Zdar. Mám poslední dobou zpomalené USB (dost podstatně). Mrkněte prosim na log, jestli to není nějakou havětí, formátovat se mi zatím nechce. Díky
Logfile of random's system information tool 1.06 (written by random/random)
Run by chces_tvaruzek at 2010-02-08 16:43:01
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 5 GB (10%) free of 54 GB
Total RAM: 2046 MB (65% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:08, on 8.2.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
D:\Downloads\RSIT.exe
C:\Program Files\trend micro\HijackThis\chces_tvaruzek.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 69.16.243.105 L2authd.lineage2.com
O1 - Hosts: 69.16.243.105 auth.lineage2.com.tw
O1 - Hosts: 69.16.243.105 auth.lineage2.jp
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.in.th
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.ph
O1 - Hosts: 69.16.243.105 L2testauthd.lineage2.com
O1 - Hosts: 69.16.243.105 L2authd.lineage2.com
O1 - Hosts: 69.16.243.105 auth.lineage2.com.tw
O1 - Hosts: 69.16.243.105 auth.lineage2.jp
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.in.th
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.ph
O1 - Hosts: 69.16.243.105 L2testauthd.lineage2.com
O1 - Hosts: 69.16.243.105 L2authd.lineage2.com
O1 - Hosts: 69.16.243.105 auth.lineage2.com.tw
O1 - Hosts: 69.16.243.105 auth.lineage2.jp
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.in.th
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.ph
O1 - Hosts: 69.16.243.105 L2testauthd.lineage2.com
O1 - Hosts: 69.16.243.105 L2authd.lineage2.com
O1 - Hosts: 69.16.243.105 auth.lineage2.com.tw
O1 - Hosts: 69.16.243.105 auth.lineage2.jp
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.in.th
O1 - Hosts: 69.16.243.105 L2auth.Lineage2.ph
O1 - Hosts: 69.16.243.105 L2testauthd.lineage2.com
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [mspaint] "C:\WINDOWS\system32\Paint.exe" -autocheck
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Air Mouse.lnk = C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\wbsys.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Turbine Message Service - Live (LiveTurbineMessageService) - Turbine, Inc. - C:\games\Turbine Download Manager\TurbineMessageService.exe
O23 - Service: Turbine Network Service - Live (LiveTurbineNetworkService) - Turbine, Inc. - C:\games\Turbine Download Manager\TurbineNetworkService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 12194 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Program Files\Orbitdownloader\orbitcth.dll [2009-10-14 179472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
IeCatch5 Class - C:\PROGRA~1\FlashGet\jccatch.dll [2006-05-16 81920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-26 320920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-26 34816]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-26 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
gFlash Class - C:\PROGRA~1\FlashGet\getflash.dll [2006-09-12 126976]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} - FlashGet Bar - C:\PROGRA~1\FlashGet\fgiebar.dll [2005-06-07 86016]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} - Grab Pro - C:\Program Files\Orbitdownloader\GrabPro.dll [2009-10-14 662720]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-28 16248320]
"AzMixerSel"=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2006-04-15 53248]
"LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2006-06-23 602112]
"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2005-11-11 1236992]
"ePower_DMC"=C:\Acer\Empowering Technology\ePower\ePower_DMC.exe [2006-05-30 421888]
"AtiPTA"=C:\WINDOWS\system32\atiptaxx.exe [2006-02-22 344064]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-03 761946]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-03 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-03 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-07-01 1447168]
"mspaint"=C:\WINDOWS\system32\Paint.exe -autocheck []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-01-22 141608]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2009-11-22 1037192]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"Cacheman"=C:\PROGRA~1\Cacheman\Cacheman.exe [2003-07-31 1290752]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dni]
C:\Program Files\365dníNET\365dniNET.exe [2007-01-06 753664]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
C:\Acer\Empowering Technology\ePower\Boot.exe [2006-03-15 579584]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe [2006-05-30 421888]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2008-09-30 133104]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2010-01-22 141608]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe [2008-11-10 1253376]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2008-12-03 1205760]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\gry\steam\steam.exe [2009-12-19 1217808]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
D:\gry\Warcraft III\w3dr.exe [2008-08-03 61440]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Acer Empowering Technology.lnk]
C:\Acer\EMPOWE~1\ACEREM~1.EXE [2006-03-27 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Handwizard.lnk]
C:\PROGRA~1\HANDWI~1.3\HANDWI~1.EXE [2008-06-20 208896]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^chces_tvaruzek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Air Mouse.lnk - C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Documents and Settings\chces_tvaruzek\Nabídka Start\Programy\Po spuštění
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\system32\wbsys.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-12-05 122880]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCPClient]
C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll [2005-01-31 49152]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll [2008-09-26 229376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - C:\PROGRA~1\COMMON~1\Stardock\MCPCore.dll [2005-05-10 86016]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Orbitdownloader\orbitdm.exe"="C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Program Files\Orbitdownloader\orbitnet.exe"="C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Garena_official\Garena.exe"="C:\Program Files\Garena_official\Garena.exe:*:Enabled:Garena"
"D:\gry\UO\client.exe"="D:\gry\UO\client.exe:*:Enabled:Ultima Online Client"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\totalcmd\TOTALCMD.EXE"="C:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"D:\gry\CS NS\cstrike.exe"="D:\gry\CS NS\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"C:\games\Turbine Download Manager\TurbineMessageService.exe"="C:\games\Turbine Download Manager\TurbineMessageService.exe:*:Enabled:TurbineMessageService"
"C:\games\Turbine Download Manager\TurbineNetworkService.exe"="C:\games\Turbine Download Manager\TurbineNetworkService.exe:*:Enabled:TurbineNetworkService"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\gry\Steam\SteamApps\ahmfgc\counter-strike source\hl2.exe"="C:\gry\Steam\SteamApps\ahmfgc\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\gry\Steam\SteamApps\ahmfgc\day of defeat source\hl2.exe"="C:\gry\Steam\SteamApps\ahmfgc\day of defeat source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Garena\Garena Host Bot v1.0\GarenaHostBot.exe"="C:\Program Files\Garena\Garena Host Bot v1.0\GarenaHostBot.exe:*:Enabled:Garena Host Bot - advanced hosting bot for garena"
"C:\Program Files\Garena\Garena Host Bot v1.0\ghost.exe"="C:\Program Files\Garena\Garena Host Bot v1.0\ghost.exe:*:Enabled:ghost"
"D:\gry\Worms Armageddon\Landgen.exe"="D:\gry\Worms Armageddon\Landgen.exe:*:Disabled:Landgen"
"D:\gry\Worms Armageddon\WA.exe"="D:\gry\Worms Armageddon\WA.exe:*:Disabled:Worms Armageddon"
"D:\gry\LieroX v0.56 Pack 1.9\LieroX.exe"="D:\gry\LieroX v0.56 Pack 1.9\LieroX.exe:*:Enabled:LieroX"
"D:\gry\Worms 4 Mayhem\WORMS 4 MAYHEM.EXE"="D:\gry\Worms 4 Mayhem\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Logitech Touch Mouse Server\iTouch-Server-Win.exe"="C:\Program Files\Logitech Touch Mouse Server\iTouch-Server-Win.exe:*:Enabled:Logitech"
"C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe"="C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe:*:Enabled:Air Mouse"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Java\jre6\launch4j-tmp\Stanza.exe"="C:\Program Files\Java\jre6\launch4j-tmp\Stanza.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
======List of files/folders created in the last 1 months======
2010-02-08 16:32:25 ----A---- C:\WINDOWS\system32\vsregexp.dll
2010-02-08 16:32:15 ----A---- C:\WINDOWS\system32\zlcommdb.dll
2010-02-08 16:32:15 ----A---- C:\WINDOWS\system32\zlcomm.dll
2010-02-08 16:32:10 ----A---- C:\WINDOWS\system32\vswmi.dll
2010-02-08 16:32:09 ----A---- C:\WINDOWS\system32\zpeng25.dll
2010-02-08 16:32:08 ----A---- C:\WINDOWS\system32\vsxml.dll
2010-02-08 16:32:07 ----D---- C:\WINDOWS\system32\ZoneLabs
2010-02-08 16:32:07 ----A---- C:\WINDOWS\system32\vspubapi.dll
2010-02-08 16:32:07 ----A---- C:\WINDOWS\system32\vsmonapi.dll
2010-02-08 16:31:20 ----A---- C:\WINDOWS\system32\vsutil.dll
2010-02-08 16:31:20 ----A---- C:\WINDOWS\system32\vsinit.dll
2010-02-08 16:31:20 ----A---- C:\WINDOWS\system32\vsdata.dll
2010-02-08 16:29:07 ----HDC---- C:\WINDOWS\$NtUninstallKB943232$
2010-02-08 16:28:54 ----D---- C:\Program Files\Zone Labs
2010-02-08 16:28:31 ----D---- C:\WINDOWS\Internet Logs
2010-02-03 17:05:46 ----D---- C:\Documents and Settings\chces_tvaruzek\Data aplikací\DiskAid
2010-02-03 17:05:16 ----D---- C:\Program Files\DigiDNA
2010-02-02 16:35:30 ----D---- C:\Program Files\USBTrace
2010-02-02 16:18:44 ----D---- C:\Program Files\iPod
2010-02-02 16:18:34 ----D---- C:\Program Files\iTunes
2010-02-01 16:58:58 ----D---- C:\Program Files\Winamp Detect
2010-02-01 15:14:01 ----D---- C:\Program Files\Stanza
2010-01-31 19:34:24 ----D---- C:\Program Files\USBInfo
2010-01-31 18:07:53 ----D---- C:\Program Files\Cacheman
2010-01-29 01:15:53 ----D---- C:\Program Files\iBrick
2010-01-29 00:53:00 ----D---- C:\Program Files\Techlogg.com ToneShop
2010-01-28 20:29:15 ----D---- C:\Program Files\Air Mouse
2010-01-28 19:25:51 ----D---- C:\Program Files\Logitech Touch Mouse Server
2010-01-27 00:21:05 ----D---- C:\WINDOWS\Downloaded Installations
2010-01-26 18:56:31 ----D---- C:\Program Files\!iPhone utilities
2010-01-26 18:12:53 ----D---- C:\Program Files\SharePod
2010-01-26 15:38:16 ----D---- C:\Documents and Settings\All Users\Data aplikací\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-01-26 15:35:25 ----D---- C:\Program Files\Bonjour
2010-01-26 15:34:05 ----D---- C:\Program Files\QuickTime
2010-01-26 15:30:52 ----A---- C:\WINDOWS\system32\usbaaplrc.dll
2010-01-22 21:56:06 ----D---- C:\Program Files\TryMedia
======List of files/folders modified in the last 1 months======
2010-02-08 16:43:03 ----D---- C:\WINDOWS\Temp
2010-02-08 16:42:50 ----D---- C:\Documents and Settings\chces_tvaruzek\Data aplikací\uTorrent
2010-02-08 16:42:25 ----A---- C:\WINDOWS\WINCMD.INI
2010-02-08 16:36:05 ----D---- C:\WINDOWS\Prefetch
2010-02-08 16:35:42 ----D---- C:\WINDOWS
2010-02-08 16:35:09 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-08 16:34:03 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-08 16:32:27 ----D---- C:\WINDOWS\system32
2010-02-08 16:29:22 ----HD---- C:\WINDOWS\inf
2010-02-08 16:29:16 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-08 16:28:54 ----RD---- C:\Program Files
2010-02-08 16:28:26 ----SHD---- C:\WINDOWS\Installer
2010-02-08 16:28:26 ----D---- C:\WINDOWS\WinSxS
2010-02-08 16:28:26 ----D---- C:\Config.Msi
2010-02-08 11:25:56 ----D---- C:\Program Files\Mozilla Firefox
2010-02-07 22:00:53 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-07 18:07:54 ----D---- C:\Torrent Downloads
2010-02-07 17:10:05 ----D---- C:\Program Files\Garena_official
2010-02-04 14:03:58 ----D---- C:\Program Files\ParadisePoker
2010-02-03 13:13:21 ----RASH---- C:\boot.ini
2010-02-03 13:13:21 ----A---- C:\WINDOWS\win.ini
2010-02-03 13:13:21 ----A---- C:\WINDOWS\system.ini
2010-02-03 00:32:24 ----D---- C:\Program Files\SpeedFan
2010-02-02 16:35:33 ----D---- C:\WINDOWS\system32\drivers
2010-02-02 16:18:39 ----D---- C:\Program Files\Common Files\Apple
2010-02-01 16:59:08 ----D---- C:\Program Files\Winamp
2010-02-01 10:39:21 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-31 19:34:30 ----N---- C:\WINDOWS\Setup1.exe
2010-01-31 19:34:25 ----A---- C:\WINDOWS\ST6UNST.EXE
2010-01-29 02:22:35 ----SD---- C:\Documents and Settings\chces_tvaruzek\Data aplikací\Microsoft
2010-01-27 18:45:43 ----D---- C:\Program Files\totalcmd
2010-01-26 21:34:37 ----D---- C:\Program Files\Orbitdownloader
2010-01-26 16:39:16 ----D---- C:\Documents and Settings\chces_tvaruzek\Data aplikací\Apple Computer
2010-01-26 15:51:58 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2010-01-26 15:39:42 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-14 18:15:15 ----A---- C:\WINDOWS\wcx_ftp.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 43008]
R1 atitray;atitray; \??\C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys []
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2009-11-22 486280]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys []
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2004-08-04 87424]
R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-07-26 547904]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-17 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-12-05 2782208]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2006-01-17 328061]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2006-01-17 850474]
R3 Cam5603D;Acer OrbiCam; C:\WINDOWS\System32\Drivers\BisonCam.sys [2006-06-30 775936]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2004-12-08 16896]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-11-23 25280]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-28 4304384]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-06-16 83968]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-03 192672]
R3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 a2cn9i12;a2cn9i12; C:\WINDOWS\system32\drivers\a2cn9i12.sys []
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2006-10-23 93440]
S3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2006-01-17 30459]
S3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-01-17 148900]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2006-01-17 65688]
S3 catchme;catchme; \??\C:\DOCUME~1\CHCES_~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 EagleNT;EagleNT; C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\CHCES_~1\LOCALS~1\Temp\HLN140F.tmp []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 42000]
S3 npkcrypt;npkcrypt; C:\WINDOWS\system32\drivers\npkcrypt.sys []
S3 npkcusb;npkcusb; C:\WINDOWS\system32\drivers\npkcusb.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 ptiusbf;PTI USB Filter; C:\WINDOWS\SYSTEM32\DRIVERS\PTIUSBF.SYS [2001-04-14 22474]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 utdrv;utdrv; \??\C:\WINDOWS\system32\drivers\utdrv.sys []
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-12-05 495616]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2006-01-17 266295]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2005-01-04 65536]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-26 152984]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2009-11-22 2384240]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2005-11-11 18944]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2005-01-04 1527893]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-01-22 545576]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2007-09-28 593920]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-10-15 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-07-01 19200]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-31 136120]
S3 LiveTurbineMessageService;Turbine Message Service - Live; C:\games\Turbine Download Manager\TurbineMessageService.exe [2009-10-14 267760]
S3 LiveTurbineNetworkService;Turbine Network Service - Live; C:\games\Turbine Download Manager\TurbineNetworkService.exe [2009-10-14 218608]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-09-03 3347280]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-01-25 93048]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Zpomalené USB
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 119497
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Zpomalené USB
Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
KrutyUkrutnik
- Návštěvník
- Příspěvky: 16
- Registrován: 31 kvě 2008 11:36
Re: Zpomalené USB
ComboFix 10-02-07.08 - chces_tvaruzek 08.02.2010 19:11:43.6.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1613 [GMT 1:00]
Spuštěný z: d:\downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\EventSystem.log
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\SIntf16.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-08 do 2010-02-08 )))))))))))))))))))))))))))))))
.
