 SP2 jsem tam nenašel.. pokračuji dál podle návodu