2010-02-08 15:32 . 2010-02-08 15:32 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-08 15:32 . 2009-11-22 14:42 69000 ----a-w- c:\windows\system32\zlcomm.dll
2010-02-08 15:32 . 2009-11-22 14:42 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2010-02-08 15:32 . 2009-11-22 14:42 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2010-02-08 15:32 . 2010-02-08 15:32 -------- d-----w- c:\windows\system32\ZoneLabs
2010-02-08 15:28 . 2010-02-08 15:28 -------- d-----w- c:\program files\Zone Labs
2010-02-08 15:28 . 2010-02-08 18:01 -------- d-----w- c:\windows\Internet Logs
2010-02-03 16:05 . 2010-02-03 16:05 -------- d-----w- c:\program files\DigiDNA
2010-02-02 15:35 . 2010-02-02 15:39 16 ----a-w- c:\windows\system32\utinfo.dat
2010-02-02 15:35 . 2009-08-17 20:02 20552 ----a-w- c:\windows\system32\drivers\utdrv.sys
2010-02-02 15:35 . 2010-02-02 15:40 -------- d-----w- c:\program files\USBTrace
2010-02-02 15:18 . 2010-02-02 15:18 -------- d-----w- c:\program files\iPod
2010-02-02 15:18 . 2010-02-02 15:20 -------- d-----w- c:\program files\iTunes
2010-02-01 15:58 . 2010-02-01 15:58 -------- d-----w- c:\program files\Winamp Detect
2010-02-01 14:14 . 2010-02-01 14:14 -------- d-----w- c:\program files\Stanza
2010-01-31 18:34 . 2010-01-31 18:35 -------- d-----w- c:\program files\USBInfo
2010-01-31 17:07 . 2010-01-31 17:08 -------- d-----w- c:\program files\Cacheman
2010-01-29 00:15 . 2010-01-29 00:16 -------- d-----w- c:\program files\iBrick
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\Techlogg.com ToneShop
2010-01-28 19:29 . 2010-01-28 19:29 -------- d-----w- c:\program files\Air Mouse
2010-01-28 18:25 . 2010-01-28 18:25 -------- d-----w- c:\program files\Logitech Touch Mouse Server
2010-01-26 23:21 . 2010-01-26 23:21 -------- d-----w- c:\windows\Downloaded Installations
2010-01-26 17:56 . 2010-01-26 17:56 -------- d-----w- c:\program files\!iPhone utilities
2010-01-26 17:12 . 2010-01-26 21:44 -------- d-----w- c:\program files\SharePod
2010-01-26 14:35 . 2010-02-01 14:38 -------- d-----w- c:\program files\Bonjour
2010-01-26 14:34 . 2010-01-26 14:34 -------- d-----w- c:\program files\QuickTime
2010-01-26 14:30 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-01-22 20:56 . 2010-01-22 20:56 -------- d-----w- c:\program files\TryMedia
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 18:08 . 2008-09-25 16:42 4718592 ----a-w- c:\documents and settings\chces_tvaruzek\NTUSER.DAT
2010-02-08 16:30 . 2009-04-13 21:50 -------- d-----w- c:\program files\Garena_official
2010-02-04 13:03 . 2009-05-08 17:55 -------- d-----w- c:\program files\ParadisePoker
2010-02-02 23:32 . 2008-09-25 18:09 -------- d-----w- c:\program files\SpeedFan
2010-02-02 15:18 . 2008-11-25 09:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-01 15:59 . 2008-09-25 21:15 -------- d-----w- c:\program files\Winamp
2010-02-01 09:39 . 2009-01-26 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 18:34 . 2008-11-20 14:07 249856 ------w- c:\windows\Setup1.exe
2010-01-31 18:34 . 2008-11-20 14:07 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-27 17:45 . 2008-09-25 16:44 -------- d-----w- c:\program files\totalcmd
2010-01-26 20:34 . 2009-05-28 20:04 -------- d-----w- c:\program files\Orbitdownloader
2010-01-07 15:07 . 2009-01-26 21:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-01-26 21:25 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 18:49 . 2009-04-09 20:25 -------- d-----w- c:\program files\Garena
2010-01-04 18:24 . 2010-01-04 18:24 -------- d-----w- c:\program files\PFPortChecker
2009-12-30 11:21 . 2009-02-04 22:32 -------- d-----w- c:\program files\WEPOS
2009-11-21 08:46 . 2009-11-21 08:46 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-11-20 21:34 . 2004-07-17 09:36 28400 ----a-w- c:\windows\system32\drivers\secdrv.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"Cacheman"="c:\progra~1\Cacheman\Cacheman.exe" [2003-07-31 1290752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 53248]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-11 1236992]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 421888]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
c:\documents and settings\chces_tvaruzek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-9-25 2860792]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Air Mouse.lnk - c:\program files\Air Mouse\Air Mouse\Air Mouse.exe [2010-1-21 505344]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-26 13:47 229376 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Acer Empowering Technology.lnk]
backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Handwizard.lnk]
backup=c:\windows\pss\Handwizard.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^chces_tvaruzek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dni]
2007-01-06 17:16 753664 ----a-w- c:\program files\365dníNET\365dniNET.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
2006-03-15 20:12 579584 ----a-w- c:\acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2006-05-30 10:11 421888 ----a-w- c:\acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-30 15:28 133104 ----atw- c:\documents and settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 18:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:58 1667584 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-11-10 14:07 1253376 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-12-03 11:47 1205760 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-19 09:59 1217808 ----a-w- c:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
2008-08-03 15:38 61440 ----a-w- d:\gry\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Garena_official\\Garena.exe"=
"d:\\gry\\UO\\client.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\gry\\CS NS\\cstrike.exe"=
"c:\\games\\Turbine Download Manager\\TurbineMessageService.exe"=
"c:\\games\\Turbine Download Manager\\TurbineNetworkService.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\counter-strike source\\hl2.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\Garena\\Garena Host Bot v1.0\\GarenaHostBot.exe"=
"c:\\Program Files\\Garena\\Garena Host Bot v1.0\\ghost.exe"=
"d:\\gry\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"d:\\gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program Files\\Air Mouse\\Air Mouse\\Air Mouse.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\Stanza.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:GAYARENA
"6113:TCP"= 6113:TCP:GAYARENA
"6114:TCP"= 6114:TCP:GAYARENA
"6115:TCP"= 6115:TCP:GAYARENA
"6116:TCP"= 6116:TCP:GAYARENA
"6117:TCP"= 6117:TCP:GAYARENA
"6118:TCP"= 6118:TCP:GAYARENA
"6119:TCP"= 6119:TCP:GAYARENA
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [12.10.2008 19:48 17952]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [1.7.2008 9:04 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1.7.2008 9:02 468224]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.10.2008 15:01 717296]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [8.11.2008 13:38 93440]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp --> c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp [?]
S3 LiveTurbineMessageService;Turbine Message Service - Live;c:\games\Turbine Download Manager\TurbineMessageService.exe [14.10.2009 21:21 267760]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;c:\games\Turbine Download Manager\TurbineNetworkService.exe [14.10.2009 21:21 218608]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 18:31 42000]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ptiusbf;PTI USB Filter;c:\windows\system32\drivers\ptiusbf.sys [14.4.2001 0:22 22474]
S3 utdrv;utdrv;c:\windows\system32\drivers\utdrv.sys [2.2.2010 16:35 20552]
.
Obsah adresáře 'Naplánované úlohy'
2010-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.respekt.cz
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-mspaint - c:\windows\system32\Paint.exe
AddRemove-Worms Armageddon - d:\gry\WORMSA~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 19:17
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
.
Celkový čas: 2010-02-08 19:19:39
ComboFix-quarantined-files.txt 2010-02-08 18:19
ComboFix2.txt 2009-11-04 10:06
Před spuštěním: 4 980 215 808
Po spuštění: 4 965 552 128
- - End Of File - - 0DC41B853C9347A1CD37C8D5E88883F6
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1613 [GMT 1:00]
Spuštěný z: d:\downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\EventSystem.log
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\SIntf16.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-08 do 2010-02-08 )))))))))))))))))))))))))))))))
.
2010-02-08 15:32 . 2010-02-08 15:32 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-08 15:32 . 2009-11-22 14:42 69000 ----a-w- c:\windows\system32\zlcomm.dll
2010-02-08 15:32 . 2009-11-22 14:42 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2010-02-08 15:32 . 2009-11-22 14:42 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2010-02-08 15:32 . 2010-02-08 15:32 -------- d-----w- c:\windows\system32\ZoneLabs
2010-02-08 15:28 . 2010-02-08 15:28 -------- d-----w- c:\program files\Zone Labs
2010-02-08 15:28 . 2010-02-08 18:01 -------- d-----w- c:\windows\Internet Logs
2010-02-03 16:05 . 2010-02-03 16:05 -------- d-----w- c:\program files\DigiDNA
2010-02-02 15:35 . 2010-02-02 15:39 16 ----a-w- c:\windows\system32\utinfo.dat
2010-02-02 15:35 . 2009-08-17 20:02 20552 ----a-w- c:\windows\system32\drivers\utdrv.sys
2010-02-02 15:35 . 2010-02-02 15:40 -------- d-----w- c:\program files\USBTrace
2010-02-02 15:18 . 2010-02-02 15:18 -------- d-----w- c:\program files\iPod
2010-02-02 15:18 . 2010-02-02 15:20 -------- d-----w- c:\program files\iTunes
2010-02-01 15:58 . 2010-02-01 15:58 -------- d-----w- c:\program files\Winamp Detect
2010-02-01 14:14 . 2010-02-01 14:14 -------- d-----w- c:\program files\Stanza
2010-01-31 18:34 . 2010-01-31 18:35 -------- d-----w- c:\program files\USBInfo
2010-01-31 17:07 . 2010-01-31 17:08 -------- d-----w- c:\program files\Cacheman
2010-01-29 00:15 . 2010-01-29 00:16 -------- d-----w- c:\program files\iBrick
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\Techlogg.com ToneShop
2010-01-28 19:29 . 2010-01-28 19:29 -------- d-----w- c:\program files\Air Mouse
2010-01-28 18:25 . 2010-01-28 18:25 -------- d-----w- c:\program files\Logitech Touch Mouse Server
2010-01-26 23:21 . 2010-01-26 23:21 -------- d-----w- c:\windows\Downloaded Installations
2010-01-26 17:56 . 2010-01-26 17:56 -------- d-----w- c:\program files\!iPhone utilities
2010-01-26 17:12 . 2010-01-26 21:44 -------- d-----w- c:\program files\SharePod
2010-01-26 14:35 . 2010-02-01 14:38 -------- d-----w- c:\program files\Bonjour
2010-01-26 14:34 . 2010-01-26 14:34 -------- d-----w- c:\program files\QuickTime
2010-01-26 14:30 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-01-22 20:56 . 2010-01-22 20:56 -------- d-----w- c:\program files\TryMedia
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 18:08 . 2008-09-25 16:42 4718592 ----a-w- c:\documents and settings\chces_tvaruzek\NTUSER.DAT
2010-02-08 16:30 . 2009-04-13 21:50 -------- d-----w- c:\program files\Garena_official
2010-02-04 13:03 . 2009-05-08 17:55 -------- d-----w- c:\program files\ParadisePoker
2010-02-02 23:32 . 2008-09-25 18:09 -------- d-----w- c:\program files\SpeedFan
2010-02-02 15:18 . 2008-11-25 09:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-01 15:59 . 2008-09-25 21:15 -------- d-----w- c:\program files\Winamp
2010-02-01 09:39 . 2009-01-26 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 18:34 . 2008-11-20 14:07 249856 ------w- c:\windows\Setup1.exe
2010-01-31 18:34 . 2008-11-20 14:07 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-27 17:45 . 2008-09-25 16:44 -------- d-----w- c:\program files\totalcmd
2010-01-26 20:34 . 2009-05-28 20:04 -------- d-----w- c:\program files\Orbitdownloader
2010-01-07 15:07 . 2009-01-26 21:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-01-26 21:25 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 18:49 . 2009-04-09 20:25 -------- d-----w- c:\program files\Garena
2010-01-04 18:24 . 2010-01-04 18:24 -------- d-----w- c:\program files\PFPortChecker
2009-12-30 11:21 . 2009-02-04 22:32 -------- d-----w- c:\program files\WEPOS
2009-11-21 08:46 . 2009-11-21 08:46 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-11-20 21:34 . 2004-07-17 09:36 28400 ----a-w- c:\windows\system32\drivers\secdrv.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"Cacheman"="c:\progra~1\Cacheman\Cacheman.exe" [2003-07-31 1290752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 53248]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-11 1236992]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 421888]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
c:\documents and settings\chces_tvaruzek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-9-25 2860792]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Air Mouse.lnk - c:\program files\Air Mouse\Air Mouse\Air Mouse.exe [2010-1-21 505344]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-26 13:47 229376 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Acer Empowering Technology.lnk]
backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Handwizard.lnk]
backup=c:\windows\pss\Handwizard.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^chces_tvaruzek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dni]
2007-01-06 17:16 753664 ----a-w- c:\program files\365dníNET\365dniNET.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
2006-03-15 20:12 579584 ----a-w- c:\acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2006-05-30 10:11 421888 ----a-w- c:\acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-30 15:28 133104 ----atw- c:\documents and settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 18:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:58 1667584 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-11-10 14:07 1253376 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-12-03 11:47 1205760 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-19 09:59 1217808 ----a-w- c:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
2008-08-03 15:38 61440 ----a-w- d:\gry\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Garena_official\\Garena.exe"=
"d:\\gry\\UO\\client.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\gry\\CS NS\\cstrike.exe"=
"c:\\games\\Turbine Download Manager\\TurbineMessageService.exe"=
"c:\\games\\Turbine Download Manager\\TurbineNetworkService.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\counter-strike source\\hl2.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\Garena\\Garena Host Bot v1.0\\GarenaHostBot.exe"=
"c:\\Program Files\\Garena\\Garena Host Bot v1.0\\ghost.exe"=
"d:\\gry\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"d:\\gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program Files\\Air Mouse\\Air Mouse\\Air Mouse.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\Stanza.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:GAYARENA
"6113:TCP"= 6113:TCP:GAYARENA
"6114:TCP"= 6114:TCP:GAYARENA
"6115:TCP"= 6115:TCP:GAYARENA
"6116:TCP"= 6116:TCP:GAYARENA
"6117:TCP"= 6117:TCP:GAYARENA
"6118:TCP"= 6118:TCP:GAYARENA
"6119:TCP"= 6119:TCP:GAYARENA
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [12.10.2008 19:48 17952]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [1.7.2008 9:04 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1.7.2008 9:02 468224]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.10.2008 15:01 717296]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [8.11.2008 13:38 93440]
S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp --> c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp [?]
S3 LiveTurbineMessageService;Turbine Message Service - Live;c:\games\Turbine Download Manager\TurbineMessageService.exe [14.10.2009 21:21 267760]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;c:\games\Turbine Download Manager\TurbineNetworkService.exe [14.10.2009 21:21 218608]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 18:31 42000]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ptiusbf;PTI USB Filter;c:\windows\system32\drivers\ptiusbf.sys [14.4.2001 0:22 22474]
S3 utdrv;utdrv;c:\windows\system32\drivers\utdrv.sys [2.2.2010 16:35 20552]
.
Obsah adresáře 'Naplánované úlohy'
2010-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.respekt.cz
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
HKLM-Run-mspaint - c:\windows\system32\Paint.exe
AddRemove-Worms Armageddon - d:\gry\WORMSA~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 19:17
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
.
Celkový čas: 2010-02-08 19:19:39
ComboFix-quarantined-files.txt 2010-02-08 18:19
ComboFix2.txt 2009-11-04 10:06
Před spuštěním: 4 980 215 808
Po spuštění: 4 965 552 128
- - End Of File - - 0DC41B853C9347A1CD37C8D5E88883F6
-
Rudy
- Site Admin
- Příspěvky: 119497
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Zpomalené USB
Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:
Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.Folder::
c:\program files\Garena
Driver::
GarenaPEngine
Collect::
c:\docume~1\CHCES_~1\LOCALS~1\Temp\YYA21.tmp
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
KrutyUkrutnik
- Návštěvník
- Příspěvky: 16
- Registrován: 31 kvě 2008 11:36
Re: Zpomalené USB
nový log
ComboFix 10-02-07.08 - chces_tvaruzek 08.02.2010 19:54:45.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1433 [GMT 1:00]
Spuštěný z: d:\downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\chces_tvaruzek\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Garena
c:\program files\Garena\AESocket.dll
c:\program files\Garena\appface.dll
c:\program files\Garena\atl71.dll
c:\program files\Garena\Avatar\boy.swf
c:\program files\Garena\Avatar\boy_s.swf
c:\program files\Garena\Avatar\girl.swf
c:\program files\Garena\Avatar\girl_s.swf
c:\program files\Garena\Avatar\unknown.swf
c:\program files\Garena\Avatar\unknown_s.swf
c:\program files\Garena\Cache\11139406_s.swf
c:\program files\Garena\Cache\1603192_s.swf
c:\program files\Garena\Cache\1802706_s.swf
c:\program files\Garena\Cache\1817996_s.swf
c:\program files\Garena\Cache\2364083_s.swf
c:\program files\Garena\Cache\2416699_s.swf
c:\program files\Garena\Cache\3075314_s.swf
c:\program files\Garena\Cache\3351446_s.swf
c:\program files\Garena\Cache\3942770_s.swf
c:\program files\Garena\Cache\4000041_s.swf
c:\program files\Garena\Cache\4255154.swf
c:\program files\Garena\Cache\4255154_s.swf
c:\program files\Garena\Cache\4389668_s.swf
c:\program files\Garena\Cache\4888330_s.swf
c:\program files\Garena\Cache\5604335_s.swf
c:\program files\Garena\Cache\7575816_s.swf
c:\program files\Garena\Cache\9534920_s.swf
c:\program files\Garena\clients.dat
c:\program files\Garena\clients2.dat
c:\program files\Garena\CommonLib.dll
c:\program files\Garena\config\bs.br.xml
c:\program files\Garena\config\bs.cn.xml
c:\program files\Garena\config\bs.en.xml
c:\program files\Garena\config\bs.id.xml
c:\program files\Garena\config\bs.pp.xml
c:\program files\Garena\config\bs.ru.xml
c:\program files\Garena\config\bs.sd.xml
c:\program files\Garena\config\bs.sp.xml
c:\program files\Garena\config\bs.th.xml
c:\program files\Garena\config\bs.tw.xml
c:\program files\Garena\config\bs.vn.xml
c:\program files\Garena\config\loccn.xml
c:\program files\Garena\config\locen.xml
c:\program files\Garena\config\lockr.xml
c:\program files\Garena\config\loctw.xml
c:\program files\Garena\config\locvn.xml
c:\program files\Garena\CS15Hook.dll
c:\program files\Garena\deps\vww.gzp
c:\program files\Garena\deps\webgame.gga
c:\program files\Garena\Detoured.dll
c:\program files\Garena\dlls\CTSys.dll
c:\program files\Garena\dlls\flags.dll
c:\program files\Garena\dlls\FPSHelper.dll
c:\program files\Garena\dlls\GFireMan.dll
c:\program files\Garena\dlls\IPvR.dll
c:\program files\Garena\dlls\PEngine.dll
c:\program files\Garena\dlls\PluginLanguage.dll
c:\program files\Garena\dlls\Sca.dll
c:\program files\Garena\dlls\WC3J.dll
c:\program files\Garena\face\1.bmp
c:\program files\Garena\face\1_m.bmp
c:\program files\Garena\face\10.bmp
c:\program files\Garena\face\10_m.bmp
c:\program files\Garena\face\11.bmp
c:\program files\Garena\face\11_m.bmp
c:\program files\Garena\face\12.bmp
c:\program files\Garena\face\12_m.bmp
c:\program files\Garena\face\13.bmp
c:\program files\Garena\face\13_m.bmp
c:\program files\Garena\face\14.bmp
c:\program files\Garena\face\14_m.bmp
c:\program files\Garena\face\15.bmp
c:\program files\Garena\face\15_m.bmp
c:\program files\Garena\face\16.bmp
c:\program files\Garena\face\16_m.bmp
c:\program files\Garena\face\17.bmp
c:\program files\Garena\face\17_m.bmp
c:\program files\Garena\face\18.bmp
c:\program files\Garena\face\18_m.bmp
c:\program files\Garena\face\19.bmp
c:\program files\Garena\face\19_m.bmp
c:\program files\Garena\face\2.bmp
c:\program files\Garena\face\2_m.bmp
c:\program files\Garena\face\20.bmp
c:\program files\Garena\face\20_m.bmp
c:\program files\Garena\face\21.bmp
c:\program files\Garena\face\21_m.bmp
c:\program files\Garena\face\22.bmp
c:\program files\Garena\face\22_m.bmp
c:\program files\Garena\face\23.bmp
c:\program files\Garena\face\23_m.bmp
c:\program files\Garena\face\24.bmp
c:\program files\Garena\face\24_m.bmp
c:\program files\Garena\face\3.bmp
c:\program files\Garena\face\3_m.bmp
c:\program files\Garena\face\4.bmp
c:\program files\Garena\face\4_m.bmp
c:\program files\Garena\face\5.bmp
c:\program files\Garena\face\5_m.bmp
c:\program files\Garena\face\6.bmp
c:\program files\Garena\face\6_m.bmp
c:\program files\Garena\face\7.bmp
c:\program files\Garena\face\7_m.bmp
c:\program files\Garena\face\8.bmp
c:\program files\Garena\face\8_m.bmp
c:\program files\Garena\face\9.bmp
c:\program files\Garena\face\9_m.bmp
c:\program files\Garena\files\files.ggz
c:\program files\Garena\FPSHook.dll
c:\program files\Garena\Gamecn.dat
c:\program files\Garena\GameConfig.xml
c:\program files\Garena\Gameen.dat
c:\program files\Garena\Gametw.dat
c:\program files\Garena\Gamevn.dat
c:\program files\Garena\Garena Host Bot v1.0\admin_user.txt
c:\program files\Garena\Garena Host Bot v1.0\BNCSutil.dll
c:\program files\Garena\Garena Host Bot v1.0\bnet.ini
c:\program files\Garena\Garena Host Bot v1.0\commands.txt
c:\program files\Garena\Garena Host Bot v1.0\Configurator.exe
c:\program files\Garena\Garena Host Bot v1.0\d3d8.dll
c:\program files\Garena\Garena Host Bot v1.0\d3d9.dll
c:\program files\Garena\Garena Host Bot v1.0\d3dx8.dll
c:\program files\Garena\Garena Host Bot v1.0\d3dx9_26.dll
c:\program files\Garena\Garena Host Bot v1.0\d3x8.dll
c:\program files\Garena\Garena Host Bot v1.0\enbconvertor.ini
c:\program files\Garena\Garena Host Bot v1.0\enbseries.ini
c:\program files\Garena\Garena Host Bot v1.0\gameloaded.txt
c:\program files\Garena\Garena Host Bot v1.0\gameover.txt
c:\program files\Garena\Garena Host Bot v1.0\GarenaHostBot.exe
c:\program files\Garena\Garena Host Bot v1.0\ghinfo.exe
c:\program files\Garena\Garena Host Bot v1.0\ghost.cfg
c:\program files\Garena\Garena Host Bot v1.0\ghost.dbs
c:\program files\Garena\Garena Host Bot v1.0\ghost.exe
c:\program files\Garena\Garena Host Bot v1.0\ghost.exe.manifest
c:\program files\Garena\Garena Host Bot v1.0\gpcomms.dll
c:\program files\Garena\Garena Host Bot v1.0\hostcounter.cfg
c:\program files\Garena\Garena Host Bot v1.0\ip-to-country.csv
c:\program files\Garena\Garena Host Bot v1.0\ipblacklist.txt
c:\program files\Garena\Garena Host Bot v1.0\language.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\English.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Russian.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Serbian.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Spanish.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Turkish.cfg
c:\program files\Garena\Garena Host Bot v1.0\libiomp5md.dll
c:\program files\Garena\Garena Host Bot v1.0\libmysql.dll
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-05 2145 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-05 2333 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-06 2237 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-07 2159 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-07 2242 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\mapcfg_tmp.txt
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\blizzard.j
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\common.j
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\map.cfg
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\map.config
c:\program files\Garena\Garena Host Bot v1.0\mars.txt
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.CRT.manifest
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.CRT.manifest.cat
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.DebugCRT.manifest
c:\program files\Garena\Garena Host Bot v1.0\modes.txt
c:\program files\Garena\Garena Host Bot v1.0\modes2.txt
c:\program files\Garena\Garena Host Bot v1.0\msvcm90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcm90d.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcp90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcp90d.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcr90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcr90d.dll
c:\program files\Garena\Garena Host Bot v1.0\mysql_create_tables_v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2-v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2.1one-v2.2one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2.2one-v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\one.ini
c:\program files\Garena\Garena Host Bot v1.0\phrases.txt
c:\program files\Garena\Garena Host Bot v1.0\phrasesh.txt
c:\program files\Garena\Garena Host Bot v1.0\phrasest.txt
c:\program files\Garena\Garena Host Bot v1.0\providers.txt
c:\program files\Garena\Garena Host Bot v1.0\Readme.nfo
c:\program files\Garena\Garena Host Bot v1.0\rir.txt
c:\program files\Garena\Garena Host Bot v1.0\Skins\Andromeda.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\AquaT.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\AquaT2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Bionix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Bionix2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlackBrilliant.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlackBrilliant2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlueBrilliant.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\ColorExpert.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Cooller.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Corner.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\CyberObject.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix3.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Express.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\FineVector2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\GPX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\GreenLight.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Charm.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Charm2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Chrome2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\iMetal.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\IMetal_Dark.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\iMetal2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Impulse.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\InnovEx.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\LightBusiness.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\LiteMedia.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Luxery.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\MacX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\MacX2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Magnificient.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Mercury.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Dark.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Dark_Remix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\office2007_Remix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Silver.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Optima.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Optima2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Orange.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Orion.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\OrionNext.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\OSVista.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Progressive_Green.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Sirius.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Blue.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Green.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Silver.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Superiority.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Top3D.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\TopLevel.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\TopLevel2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Triton.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Triton2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UltraFX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UltraFX2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UniOS.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UniOS2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\VisionEx.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\VistaTM.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Windows7.skn
c:\program files\Garena\Garena Host Bot v1.0\Sounds\click1c.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\complete.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Game countdown started.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\incomplete.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Player got banned.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Player leaves.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Response Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Same IP Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\VIP joins.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Whisper Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\StormLib\storm.dll
c:\program files\Garena\Garena Host Bot v1.0\udpserver.dll
c:\program files\Garena\Garena Host Bot v1.0\uninstall.exe
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG1.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG2.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG3.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\uninstall.dat
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\uninstall.xml
c:\program files\Garena\Garena Host Bot v1.0\update_dota_elo.cfg
c:\program files\Garena\Garena Host Bot v1.0\update_dota_elo.exe
c:\program files\Garena\Garena Host Bot v1.0\update_w3mmd_elo.cfg
c:\program files\Garena\Garena Host Bot v1.0\update_w3mmd_elo.exe
c:\program files\Garena\Garena Host Bot v1.0\user_info.cfg
c:\program files\Garena\Garena Host Bot v1.0\user_info_tmp.cfg
c:\program files\Garena\Garena Host Bot v1.0\user_info2.cfg
c:\program files\Garena\Garena Host Bot v1.0\vcredist_x86.exe
c:\program files\Garena\Garena Host Bot v1.0\welcome.txt
c:\program files\Garena\Garena Host Bot v1.0\zlib1.dll
c:\program files\Garena\Garena Modifier.exe
c:\program files\Garena\Garena.exe
c:\program files\Garena\Garena.RPT
c:\program files\Garena\GarenaSkin.dll
c:\program files\Garena\GarenaSkin1.dll
c:\program files\Garena\GarenaTV.xml
c:\program files\Garena\GarenaTV\0.bmp
c:\program files\Garena\GarenaTV\1.bmp
c:\program files\Garena\GarenaTV\2.bmp
c:\program files\Garena\GarenaTV\3.bmp
c:\program files\Garena\GarenaTV\4.bmp
c:\program files\Garena\GarenaTV\5.bmp
c:\program files\Garena\GarenaTV\6.bmp
c:\program files\Garena\GarenaTV\cn.ggz
c:\program files\Garena\GarenaTV\cn_s.ggz
c:\program files\Garena\GarenaTV\en.ggz
c:\program files\Garena\GarenaTV\en_s.ggz
c:\program files\Garena\GarenaTV\id_s.ggz
c:\program files\Garena\GarenaTV\Thumbs.db
c:\program files\Garena\GarenaTV\tw.ggz
c:\program files\Garena\GarenaTV\tw_s.ggz
c:\program files\Garena\GarenaTV_UI.dll
c:\program files\Garena\GarenaTVHook.dll
c:\program files\Garena\GGICON.ico
c:\program files\Garena\Gn.ggz
c:\program files\Garena\gs.dat
c:\program files\Garena\hc.xml
c:\program files\Garena\Inject.dll
c:\program files\Garena\L4DSocket.dll
c:\program files\Garena\langs.xml
c:\program files\Garena\Languages\FPSGame.dll.cn
c:\program files\Garena\Languages\FPSGame.dll.en
c:\program files\Garena\Languages\FPSGame.dll.tw
c:\program files\Garena\Languages\Garena.exe.br
c:\program files\Garena\Languages\Garena.exe.cn
c:\program files\Garena\Languages\Garena.exe.en
c:\program files\Garena\Languages\Garena.exe.id
c:\program files\Garena\Languages\Garena.exe.ru
c:\program files\Garena\Languages\Garena.exe.sp
c:\program files\Garena\Languages\Garena.exe.th
c:\program files\Garena\Languages\Garena.exe.tw
c:\program files\Garena\Languages\Garena.exe.vn
c:\program files\Garena\Languages\GarenaTV_UI.dll.cn
c:\program files\Garena\Languages\GarenaTV_UI.dll.en
c:\program files\Garena\Languages\GarenaTV_UI.dll.id
c:\program files\Garena\Languages\GarenaTV_UI.dll.tw
c:\program files\Garena\Languages\languages.glf
c:\program files\Garena\Languages\update.exe.cn
c:\program files\Garena\Languages\update.exe.tw
c:\program files\Garena\Languages\update2.exe.cn
c:\program files\Garena\Languages\update2.exe.tw
c:\program files\Garena\Languages\WC3Ass.dll.cn
c:\program files\Garena\Languages\WC3Ass.dll.en
c:\program files\Garena\Languages\WC3Ass.dll.tw
c:\program files\Garena\Languages\WC3Ass.dll.vn
c:\program files\Garena\Languages\WC3Ladder.dll.cn
c:\program files\Garena\Languages\WC3Ladder.dll.en
c:\program files\Garena\Languages\WC3Ladder.dll.tw
c:\program files\Garena\layout\BlackShotView.layout
c:\program files\Garena\layout\layout.ggz
c:\program files\Garena\lib\BlackShot.dll
c:\program files\Garena\lib\common\Language.dll
c:\program files\Garena\lib\exchndl.dll
c:\program files\Garena\lib\GarenaRoomSystem.dll
c:\program files\Garena\lib\GarenaWebService.dll
c:\program files\Garena\lib\HttpLayer.dll
c:\program files\Garena\lib\Language.dll
c:\program files\Garena\lib\Layout.dll
c:\program files\Garena\lib\LibPlugin.ggz
c:\program files\Garena\lib\LoadSwf.dll
c:\program files\Garena\lib\MessagePumpLib.dll
c:\program files\Garena\lib\NetworkLayer.dll
c:\program files\Garena\lib\PKCS.dll
c:\program files\Garena\lib\RSA.dll
c:\program files\Garena\lib\WebCache.dll
c:\program files\Garena\MapHack for v1.20e.exe
c:\program files\Garena\Maphack For v1.22.exe
c:\program files\Garena\mdata.ggz
c:\program files\Garena\PluginKernel.dll
c:\program files\Garena\plugins\Game\GarenaTVRecorder.dll
c:\program files\Garena\plugins\Game\WC3Ass.dll
c:\program files\Garena\plugins\Game\WC3Ladder.dll
c:\program files\Garena\plugins\Game\WC3VC.dll
c:\program files\Garena\plugins\MPQWriter.dll
c:\program files\Garena\plugins\Plugins.ggz
c:\program files\Garena\plugins\UI\AdPlugin.dll
c:\program files\Garena\plugins\UI\AdPlugin\close_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\close_rollover.bmp
c:\program files\Garena\plugins\UI\AdPlugin\down_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\down_rollover.bmp
c:\program files\Garena\plugins\UI\AdPlugin\skinmsn.bmp
c:\program files\Garena\plugins\UI\AdPlugin\up_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\up_rollover.bmp
c:\program files\Garena\plugins\UI\AvoidCrackPlugin.dll
c:\program files\Garena\plugins\UI\BlackShotPlugin.dll
c:\program files\Garena\plugins\UI\CafeLogin.dll
c:\program files\Garena\plugins\UI\FavListUIPlugin.dll
c:\program files\Garena\plugins\UI\FPSGame.dll
c:\program files\Garena\plugins\UI\GarenaTV.dll
c:\program files\Garena\plugins\UI\GarenaTVRecUI.dll
c:\program files\Garena\plugins\UI\GEngine.dll
c:\program files\Garena\plugins\UI\Chenyx.dll
c:\program files\Garena\plugins\UI\ManagePlugin.dll
c:\program files\Garena\plugins\UI\StatPlugin.dll
c:\program files\Garena\plugins\UI\ViwawaPlugin.dll
c:\program files\Garena\plugins\UI\WebGameUI.dll
c:\program files\Garena\plugins\UI\zDep.dll
c:\program files\Garena\plugins\UI\zzzPlugin.dll
c:\program files\Garena\plugins\WelcomePlugin.dll
c:\program files\Garena\RecConfig.xml
c:\program files\Garena\Roomcn.dat
c:\program files\Garena\Roomen.dat
c:\program files\Garena\Roomtw.dat
c:\program files\Garena\server.xml
c:\program files\Garena\shop\items\1.gif
c:\program files\Garena\shop\items\100.gif
c:\program files\Garena\shop\items\105.gif
c:\program files\Garena\shop\items\150.gif
c:\program files\Garena\shop\items\151.gif
c:\program files\Garena\shop\items\2.gif
c:\program files\Garena\shop\items\200.gif
c:\program files\Garena\shop\items\201.gif
c:\program files\Garena\shop\items\202.gif
c:\program files\Garena\shop\items\203.gif
c:\program files\Garena\shop\items\204.gif
c:\program files\Garena\shop\items\205.gif
c:\program files\Garena\shop\items\206.gif
c:\program files\Garena\shop\items\21.gif
c:\program files\Garena\shop\items\22.gif
c:\program files\Garena\shop\items\23.gif
c:\program files\Garena\shop\items\24.gif
c:\program files\Garena\shop\items\3.gif
c:\program files\Garena\shop\items\300.gif
c:\program files\Garena\shop\items\301.gif
c:\program files\Garena\shop\items\302.gif
c:\program files\Garena\shop\items\303.gif
c:\program files\Garena\shop\items\304.gif
c:\program files\Garena\shop\items\305.gif
c:\program files\Garena\shop\items\306.gif
c:\program files\Garena\shop\items\307.gif
c:\program files\Garena\shop\items\308.gif
c:\program files\Garena\shop\items\309.gif
c:\program files\Garena\shop\items\310.gif
c:\program files\Garena\shop\items\311.gif
c:\program files\Garena\shop\items\312.gif
c:\program files\Garena\shop\items\313.gif
c:\program files\Garena\shop\items\4.gif
c:\program files\Garena\shop\items\40.gif
c:\program files\Garena\shop\items\60.gif
c:\program files\Garena\shop\items\61.gif
c:\program files\Garena\shop\items\62.gif
c:\program files\Garena\shop\items\63.gif
c:\program files\Garena\shop\items\64.gif
c:\program files\Garena\shop\items\65.gif
c:\program files\Garena\shop\items\66.gif
c:\program files\Garena\shop\items\67.gif
c:\program files\Garena\shop\items\68.gif
c:\program files\Garena\shop\items\69.gif
c:\program files\Garena\shop\items\70.gif
c:\program files\Garena\shop\items\8.gif
c:\program files\Garena\shop\items\Thumbs.db
c:\program files\Garena\Skin\Flags\-.gif
c:\program files\Garena\Skin\Flags\ad.gif
c:\program files\Garena\Skin\Flags\ae.gif
c:\program files\Garena\Skin\Flags\af.gif
c:\program files\Garena\Skin\Flags\ag.gif
c:\program files\Garena\Skin\Flags\ai.gif
c:\program files\Garena\Skin\Flags\al.gif
c:\program files\Garena\Skin\Flags\am.gif
c:\program files\Garena\Skin\Flags\an.gif
c:\program files\Garena\Skin\Flags\ao.gif
c:\program files\Garena\Skin\Flags\aq.gif
c:\program files\Garena\Skin\Flags\ar.gif
c:\program files\Garena\Skin\Flags\as.gif
c:\program files\Garena\Skin\Flags\at.gif
c:\program files\Garena\Skin\Flags\au.gif
c:\program files\Garena\Skin\Flags\aw.gif
c:\program files\Garena\Skin\Flags\az.gif
c:\program files\Garena\Skin\Flags\ba.gif
c:\program files\Garena\Skin\Flags\bb.gif
c:\program files\Garena\Skin\Flags\bd.gif
c:\program files\Garena\Skin\Flags\be.gif
c:\program files\Garena\Skin\Flags\bf.gif
c:\program files\Garena\Skin\Flags\bg.gif
c:\program files\Garena\Skin\Flags\bh.gif
c:\program files\Garena\Skin\Flags\bi.gif
c:\program files\Garena\Skin\Flags\bj.gif
c:\program files\Garena\Skin\Flags\bm.gif
c:\program files\Garena\Skin\Flags\bn.gif
c:\program files\Garena\Skin\Flags\bo.gif
c:\program files\Garena\Skin\Flags\br.gif
c:\program files\Garena\Skin\Flags\bs.gif
c:\program files\Garena\Skin\Flags\bt.gif
c:\program files\Garena\Skin\Flags\bv.gif
c:\program files\Garena\Skin\Flags\bw.gif
c:\program files\Garena\Skin\Flags\by.gif
c:\program files\Garena\Skin\Flags\bz.gif
c:\program files\Garena\Skin\Flags\ca.gif
c:\program files\Garena\Skin\Flags\cd.gif
c:\program files\Garena\Skin\Flags\cf.gif
c:\program files\Garena\Skin\Flags\cg.gif
c:\program files\Garena\Skin\Flags\ci.gif
c:\program files\Garena\Skin\Flags\ck.gif
c:\program files\Garena\Skin\Flags\cl.gif
c:\program files\Garena\Skin\Flags\cm.gif
c:\program files\Garena\Skin\Flags\cn.gif
c:\program files\Garena\Skin\Flags\co.gif
c:\program files\Garena\Skin\Flags\cr.gif
c:\program files\Garena\Skin\Flags\cu.gif
c:\program files\Garena\Skin\Flags\cv.gif
c:\program files\Garena\Skin\Flags\cy.gif
c:\program files\Garena\Skin\Flags\cz.gif
c:\program files\Garena\Skin\Flags\de.gif
c:\program files\Garena\Skin\Flags\dj.gif
c:\program files\Garena\Skin\Flags\dk.gif
c:\program files\Garena\Skin\Flags\dm.gif
c:\program files\Garena\Skin\Flags\do.gif
c:\program files\Garena\Skin\Flags\dz.gif
c:\program files\Garena\Skin\Flags\ec.gif
c:\program files\Garena\Skin\Flags\ee.gif
c:\program files\Garena\Skin\Flags\eg.gif
c:\program files\Garena\Skin\Flags\er.gif
c:\program files\Garena\Skin\Flags\es.gif
c:\program files\Garena\Skin\Flags\et.gif
c:\program files\Garena\Skin\Flags\eu.gif
c:\program files\Garena\Skin\Flags\fi.gif
c:\program files\Garena\Skin\Flags\fj.gif
c:\program files\Garena\Skin\Flags\fk.gif
c:\program files\Garena\Skin\Flags\fm.gif
c:\program files\Garena\Skin\Flags\fo.gif
c:\program files\Garena\Skin\Flags\fr.gif
c:\program files\Garena\Skin\Flags\fx.gif
c:\program files\Garena\Skin\Flags\ga.gif
c:\program files\Garena\Skin\Flags\gb.gif
c:\program files\Garena\Skin\Flags\gd.gif
c:\program files\Garena\Skin\Flags\ge.gif
c:\program files\Garena\Skin\Flags\gh.gif
c:\program files\Garena\Skin\Flags\gi.gif
c:\program files\Garena\Skin\Flags\gl.gif
c:\program files\Garena\Skin\Flags\gm.gif
c:\program files\Garena\Skin\Flags\gn.gif
c:\program files\Garena\Skin\Flags\gp.gif
c:\program files\Garena\Skin\Flags\gq.gif
c:\program files\Garena\Skin\Flags\gr.gif
c:\program files\Garena\Skin\Flags\gt.gif
c:\program files\Garena\Skin\Flags\gu.gif
c:\program files\Garena\Skin\Flags\gw.gif
c:\program files\Garena\Skin\Flags\gy.gif
c:\program files\Garena\Skin\Flags\hk.gif
c:\program files\Garena\Skin\Flags\hm.gif
c:\program files\Garena\Skin\Flags\hn.gif
c:\program files\Garena\Skin\Flags\hr.gif
c:\program files\Garena\Skin\Flags\ht.gif
c:\program files\Garena\Skin\Flags\hu.gif
c:\program files\Garena\Skin\Flags\ch.gif
c:\program files\Garena\Skin\Flags\id.gif
c:\program files\Garena\Skin\Flags\ie.gif
c:\program files\Garena\Skin\Flags\il.gif
c:\program files\Garena\Skin\Flags\im.gif
c:\program files\Garena\Skin\Flags\in.gif
c:\program files\Garena\Skin\Flags\io.gif
c:\program files\Garena\Skin\Flags\iq.gif
c:\program files\Garena\Skin\Flags\ir.gif
c:\program files\Garena\Skin\Flags\is.gif
c:\program files\Garena\Skin\Flags\it.gif
c:\program files\Garena\Skin\Flags\je.gif
c:\program files\Garena\Skin\Flags\jm.gif
c:\program files\Garena\Skin\Flags\jo.gif
c:\program files\Garena\Skin\Flags\jp.gif
c:\program files\Garena\Skin\Flags\ke.gif
c:\program files\Garena\Skin\Flags\kg.gif
c:\program files\Garena\Skin\Flags\kh.gif
c:\program files\Garena\Skin\Flags\ki.gif
c:\program files\Garena\Skin\Flags\km.gif
c:\program files\Garena\Skin\Flags\kn.gif
c:\program files\Garena\Skin\Flags\kp.gif
c:\program files\Garena\Skin\Flags\kr.gif
c:\program files\Garena\Skin\Flags\kw.gif
c:\program files\Garena\Skin\Flags\ky.gif
c:\program files\Garena\Skin\Flags\kz.gif
c:\program files\Garena\Skin\Flags\la.gif
c:\program files\Garena\Skin\Flags\lb.gif
c:\program files\Garena\Skin\Flags\lc.gif
c:\program files\Garena\Skin\Flags\li.gif
c:\program files\Garena\Skin\Flags\lk.gif
c:\program files\Garena\Skin\Flags\lr.gif
c:\program files\Garena\Skin\Flags\ls.gif
c:\program files\Garena\Skin\Flags\lt.gif
c:\program files\Garena\Skin\Flags\lu.gif
c:\program files\Garena\Skin\Flags\lv.gif
c:\program files\Garena\Skin\Flags\ly.gif
c:\program files\Garena\Skin\Flags\ma.gif
c:\program files\Garena\Skin\Flags\mc.gif
c:\program files\Garena\Skin\Flags\md.gif
c:\program files\Garena\Skin\Flags\me.gif
c:\program files\Garena\Skin\Flags\mg.gif
c:\program files\Garena\Skin\Flags\mh.gif
c:\program files\Garena\Skin\Flags\mk.gif
c:\program files\Garena\Skin\Flags\ml.gif
c:\program files\Garena\Skin\Flags\mm.gif
c:\program files\Garena\Skin\Flags\mn.gif
c:\program files\Garena\Skin\Flags\mo.gif
c:\program files\Garena\Skin\Flags\mp.gif
c:\program files\Garena\Skin\Flags\mq.gif
c:\program files\Garena\Skin\Flags\mr.gif
c:\program files\Garena\Skin\Flags\ms.gif
c:\program files\Garena\Skin\Flags\mt.gif
c:\program files\Garena\Skin\Flags\mu.gif
c:\program files\Garena\Skin\Flags\mv.gif
c:\program files\Garena\Skin\Flags\mw.gif
c:\program files\Garena\Skin\Flags\mx.gif
c:\program files\Garena\Skin\Flags\my.gif
c:\program files\Garena\Skin\Flags\mz.gif
c:\program files\Garena\Skin\Flags\na.gif
c:\program files\Garena\Skin\Flags\nc.gif
c:\program files\Garena\Skin\Flags\ne.gif
c:\program files\Garena\Skin\Flags\nf.gif
c:\program files\Garena\Skin\Flags\ng.gif
c:\program files\Garena\Skin\Flags\ni.gif
c:\program files\Garena\Skin\Flags\nl.gif
c:\program files\Garena\Skin\Flags\no.gif
c:\program files\Garena\Skin\Flags\np.gif
c:\program files\Garena\Skin\Flags\nr.gif
c:\program files\Garena\Skin\Flags\nz.gif
c:\program files\Garena\Skin\Flags\om.gif
c:\program files\Garena\Skin\Flags\pa.gif
c:\program files\Garena\Skin\Flags\pe.gif
c:\program files\Garena\Skin\Flags\pf.gif
c:\program files\Garena\Skin\Flags\pg.gif
c:\program files\Garena\Skin\Flags\ph.gif
c:\program files\Garena\Skin\Flags\pk.gif
c:\program files\Garena\Skin\Flags\pl.gif
c:\program files\Garena\Skin\Flags\pm.gif
c:\program files\Garena\Skin\Flags\pr.gif
c:\program files\Garena\Skin\Flags\ps.gif
c:\program files\Garena\Skin\Flags\pt.gif
c:\program files\Garena\Skin\Flags\pw.gif
c:\program files\Garena\Skin\Flags\py.gif
c:\program files\Garena\Skin\Flags\qa.gif
c:\program files\Garena\Skin\Flags\re.gif
c:\program files\Garena\Skin\Flags\ro.gif
c:\program files\Garena\Skin\Flags\rs.gif
c:\program files\Garena\Skin\Flags\ru.gif
c:\program files\Garena\Skin\Flags\rw.gif
c:\program files\Garena\Skin\Flags\sa.gif
c:\program files\Garena\Skin\Flags\sb.gif
c:\program files\Garena\Skin\Flags\sc.gif
c:\program files\Garena\Skin\Flags\sd.gif
c:\program files\Garena\Skin\Flags\se.gif
c:\program files\Garena\Skin\Flags\sg.gif
c:\program files\Garena\Skin\Flags\si.gif
c:\program files\Garena\Skin\Flags\sk.gif
c:\program files\Garena\Skin\Flags\sl.gif
c:\program files\Garena\Skin\Flags\sm.gif
c:\program files\Garena\Skin\Flags\sn.gif
c:\program files\Garena\Skin\Flags\so.gif
c:\program files\Garena\Skin\Flags\sr.gif
c:\program files\Garena\Skin\Flags\st.gif
c:\program files\Garena\Skin\Flags\sv.gif
c:\program files\Garena\Skin\Flags\sy.gif
c:\program files\Garena\Skin\Flags\sz.gif
c:\program files\Garena\Skin\Flags\tc.gif
c:\program files\Garena\Skin\Flags\td.gif
c:\program files\Garena\Skin\Flags\tf.gif
c:\program files\Garena\Skin\Flags\tg.gif
c:\program files\Garena\Skin\Flags\th.gif
c:\program files\Garena\Skin\Flags\Thumbs.db
c:\program files\Garena\Skin\Flags\tj.gif
c:\program files\Garena\Skin\Flags\tm.gif
c:\program files\Garena\Skin\Flags\tn.gif
c:\program files\Garena\Skin\Flags\to.gif
c:\program files\Garena\Skin\Flags\tp.gif
c:\program files\Garena\Skin\Flags\tr.gif
c:\program files\Garena\Skin\Flags\tt.gif
c:\program files\Garena\Skin\Flags\tv.gif
c:\program files\Garena\Skin\Flags\tw.gif
c:\program files\Garena\Skin\Flags\tz.gif
c:\program files\Garena\Skin\Flags\ua.gif
c:\program files\Garena\Skin\Flags\ug.gif
c:\program files\Garena\Skin\Flags\uk.gif
c:\program files\Garena\Skin\Flags\um.gif
c:\program files\Garena\Skin\Flags\us.gif
c:\program files\Garena\Skin\Flags\uy.gif
c:\program files\Garena\Skin\Flags\uz.gif
c:\program files\Garena\Skin\Flags\va.gif
c:\program files\Garena\Skin\Flags\vc.gif
c:\program files\Garena\Skin\Flags\ve.gif
c:\program files\Garena\Skin\Flags\vg.gif
c:\program files\Garena\Skin\Flags\vi.gif
c:\program files\Garena\Skin\Flags\vn.gif
c:\program files\Garena\Skin\Flags\vu.gif
c:\program files\Garena\Skin\Flags\ws.gif
c:\program files\Garena\Skin\Flags\ye.gif
c:\program files\Garena\Skin\Flags\yu.gif
c:\program files\Garena\Skin\Flags\za.gif
c:\program files\Garena\Skin\Flags\zm.gif
c:\program files\Garena\Skin\Flags\zr.gif
c:\program files\Garena\Skin\Flags\zw.gif
c:\program files\Garena\Skin\garenatv.ggz
c:\program files\Garena\Skin\READ FIRST!!!.txt
c:\program files\Garena\Skin\skin.ggz
c:\program files\Garena\skin_bs\garenatv.ggz
c:\program files\Garena\skin_bs\Skin.ggz
c:\program files\Garena\Skins.xml
c:\program files\Garena\SocketHook.dll
c:\program files\Garena\sound\folder.wav
c:\program files\Garena\sound\game.wav
c:\program files\Garena\sound\msg.wav
c:\program files\Garena\sound\nudge.wav
c:\program files\Garena\sound\quit.wav
c:\program files\Garena\sound\ring.wav
c:\program files\Garena\sound\sysmsg.wav
c:\program files\Garena\source.xml
c:\program files\Garena\sqlite3.dll
c:\program files\Garena\uninst.exe
c:\program files\Garena\update.dat
c:\program files\Garena\update.exe
c:\program files\Garena\update.xml
c:\program files\Garena\update2.exe
c:\program files\Garena\user.xml
c:\program files\Garena\user\10359800\ban.dat
c:\program files\Garena\user\10359800\data.dat
c:\program files\Garena\user\10359800\fps.dat
c:\program files\Garena\user\10359800\recent.txt
c:\program files\Garena\user\10359800\wc3ass.dat
c:\program files\Garena\viwawa.cn.xml
c:\program files\Garena\viwawa.en.xml
c:\program files\Garena\viwawa.tw.xml
c:\program files\Garena\War3Hook.dll
c:\program files\Garena\web\1.cn.html
c:\program files\Garena\web\1.en.html
c:\program files\Garena\web\1.tw.html
c:\program files\Garena\web\2.cn.html
c:\program files\Garena\web\2.en.html
c:\program files\Garena\web\2.tw.html
c:\program files\Garena\web\3.cn.html
c:\program files\Garena\web\3.en.html
c:\program files\Garena\web\3.tw.html
c:\program files\Garena\web\6.cn.html
c:\program files\Garena\web\6.en.html
c:\program files\Garena\web\6.tw.html
c:\program files\Garena\web\cache\Freesky\css\foemb_2.css
c:\program files\Garena\web\cache\Freesky\img\do_bg2.jpg
c:\program files\Garena\web\cache\Freesky\img\do_btn.jpg
c:\program files\Garena\web\cache\Freesky\img\ggbackground.jpg
c:\program files\Garena\web\cache\RUpoker\css\pokerembed.css
c:\program files\Garena\web\cache\RUpoker\img\bg.jpg
c:\program files\Garena\web\cache\RUpoker\img\btn.jpg
c:\program files\Garena\web\cache\RUpoker\img\ggbackground.jpg
c:\program files\Garena\web\embed_game.jpg
c:\program files\Garena\web\embed_game_cn.jpg
c:\program files\Garena\web\embed_game_tw.jpg
c:\program files\Garena\web\embed_garenafire_ZH.jpg
c:\program files\Garena\web\embed_gfire.jpg
c:\program files\Garena\web\gfire.cn.html
c:\program files\Garena\web\gfire.en.html
c:\program files\Garena\web\gfire.tw.html
c:\program files\Garena\web\ggbackground.jpg
c:\program files\Garena\web\loading.gif
c:\program files\Garena\web\loading.html
c:\program files\Garena\web\Thumbs.db
c:\program files\Garena\YYFileSystem.dll
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GARENAPENGINE
-------\Service_GarenaPEngine
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-08 do 2010-02-08 )))))))))))))))))))))))))))))))
.
2010-02-08 15:32 . 2010-02-08 15:32 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-08 15:32 . 2009-11-22 14:42 69000 ----a-w- c:\windows\system32\zlcomm.dll
2010-02-08 15:32 . 2009-11-22 14:42 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2010-02-08 15:32 . 2009-11-22 14:42 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2010-02-08 15:32 . 2010-02-08 15:32 -------- d-----w- c:\windows\system32\ZoneLabs
2010-02-08 15:28 . 2010-02-08 15:28 -------- d-----w- c:\program files\Zone Labs
2010-02-08 15:28 . 2010-02-08 18:45 -------- d-----w- c:\windows\Internet Logs
2010-02-03 16:05 . 2010-02-03 16:05 -------- d-----w- c:\program files\DigiDNA
2010-02-02 15:35 . 2010-02-02 15:39 16 ----a-w- c:\windows\system32\utinfo.dat
2010-02-02 15:35 . 2009-08-17 20:02 20552 ----a-w- c:\windows\system32\drivers\utdrv.sys
2010-02-02 15:35 . 2010-02-02 15:40 -------- d-----w- c:\program files\USBTrace
2010-02-02 15:18 . 2010-02-02 15:18 -------- d-----w- c:\program files\iPod
2010-02-02 15:18 . 2010-02-02 15:20 -------- d-----w- c:\program files\iTunes
2010-02-01 15:58 . 2010-02-01 15:58 -------- d-----w- c:\program files\Winamp Detect
2010-02-01 14:14 . 2010-02-01 14:14 -------- d-----w- c:\program files\Stanza
2010-01-31 18:34 . 2010-01-31 18:35 -------- d-----w- c:\program files\USBInfo
2010-01-31 17:07 . 2010-01-31 17:08 -------- d-----w- c:\program files\Cacheman
2010-01-29 00:15 . 2010-01-29 00:16 -------- d-----w- c:\program files\iBrick
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\Techlogg.com ToneShop
2010-01-28 19:29 . 2010-01-28 19:29 -------- d-----w- c:\program files\Air Mouse
2010-01-28 18:25 . 2010-01-28 18:25 -------- d-----w- c:\program files\Logitech Touch Mouse Server
2010-01-26 23:21 . 2010-01-26 23:21 -------- d-----w- c:\windows\Downloaded Installations
2010-01-26 17:56 . 2010-01-26 17:56 -------- d-----w- c:\program files\!iPhone utilities
2010-01-26 17:12 . 2010-01-26 21:44 -------- d-----w- c:\program files\SharePod
2010-01-26 14:35 . 2010-02-01 14:38 -------- d-----w- c:\program files\Bonjour
2010-01-26 14:34 . 2010-01-26 14:34 -------- d-----w- c:\program files\QuickTime
2010-01-26 14:30 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-01-22 20:56 . 2010-01-22 20:56 -------- d-----w- c:\program files\TryMedia
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 19:07 . 2008-09-25 16:42 4718592 ----a-w- c:\documents and settings\chces_tvaruzek\NTUSER.DAT
2010-02-08 16:30 . 2009-04-13 21:50 -------- d-----w- c:\program files\Garena_official
2010-02-04 13:03 . 2009-05-08 17:55 -------- d-----w- c:\program files\ParadisePoker
2010-02-02 23:32 . 2008-09-25 18:09 -------- d-----w- c:\program files\SpeedFan
2010-02-02 15:18 . 2008-11-25 09:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-01 15:59 . 2008-09-25 21:15 -------- d-----w- c:\program files\Winamp
2010-02-01 09:39 . 2009-01-26 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 18:34 . 2008-11-20 14:07 249856 ------w- c:\windows\Setup1.exe
2010-01-31 18:34 . 2008-11-20 14:07 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-27 17:45 . 2008-09-25 16:44 -------- d-----w- c:\program files\totalcmd
2010-01-26 20:34 . 2009-05-28 20:04 -------- d-----w- c:\program files\Orbitdownloader
2010-01-07 15:07 . 2009-01-26 21:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-01-26 21:25 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 18:24 . 2010-01-04 18:24 -------- d-----w- c:\program files\PFPortChecker
2009-12-30 11:21 . 2009-02-04 22:32 -------- d-----w- c:\program files\WEPOS
2009-11-21 08:46 . 2009-11-21 08:46 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-11-20 21:34 . 2004-07-17 09:36 28400 ----a-w- c:\windows\system32\drivers\secdrv.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-02-08_18.17.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-08 19:09 . 2010-02-08 19:09 16384 c:\windows\Temp\Perflib_Perfdata_4e8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"Cacheman"="c:\progra~1\Cacheman\Cacheman.exe" [2003-07-31 1290752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 53248]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-11 1236992]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 421888]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
c:\documents and settings\chces_tvaruzek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-9-25 2860792]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Air Mouse.lnk - c:\program files\Air Mouse\Air Mouse\Air Mouse.exe [2010-1-21 505344]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-26 13:47 229376 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Acer Empowering Technology.lnk]
backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Handwizard.lnk]
backup=c:\windows\pss\Handwizard.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^chces_tvaruzek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dni]
2007-01-06 17:16 753664 ----a-w- c:\program files\365dníNET\365dniNET.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
2006-03-15 20:12 579584 ----a-w- c:\acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2006-05-30 10:11 421888 ----a-w- c:\acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-30 15:28 133104 ----atw- c:\documents and settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 18:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:58 1667584 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-11-10 14:07 1253376 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-12-03 11:47 1205760 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-19 09:59 1217808 ----a-w- c:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
2008-08-03 15:38 61440 ----a-w- d:\gry\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Garena_official\\Garena.exe"=
"d:\\gry\\UO\\client.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\gry\\CS NS\\cstrike.exe"=
"c:\\games\\Turbine Download Manager\\TurbineMessageService.exe"=
"c:\\games\\Turbine Download Manager\\TurbineNetworkService.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\counter-strike source\\hl2.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\day of defeat source\\hl2.exe"=
"d:\\gry\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"d:\\gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program Files\\Air Mouse\\Air Mouse\\Air Mouse.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\Stanza.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:GAYARENA
"6113:TCP"= 6113:TCP:GAYARENA
"6114:TCP"= 6114:TCP:GAYARENA
"6115:TCP"= 6115:TCP:GAYARENA
"6116:TCP"= 6116:TCP:GAYARENA
"6117:TCP"= 6117:TCP:GAYARENA
"6118:TCP"= 6118:TCP:GAYARENA
"6119:TCP"= 6119:TCP:GAYARENA
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.10.2008 15:01 717296]
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [12.10.2008 19:48 17952]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [1.7.2008 9:04 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1.7.2008 9:02 468224]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [8.11.2008 13:38 93440]
S3 LiveTurbineMessageService;Turbine Message Service - Live;c:\games\Turbine Download Manager\TurbineMessageService.exe [14.10.2009 21:21 267760]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;c:\games\Turbine Download Manager\TurbineNetworkService.exe [14.10.2009 21:21 218608]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 18:31 42000]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ptiusbf;PTI USB Filter;c:\windows\system32\drivers\ptiusbf.sys [14.4.2001 0:22 22474]
S3 utdrv;utdrv;c:\windows\system32\drivers\utdrv.sys [2.2.2010 16:35 20552]
.
Obsah adresáře 'Naplánované úlohy'
2010-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.respekt.cz
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-Garena - c:\program files\Garena\uninst.exe
AddRemove-Garena Host Bot v1.01.0 - c:\program files\Garena\Garena Host Bot v1.0\uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 20:10
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89E041F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebfc3
\Driver\ACPI -> ACPI.sys @ 0xf7246cb8
\Driver\atapi -> 0x89e041f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(956)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
- - - - - - - > 'explorer.exe'(3408)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\progra~1\COMMON~1\Stardock\MCPCore.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\tray.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\progra~1\COMMON~1\Stardock\SDMCP.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Celkový čas: 2010-02-08 20:14:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-08 19:14
ComboFix2.txt 2010-02-08 18:19
ComboFix3.txt 2009-11-04 10:06
Před spuštěním: 4 956 872 704
Po spuštění: 4 824 473 600
- - End Of File - - 10DCE8F2AA8B8BE4877D63C978DE5678
ComboFix 10-02-07.08 - chces_tvaruzek 08.02.2010 19:54:45.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1433 [GMT 1:00]
Spuštěný z: d:\downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\chces_tvaruzek\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Garena
c:\program files\Garena\AESocket.dll
c:\program files\Garena\appface.dll
c:\program files\Garena\atl71.dll
c:\program files\Garena\Avatar\boy.swf
c:\program files\Garena\Avatar\boy_s.swf
c:\program files\Garena\Avatar\girl.swf
c:\program files\Garena\Avatar\girl_s.swf
c:\program files\Garena\Avatar\unknown.swf
c:\program files\Garena\Avatar\unknown_s.swf
c:\program files\Garena\Cache\11139406_s.swf
c:\program files\Garena\Cache\1603192_s.swf
c:\program files\Garena\Cache\1802706_s.swf
c:\program files\Garena\Cache\1817996_s.swf
c:\program files\Garena\Cache\2364083_s.swf
c:\program files\Garena\Cache\2416699_s.swf
c:\program files\Garena\Cache\3075314_s.swf
c:\program files\Garena\Cache\3351446_s.swf
c:\program files\Garena\Cache\3942770_s.swf
c:\program files\Garena\Cache\4000041_s.swf
c:\program files\Garena\Cache\4255154.swf
c:\program files\Garena\Cache\4255154_s.swf
c:\program files\Garena\Cache\4389668_s.swf
c:\program files\Garena\Cache\4888330_s.swf
c:\program files\Garena\Cache\5604335_s.swf
c:\program files\Garena\Cache\7575816_s.swf
c:\program files\Garena\Cache\9534920_s.swf
c:\program files\Garena\clients.dat
c:\program files\Garena\clients2.dat
c:\program files\Garena\CommonLib.dll
c:\program files\Garena\config\bs.br.xml
c:\program files\Garena\config\bs.cn.xml
c:\program files\Garena\config\bs.en.xml
c:\program files\Garena\config\bs.id.xml
c:\program files\Garena\config\bs.pp.xml
c:\program files\Garena\config\bs.ru.xml
c:\program files\Garena\config\bs.sd.xml
c:\program files\Garena\config\bs.sp.xml
c:\program files\Garena\config\bs.th.xml
c:\program files\Garena\config\bs.tw.xml
c:\program files\Garena\config\bs.vn.xml
c:\program files\Garena\config\loccn.xml
c:\program files\Garena\config\locen.xml
c:\program files\Garena\config\lockr.xml
c:\program files\Garena\config\loctw.xml
c:\program files\Garena\config\locvn.xml
c:\program files\Garena\CS15Hook.dll
c:\program files\Garena\deps\vww.gzp
c:\program files\Garena\deps\webgame.gga
c:\program files\Garena\Detoured.dll
c:\program files\Garena\dlls\CTSys.dll
c:\program files\Garena\dlls\flags.dll
c:\program files\Garena\dlls\FPSHelper.dll
c:\program files\Garena\dlls\GFireMan.dll
c:\program files\Garena\dlls\IPvR.dll
c:\program files\Garena\dlls\PEngine.dll
c:\program files\Garena\dlls\PluginLanguage.dll
c:\program files\Garena\dlls\Sca.dll
c:\program files\Garena\dlls\WC3J.dll
c:\program files\Garena\face\1.bmp
c:\program files\Garena\face\1_m.bmp
c:\program files\Garena\face\10.bmp
c:\program files\Garena\face\10_m.bmp
c:\program files\Garena\face\11.bmp
c:\program files\Garena\face\11_m.bmp
c:\program files\Garena\face\12.bmp
c:\program files\Garena\face\12_m.bmp
c:\program files\Garena\face\13.bmp
c:\program files\Garena\face\13_m.bmp
c:\program files\Garena\face\14.bmp
c:\program files\Garena\face\14_m.bmp
c:\program files\Garena\face\15.bmp
c:\program files\Garena\face\15_m.bmp
c:\program files\Garena\face\16.bmp
c:\program files\Garena\face\16_m.bmp
c:\program files\Garena\face\17.bmp
c:\program files\Garena\face\17_m.bmp
c:\program files\Garena\face\18.bmp
c:\program files\Garena\face\18_m.bmp
c:\program files\Garena\face\19.bmp
c:\program files\Garena\face\19_m.bmp
c:\program files\Garena\face\2.bmp
c:\program files\Garena\face\2_m.bmp
c:\program files\Garena\face\20.bmp
c:\program files\Garena\face\20_m.bmp
c:\program files\Garena\face\21.bmp
c:\program files\Garena\face\21_m.bmp
c:\program files\Garena\face\22.bmp
c:\program files\Garena\face\22_m.bmp
c:\program files\Garena\face\23.bmp
c:\program files\Garena\face\23_m.bmp
c:\program files\Garena\face\24.bmp
c:\program files\Garena\face\24_m.bmp
c:\program files\Garena\face\3.bmp
c:\program files\Garena\face\3_m.bmp
c:\program files\Garena\face\4.bmp
c:\program files\Garena\face\4_m.bmp
c:\program files\Garena\face\5.bmp
c:\program files\Garena\face\5_m.bmp
c:\program files\Garena\face\6.bmp
c:\program files\Garena\face\6_m.bmp
c:\program files\Garena\face\7.bmp
c:\program files\Garena\face\7_m.bmp
c:\program files\Garena\face\8.bmp
c:\program files\Garena\face\8_m.bmp
c:\program files\Garena\face\9.bmp
c:\program files\Garena\face\9_m.bmp
c:\program files\Garena\files\files.ggz
c:\program files\Garena\FPSHook.dll
c:\program files\Garena\Gamecn.dat
c:\program files\Garena\GameConfig.xml
c:\program files\Garena\Gameen.dat
c:\program files\Garena\Gametw.dat
c:\program files\Garena\Gamevn.dat
c:\program files\Garena\Garena Host Bot v1.0\admin_user.txt
c:\program files\Garena\Garena Host Bot v1.0\BNCSutil.dll
c:\program files\Garena\Garena Host Bot v1.0\bnet.ini
c:\program files\Garena\Garena Host Bot v1.0\commands.txt
c:\program files\Garena\Garena Host Bot v1.0\Configurator.exe
c:\program files\Garena\Garena Host Bot v1.0\d3d8.dll
c:\program files\Garena\Garena Host Bot v1.0\d3d9.dll
c:\program files\Garena\Garena Host Bot v1.0\d3dx8.dll
c:\program files\Garena\Garena Host Bot v1.0\d3dx9_26.dll
c:\program files\Garena\Garena Host Bot v1.0\d3x8.dll
c:\program files\Garena\Garena Host Bot v1.0\enbconvertor.ini
c:\program files\Garena\Garena Host Bot v1.0\enbseries.ini
c:\program files\Garena\Garena Host Bot v1.0\gameloaded.txt
c:\program files\Garena\Garena Host Bot v1.0\gameover.txt
c:\program files\Garena\Garena Host Bot v1.0\GarenaHostBot.exe
c:\program files\Garena\Garena Host Bot v1.0\ghinfo.exe
c:\program files\Garena\Garena Host Bot v1.0\ghost.cfg
c:\program files\Garena\Garena Host Bot v1.0\ghost.dbs
c:\program files\Garena\Garena Host Bot v1.0\ghost.exe
c:\program files\Garena\Garena Host Bot v1.0\ghost.exe.manifest
c:\program files\Garena\Garena Host Bot v1.0\gpcomms.dll
c:\program files\Garena\Garena Host Bot v1.0\hostcounter.cfg
c:\program files\Garena\Garena Host Bot v1.0\ip-to-country.csv
c:\program files\Garena\Garena Host Bot v1.0\ipblacklist.txt
c:\program files\Garena\Garena Host Bot v1.0\language.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\English.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Russian.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Serbian.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Spanish.cfg
c:\program files\Garena\Garena Host Bot v1.0\Languages\Turkish.cfg
c:\program files\Garena\Garena Host Bot v1.0\libiomp5md.dll
c:\program files\Garena\Garena Host Bot v1.0\libmysql.dll
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-05 2145 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-05 2333 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-06 2237 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-07 2159 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\logs\2010-01-07 2242 CZ_EBOLA.html
c:\program files\Garena\Garena Host Bot v1.0\mapcfg_tmp.txt
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\blizzard.j
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\common.j
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\map.cfg
c:\program files\Garena\Garena Host Bot v1.0\mapcfgs\map.config
c:\program files\Garena\Garena Host Bot v1.0\mars.txt
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.CRT.manifest
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.CRT.manifest.cat
c:\program files\Garena\Garena Host Bot v1.0\Microsoft.VC90.DebugCRT.manifest
c:\program files\Garena\Garena Host Bot v1.0\modes.txt
c:\program files\Garena\Garena Host Bot v1.0\modes2.txt
c:\program files\Garena\Garena Host Bot v1.0\msvcm90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcm90d.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcp90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcp90d.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcr90.dll
c:\program files\Garena\Garena Host Bot v1.0\msvcr90d.dll
c:\program files\Garena\Garena Host Bot v1.0\mysql_create_tables_v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2-v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2.1one-v2.2one.sql
c:\program files\Garena\Garena Host Bot v1.0\mysql_upgrade_v2.2one-v2.3one.sql
c:\program files\Garena\Garena Host Bot v1.0\one.ini
c:\program files\Garena\Garena Host Bot v1.0\phrases.txt
c:\program files\Garena\Garena Host Bot v1.0\phrasesh.txt
c:\program files\Garena\Garena Host Bot v1.0\phrasest.txt
c:\program files\Garena\Garena Host Bot v1.0\providers.txt
c:\program files\Garena\Garena Host Bot v1.0\Readme.nfo
c:\program files\Garena\Garena Host Bot v1.0\rir.txt
c:\program files\Garena\Garena Host Bot v1.0\Skins\Andromeda.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\AquaT.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\AquaT2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Bionix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Bionix2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlackBrilliant.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlackBrilliant2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\BlueBrilliant.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\ColorExpert.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Cooller.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Corner.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\CyberObject.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Digimix3.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Express.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\FineVector2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\GPX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\GreenLight.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Charm.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Charm2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Chrome2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\iMetal.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\IMetal_Dark.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\iMetal2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Impulse.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\InnovEx.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\LightBusiness.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\LiteMedia.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Luxery.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\MacX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\MacX2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Magnificient.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Mercury.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Dark.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Dark_Remix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\office2007_Remix.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Office2007_Silver.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Optima.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Optima2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Orange.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Orion.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\OrionNext.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\OSVista.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Progressive_Green.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Sirius.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Blue.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Green.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\SmartStyle_Silver.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Superiority.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Top3D.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\TopLevel.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\TopLevel2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Triton.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Triton2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UltraFX.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UltraFX2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UniOS.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\UniOS2.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\VisionEx.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\VistaTM.skn
c:\program files\Garena\Garena Host Bot v1.0\Skins\Windows7.skn
c:\program files\Garena\Garena Host Bot v1.0\Sounds\click1c.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\complete.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Game countdown started.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\incomplete.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Player got banned.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Player leaves.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Response Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Same IP Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\VIP joins.wav
c:\program files\Garena\Garena Host Bot v1.0\Sounds\Whisper Sound.wav
c:\program files\Garena\Garena Host Bot v1.0\StormLib\storm.dll
c:\program files\Garena\Garena Host Bot v1.0\udpserver.dll
c:\program files\Garena\Garena Host Bot v1.0\uninstall.exe
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG1.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG2.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\IRIMG3.JPG
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\uninstall.dat
c:\program files\Garena\Garena Host Bot v1.0\Uninstall\uninstall.xml
c:\program files\Garena\Garena Host Bot v1.0\update_dota_elo.cfg
c:\program files\Garena\Garena Host Bot v1.0\update_dota_elo.exe
c:\program files\Garena\Garena Host Bot v1.0\update_w3mmd_elo.cfg
c:\program files\Garena\Garena Host Bot v1.0\update_w3mmd_elo.exe
c:\program files\Garena\Garena Host Bot v1.0\user_info.cfg
c:\program files\Garena\Garena Host Bot v1.0\user_info_tmp.cfg
c:\program files\Garena\Garena Host Bot v1.0\user_info2.cfg
c:\program files\Garena\Garena Host Bot v1.0\vcredist_x86.exe
c:\program files\Garena\Garena Host Bot v1.0\welcome.txt
c:\program files\Garena\Garena Host Bot v1.0\zlib1.dll
c:\program files\Garena\Garena Modifier.exe
c:\program files\Garena\Garena.exe
c:\program files\Garena\Garena.RPT
c:\program files\Garena\GarenaSkin.dll
c:\program files\Garena\GarenaSkin1.dll
c:\program files\Garena\GarenaTV.xml
c:\program files\Garena\GarenaTV\0.bmp
c:\program files\Garena\GarenaTV\1.bmp
c:\program files\Garena\GarenaTV\2.bmp
c:\program files\Garena\GarenaTV\3.bmp
c:\program files\Garena\GarenaTV\4.bmp
c:\program files\Garena\GarenaTV\5.bmp
c:\program files\Garena\GarenaTV\6.bmp
c:\program files\Garena\GarenaTV\cn.ggz
c:\program files\Garena\GarenaTV\cn_s.ggz
c:\program files\Garena\GarenaTV\en.ggz
c:\program files\Garena\GarenaTV\en_s.ggz
c:\program files\Garena\GarenaTV\id_s.ggz
c:\program files\Garena\GarenaTV\Thumbs.db
c:\program files\Garena\GarenaTV\tw.ggz
c:\program files\Garena\GarenaTV\tw_s.ggz
c:\program files\Garena\GarenaTV_UI.dll
c:\program files\Garena\GarenaTVHook.dll
c:\program files\Garena\GGICON.ico
c:\program files\Garena\Gn.ggz
c:\program files\Garena\gs.dat
c:\program files\Garena\hc.xml
c:\program files\Garena\Inject.dll
c:\program files\Garena\L4DSocket.dll
c:\program files\Garena\langs.xml
c:\program files\Garena\Languages\FPSGame.dll.cn
c:\program files\Garena\Languages\FPSGame.dll.en
c:\program files\Garena\Languages\FPSGame.dll.tw
c:\program files\Garena\Languages\Garena.exe.br
c:\program files\Garena\Languages\Garena.exe.cn
c:\program files\Garena\Languages\Garena.exe.en
c:\program files\Garena\Languages\Garena.exe.id
c:\program files\Garena\Languages\Garena.exe.ru
c:\program files\Garena\Languages\Garena.exe.sp
c:\program files\Garena\Languages\Garena.exe.th
c:\program files\Garena\Languages\Garena.exe.tw
c:\program files\Garena\Languages\Garena.exe.vn
c:\program files\Garena\Languages\GarenaTV_UI.dll.cn
c:\program files\Garena\Languages\GarenaTV_UI.dll.en
c:\program files\Garena\Languages\GarenaTV_UI.dll.id
c:\program files\Garena\Languages\GarenaTV_UI.dll.tw
c:\program files\Garena\Languages\languages.glf
c:\program files\Garena\Languages\update.exe.cn
c:\program files\Garena\Languages\update.exe.tw
c:\program files\Garena\Languages\update2.exe.cn
c:\program files\Garena\Languages\update2.exe.tw
c:\program files\Garena\Languages\WC3Ass.dll.cn
c:\program files\Garena\Languages\WC3Ass.dll.en
c:\program files\Garena\Languages\WC3Ass.dll.tw
c:\program files\Garena\Languages\WC3Ass.dll.vn
c:\program files\Garena\Languages\WC3Ladder.dll.cn
c:\program files\Garena\Languages\WC3Ladder.dll.en
c:\program files\Garena\Languages\WC3Ladder.dll.tw
c:\program files\Garena\layout\BlackShotView.layout
c:\program files\Garena\layout\layout.ggz
c:\program files\Garena\lib\BlackShot.dll
c:\program files\Garena\lib\common\Language.dll
c:\program files\Garena\lib\exchndl.dll
c:\program files\Garena\lib\GarenaRoomSystem.dll
c:\program files\Garena\lib\GarenaWebService.dll
c:\program files\Garena\lib\HttpLayer.dll
c:\program files\Garena\lib\Language.dll
c:\program files\Garena\lib\Layout.dll
c:\program files\Garena\lib\LibPlugin.ggz
c:\program files\Garena\lib\LoadSwf.dll
c:\program files\Garena\lib\MessagePumpLib.dll
c:\program files\Garena\lib\NetworkLayer.dll
c:\program files\Garena\lib\PKCS.dll
c:\program files\Garena\lib\RSA.dll
c:\program files\Garena\lib\WebCache.dll
c:\program files\Garena\MapHack for v1.20e.exe
c:\program files\Garena\Maphack For v1.22.exe
c:\program files\Garena\mdata.ggz
c:\program files\Garena\PluginKernel.dll
c:\program files\Garena\plugins\Game\GarenaTVRecorder.dll
c:\program files\Garena\plugins\Game\WC3Ass.dll
c:\program files\Garena\plugins\Game\WC3Ladder.dll
c:\program files\Garena\plugins\Game\WC3VC.dll
c:\program files\Garena\plugins\MPQWriter.dll
c:\program files\Garena\plugins\Plugins.ggz
c:\program files\Garena\plugins\UI\AdPlugin.dll
c:\program files\Garena\plugins\UI\AdPlugin\close_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\close_rollover.bmp
c:\program files\Garena\plugins\UI\AdPlugin\down_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\down_rollover.bmp
c:\program files\Garena\plugins\UI\AdPlugin\skinmsn.bmp
c:\program files\Garena\plugins\UI\AdPlugin\up_rollout.bmp
c:\program files\Garena\plugins\UI\AdPlugin\up_rollover.bmp
c:\program files\Garena\plugins\UI\AvoidCrackPlugin.dll
c:\program files\Garena\plugins\UI\BlackShotPlugin.dll
c:\program files\Garena\plugins\UI\CafeLogin.dll
c:\program files\Garena\plugins\UI\FavListUIPlugin.dll
c:\program files\Garena\plugins\UI\FPSGame.dll
c:\program files\Garena\plugins\UI\GarenaTV.dll
c:\program files\Garena\plugins\UI\GarenaTVRecUI.dll
c:\program files\Garena\plugins\UI\GEngine.dll
c:\program files\Garena\plugins\UI\Chenyx.dll
c:\program files\Garena\plugins\UI\ManagePlugin.dll
c:\program files\Garena\plugins\UI\StatPlugin.dll
c:\program files\Garena\plugins\UI\ViwawaPlugin.dll
c:\program files\Garena\plugins\UI\WebGameUI.dll
c:\program files\Garena\plugins\UI\zDep.dll
c:\program files\Garena\plugins\UI\zzzPlugin.dll
c:\program files\Garena\plugins\WelcomePlugin.dll
c:\program files\Garena\RecConfig.xml
c:\program files\Garena\Roomcn.dat
c:\program files\Garena\Roomen.dat
c:\program files\Garena\Roomtw.dat
c:\program files\Garena\server.xml
c:\program files\Garena\shop\items\1.gif
c:\program files\Garena\shop\items\100.gif
c:\program files\Garena\shop\items\105.gif
c:\program files\Garena\shop\items\150.gif
c:\program files\Garena\shop\items\151.gif
c:\program files\Garena\shop\items\2.gif
c:\program files\Garena\shop\items\200.gif
c:\program files\Garena\shop\items\201.gif
c:\program files\Garena\shop\items\202.gif
c:\program files\Garena\shop\items\203.gif
c:\program files\Garena\shop\items\204.gif
c:\program files\Garena\shop\items\205.gif
c:\program files\Garena\shop\items\206.gif
c:\program files\Garena\shop\items\21.gif
c:\program files\Garena\shop\items\22.gif
c:\program files\Garena\shop\items\23.gif
c:\program files\Garena\shop\items\24.gif
c:\program files\Garena\shop\items\3.gif
c:\program files\Garena\shop\items\300.gif
c:\program files\Garena\shop\items\301.gif
c:\program files\Garena\shop\items\302.gif
c:\program files\Garena\shop\items\303.gif
c:\program files\Garena\shop\items\304.gif
c:\program files\Garena\shop\items\305.gif
c:\program files\Garena\shop\items\306.gif
c:\program files\Garena\shop\items\307.gif
c:\program files\Garena\shop\items\308.gif
c:\program files\Garena\shop\items\309.gif
c:\program files\Garena\shop\items\310.gif
c:\program files\Garena\shop\items\311.gif
c:\program files\Garena\shop\items\312.gif
c:\program files\Garena\shop\items\313.gif
c:\program files\Garena\shop\items\4.gif
c:\program files\Garena\shop\items\40.gif
c:\program files\Garena\shop\items\60.gif
c:\program files\Garena\shop\items\61.gif
c:\program files\Garena\shop\items\62.gif
c:\program files\Garena\shop\items\63.gif
c:\program files\Garena\shop\items\64.gif
c:\program files\Garena\shop\items\65.gif
c:\program files\Garena\shop\items\66.gif
c:\program files\Garena\shop\items\67.gif
c:\program files\Garena\shop\items\68.gif
c:\program files\Garena\shop\items\69.gif
c:\program files\Garena\shop\items\70.gif
c:\program files\Garena\shop\items\8.gif
c:\program files\Garena\shop\items\Thumbs.db
c:\program files\Garena\Skin\Flags\-.gif
c:\program files\Garena\Skin\Flags\ad.gif
c:\program files\Garena\Skin\Flags\ae.gif
c:\program files\Garena\Skin\Flags\af.gif
c:\program files\Garena\Skin\Flags\ag.gif
c:\program files\Garena\Skin\Flags\ai.gif
c:\program files\Garena\Skin\Flags\al.gif
c:\program files\Garena\Skin\Flags\am.gif
c:\program files\Garena\Skin\Flags\an.gif
c:\program files\Garena\Skin\Flags\ao.gif
c:\program files\Garena\Skin\Flags\aq.gif
c:\program files\Garena\Skin\Flags\ar.gif
c:\program files\Garena\Skin\Flags\as.gif
c:\program files\Garena\Skin\Flags\at.gif
c:\program files\Garena\Skin\Flags\au.gif
c:\program files\Garena\Skin\Flags\aw.gif
c:\program files\Garena\Skin\Flags\az.gif
c:\program files\Garena\Skin\Flags\ba.gif
c:\program files\Garena\Skin\Flags\bb.gif
c:\program files\Garena\Skin\Flags\bd.gif
c:\program files\Garena\Skin\Flags\be.gif
c:\program files\Garena\Skin\Flags\bf.gif
c:\program files\Garena\Skin\Flags\bg.gif
c:\program files\Garena\Skin\Flags\bh.gif
c:\program files\Garena\Skin\Flags\bi.gif
c:\program files\Garena\Skin\Flags\bj.gif
c:\program files\Garena\Skin\Flags\bm.gif
c:\program files\Garena\Skin\Flags\bn.gif
c:\program files\Garena\Skin\Flags\bo.gif
c:\program files\Garena\Skin\Flags\br.gif
c:\program files\Garena\Skin\Flags\bs.gif
c:\program files\Garena\Skin\Flags\bt.gif
c:\program files\Garena\Skin\Flags\bv.gif
c:\program files\Garena\Skin\Flags\bw.gif
c:\program files\Garena\Skin\Flags\by.gif
c:\program files\Garena\Skin\Flags\bz.gif
c:\program files\Garena\Skin\Flags\ca.gif
c:\program files\Garena\Skin\Flags\cd.gif
c:\program files\Garena\Skin\Flags\cf.gif
c:\program files\Garena\Skin\Flags\cg.gif
c:\program files\Garena\Skin\Flags\ci.gif
c:\program files\Garena\Skin\Flags\ck.gif
c:\program files\Garena\Skin\Flags\cl.gif
c:\program files\Garena\Skin\Flags\cm.gif
c:\program files\Garena\Skin\Flags\cn.gif
c:\program files\Garena\Skin\Flags\co.gif
c:\program files\Garena\Skin\Flags\cr.gif
c:\program files\Garena\Skin\Flags\cu.gif
c:\program files\Garena\Skin\Flags\cv.gif
c:\program files\Garena\Skin\Flags\cy.gif
c:\program files\Garena\Skin\Flags\cz.gif
c:\program files\Garena\Skin\Flags\de.gif
c:\program files\Garena\Skin\Flags\dj.gif
c:\program files\Garena\Skin\Flags\dk.gif
c:\program files\Garena\Skin\Flags\dm.gif
c:\program files\Garena\Skin\Flags\do.gif
c:\program files\Garena\Skin\Flags\dz.gif
c:\program files\Garena\Skin\Flags\ec.gif
c:\program files\Garena\Skin\Flags\ee.gif
c:\program files\Garena\Skin\Flags\eg.gif
c:\program files\Garena\Skin\Flags\er.gif
c:\program files\Garena\Skin\Flags\es.gif
c:\program files\Garena\Skin\Flags\et.gif
c:\program files\Garena\Skin\Flags\eu.gif
c:\program files\Garena\Skin\Flags\fi.gif
c:\program files\Garena\Skin\Flags\fj.gif
c:\program files\Garena\Skin\Flags\fk.gif
c:\program files\Garena\Skin\Flags\fm.gif
c:\program files\Garena\Skin\Flags\fo.gif
c:\program files\Garena\Skin\Flags\fr.gif
c:\program files\Garena\Skin\Flags\fx.gif
c:\program files\Garena\Skin\Flags\ga.gif
c:\program files\Garena\Skin\Flags\gb.gif
c:\program files\Garena\Skin\Flags\gd.gif
c:\program files\Garena\Skin\Flags\ge.gif
c:\program files\Garena\Skin\Flags\gh.gif
c:\program files\Garena\Skin\Flags\gi.gif
c:\program files\Garena\Skin\Flags\gl.gif
c:\program files\Garena\Skin\Flags\gm.gif
c:\program files\Garena\Skin\Flags\gn.gif
c:\program files\Garena\Skin\Flags\gp.gif
c:\program files\Garena\Skin\Flags\gq.gif
c:\program files\Garena\Skin\Flags\gr.gif
c:\program files\Garena\Skin\Flags\gt.gif
c:\program files\Garena\Skin\Flags\gu.gif
c:\program files\Garena\Skin\Flags\gw.gif
c:\program files\Garena\Skin\Flags\gy.gif
c:\program files\Garena\Skin\Flags\hk.gif
c:\program files\Garena\Skin\Flags\hm.gif
c:\program files\Garena\Skin\Flags\hn.gif
c:\program files\Garena\Skin\Flags\hr.gif
c:\program files\Garena\Skin\Flags\ht.gif
c:\program files\Garena\Skin\Flags\hu.gif
c:\program files\Garena\Skin\Flags\ch.gif
c:\program files\Garena\Skin\Flags\id.gif
c:\program files\Garena\Skin\Flags\ie.gif
c:\program files\Garena\Skin\Flags\il.gif
c:\program files\Garena\Skin\Flags\im.gif
c:\program files\Garena\Skin\Flags\in.gif
c:\program files\Garena\Skin\Flags\io.gif
c:\program files\Garena\Skin\Flags\iq.gif
c:\program files\Garena\Skin\Flags\ir.gif
c:\program files\Garena\Skin\Flags\is.gif
c:\program files\Garena\Skin\Flags\it.gif
c:\program files\Garena\Skin\Flags\je.gif
c:\program files\Garena\Skin\Flags\jm.gif
c:\program files\Garena\Skin\Flags\jo.gif
c:\program files\Garena\Skin\Flags\jp.gif
c:\program files\Garena\Skin\Flags\ke.gif
c:\program files\Garena\Skin\Flags\kg.gif
c:\program files\Garena\Skin\Flags\kh.gif
c:\program files\Garena\Skin\Flags\ki.gif
c:\program files\Garena\Skin\Flags\km.gif
c:\program files\Garena\Skin\Flags\kn.gif
c:\program files\Garena\Skin\Flags\kp.gif
c:\program files\Garena\Skin\Flags\kr.gif
c:\program files\Garena\Skin\Flags\kw.gif
c:\program files\Garena\Skin\Flags\ky.gif
c:\program files\Garena\Skin\Flags\kz.gif
c:\program files\Garena\Skin\Flags\la.gif
c:\program files\Garena\Skin\Flags\lb.gif
c:\program files\Garena\Skin\Flags\lc.gif
c:\program files\Garena\Skin\Flags\li.gif
c:\program files\Garena\Skin\Flags\lk.gif
c:\program files\Garena\Skin\Flags\lr.gif
c:\program files\Garena\Skin\Flags\ls.gif
c:\program files\Garena\Skin\Flags\lt.gif
c:\program files\Garena\Skin\Flags\lu.gif
c:\program files\Garena\Skin\Flags\lv.gif
c:\program files\Garena\Skin\Flags\ly.gif
c:\program files\Garena\Skin\Flags\ma.gif
c:\program files\Garena\Skin\Flags\mc.gif
c:\program files\Garena\Skin\Flags\md.gif
c:\program files\Garena\Skin\Flags\me.gif
c:\program files\Garena\Skin\Flags\mg.gif
c:\program files\Garena\Skin\Flags\mh.gif
c:\program files\Garena\Skin\Flags\mk.gif
c:\program files\Garena\Skin\Flags\ml.gif
c:\program files\Garena\Skin\Flags\mm.gif
c:\program files\Garena\Skin\Flags\mn.gif
c:\program files\Garena\Skin\Flags\mo.gif
c:\program files\Garena\Skin\Flags\mp.gif
c:\program files\Garena\Skin\Flags\mq.gif
c:\program files\Garena\Skin\Flags\mr.gif
c:\program files\Garena\Skin\Flags\ms.gif
c:\program files\Garena\Skin\Flags\mt.gif
c:\program files\Garena\Skin\Flags\mu.gif
c:\program files\Garena\Skin\Flags\mv.gif
c:\program files\Garena\Skin\Flags\mw.gif
c:\program files\Garena\Skin\Flags\mx.gif
c:\program files\Garena\Skin\Flags\my.gif
c:\program files\Garena\Skin\Flags\mz.gif
c:\program files\Garena\Skin\Flags\na.gif
c:\program files\Garena\Skin\Flags\nc.gif
c:\program files\Garena\Skin\Flags\ne.gif
c:\program files\Garena\Skin\Flags\nf.gif
c:\program files\Garena\Skin\Flags\ng.gif
c:\program files\Garena\Skin\Flags\ni.gif
c:\program files\Garena\Skin\Flags\nl.gif
c:\program files\Garena\Skin\Flags\no.gif
c:\program files\Garena\Skin\Flags\np.gif
c:\program files\Garena\Skin\Flags\nr.gif
c:\program files\Garena\Skin\Flags\nz.gif
c:\program files\Garena\Skin\Flags\om.gif
c:\program files\Garena\Skin\Flags\pa.gif
c:\program files\Garena\Skin\Flags\pe.gif
c:\program files\Garena\Skin\Flags\pf.gif
c:\program files\Garena\Skin\Flags\pg.gif
c:\program files\Garena\Skin\Flags\ph.gif
c:\program files\Garena\Skin\Flags\pk.gif
c:\program files\Garena\Skin\Flags\pl.gif
c:\program files\Garena\Skin\Flags\pm.gif
c:\program files\Garena\Skin\Flags\pr.gif
c:\program files\Garena\Skin\Flags\ps.gif
c:\program files\Garena\Skin\Flags\pt.gif
c:\program files\Garena\Skin\Flags\pw.gif
c:\program files\Garena\Skin\Flags\py.gif
c:\program files\Garena\Skin\Flags\qa.gif
c:\program files\Garena\Skin\Flags\re.gif
c:\program files\Garena\Skin\Flags\ro.gif
c:\program files\Garena\Skin\Flags\rs.gif
c:\program files\Garena\Skin\Flags\ru.gif
c:\program files\Garena\Skin\Flags\rw.gif
c:\program files\Garena\Skin\Flags\sa.gif
c:\program files\Garena\Skin\Flags\sb.gif
c:\program files\Garena\Skin\Flags\sc.gif
c:\program files\Garena\Skin\Flags\sd.gif
c:\program files\Garena\Skin\Flags\se.gif
c:\program files\Garena\Skin\Flags\sg.gif
c:\program files\Garena\Skin\Flags\si.gif
c:\program files\Garena\Skin\Flags\sk.gif
c:\program files\Garena\Skin\Flags\sl.gif
c:\program files\Garena\Skin\Flags\sm.gif
c:\program files\Garena\Skin\Flags\sn.gif
c:\program files\Garena\Skin\Flags\so.gif
c:\program files\Garena\Skin\Flags\sr.gif
c:\program files\Garena\Skin\Flags\st.gif
c:\program files\Garena\Skin\Flags\sv.gif
c:\program files\Garena\Skin\Flags\sy.gif
c:\program files\Garena\Skin\Flags\sz.gif
c:\program files\Garena\Skin\Flags\tc.gif
c:\program files\Garena\Skin\Flags\td.gif
c:\program files\Garena\Skin\Flags\tf.gif
c:\program files\Garena\Skin\Flags\tg.gif
c:\program files\Garena\Skin\Flags\th.gif
c:\program files\Garena\Skin\Flags\Thumbs.db
c:\program files\Garena\Skin\Flags\tj.gif
c:\program files\Garena\Skin\Flags\tm.gif
c:\program files\Garena\Skin\Flags\tn.gif
c:\program files\Garena\Skin\Flags\to.gif
c:\program files\Garena\Skin\Flags\tp.gif
c:\program files\Garena\Skin\Flags\tr.gif
c:\program files\Garena\Skin\Flags\tt.gif
c:\program files\Garena\Skin\Flags\tv.gif
c:\program files\Garena\Skin\Flags\tw.gif
c:\program files\Garena\Skin\Flags\tz.gif
c:\program files\Garena\Skin\Flags\ua.gif
c:\program files\Garena\Skin\Flags\ug.gif
c:\program files\Garena\Skin\Flags\uk.gif
c:\program files\Garena\Skin\Flags\um.gif
c:\program files\Garena\Skin\Flags\us.gif
c:\program files\Garena\Skin\Flags\uy.gif
c:\program files\Garena\Skin\Flags\uz.gif
c:\program files\Garena\Skin\Flags\va.gif
c:\program files\Garena\Skin\Flags\vc.gif
c:\program files\Garena\Skin\Flags\ve.gif
c:\program files\Garena\Skin\Flags\vg.gif
c:\program files\Garena\Skin\Flags\vi.gif
c:\program files\Garena\Skin\Flags\vn.gif
c:\program files\Garena\Skin\Flags\vu.gif
c:\program files\Garena\Skin\Flags\ws.gif
c:\program files\Garena\Skin\Flags\ye.gif
c:\program files\Garena\Skin\Flags\yu.gif
c:\program files\Garena\Skin\Flags\za.gif
c:\program files\Garena\Skin\Flags\zm.gif
c:\program files\Garena\Skin\Flags\zr.gif
c:\program files\Garena\Skin\Flags\zw.gif
c:\program files\Garena\Skin\garenatv.ggz
c:\program files\Garena\Skin\READ FIRST!!!.txt
c:\program files\Garena\Skin\skin.ggz
c:\program files\Garena\skin_bs\garenatv.ggz
c:\program files\Garena\skin_bs\Skin.ggz
c:\program files\Garena\Skins.xml
c:\program files\Garena\SocketHook.dll
c:\program files\Garena\sound\folder.wav
c:\program files\Garena\sound\game.wav
c:\program files\Garena\sound\msg.wav
c:\program files\Garena\sound\nudge.wav
c:\program files\Garena\sound\quit.wav
c:\program files\Garena\sound\ring.wav
c:\program files\Garena\sound\sysmsg.wav
c:\program files\Garena\source.xml
c:\program files\Garena\sqlite3.dll
c:\program files\Garena\uninst.exe
c:\program files\Garena\update.dat
c:\program files\Garena\update.exe
c:\program files\Garena\update.xml
c:\program files\Garena\update2.exe
c:\program files\Garena\user.xml
c:\program files\Garena\user\10359800\ban.dat
c:\program files\Garena\user\10359800\data.dat
c:\program files\Garena\user\10359800\fps.dat
c:\program files\Garena\user\10359800\recent.txt
c:\program files\Garena\user\10359800\wc3ass.dat
c:\program files\Garena\viwawa.cn.xml
c:\program files\Garena\viwawa.en.xml
c:\program files\Garena\viwawa.tw.xml
c:\program files\Garena\War3Hook.dll
c:\program files\Garena\web\1.cn.html
c:\program files\Garena\web\1.en.html
c:\program files\Garena\web\1.tw.html
c:\program files\Garena\web\2.cn.html
c:\program files\Garena\web\2.en.html
c:\program files\Garena\web\2.tw.html
c:\program files\Garena\web\3.cn.html
c:\program files\Garena\web\3.en.html
c:\program files\Garena\web\3.tw.html
c:\program files\Garena\web\6.cn.html
c:\program files\Garena\web\6.en.html
c:\program files\Garena\web\6.tw.html
c:\program files\Garena\web\cache\Freesky\css\foemb_2.css
c:\program files\Garena\web\cache\Freesky\img\do_bg2.jpg
c:\program files\Garena\web\cache\Freesky\img\do_btn.jpg
c:\program files\Garena\web\cache\Freesky\img\ggbackground.jpg
c:\program files\Garena\web\cache\RUpoker\css\pokerembed.css
c:\program files\Garena\web\cache\RUpoker\img\bg.jpg
c:\program files\Garena\web\cache\RUpoker\img\btn.jpg
c:\program files\Garena\web\cache\RUpoker\img\ggbackground.jpg
c:\program files\Garena\web\embed_game.jpg
c:\program files\Garena\web\embed_game_cn.jpg
c:\program files\Garena\web\embed_game_tw.jpg
c:\program files\Garena\web\embed_garenafire_ZH.jpg
c:\program files\Garena\web\embed_gfire.jpg
c:\program files\Garena\web\gfire.cn.html
c:\program files\Garena\web\gfire.en.html
c:\program files\Garena\web\gfire.tw.html
c:\program files\Garena\web\ggbackground.jpg
c:\program files\Garena\web\loading.gif
c:\program files\Garena\web\loading.html
c:\program files\Garena\web\Thumbs.db
c:\program files\Garena\YYFileSystem.dll
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GARENAPENGINE
-------\Service_GarenaPEngine
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-08 do 2010-02-08 )))))))))))))))))))))))))))))))
.
2010-02-08 15:32 . 2010-02-08 15:32 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-08 15:32 . 2009-11-22 14:42 69000 ----a-w- c:\windows\system32\zlcomm.dll
2010-02-08 15:32 . 2009-11-22 14:42 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2010-02-08 15:32 . 2009-11-22 14:42 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2010-02-08 15:32 . 2010-02-08 15:32 -------- d-----w- c:\windows\system32\ZoneLabs
2010-02-08 15:28 . 2010-02-08 15:28 -------- d-----w- c:\program files\Zone Labs
2010-02-08 15:28 . 2010-02-08 18:45 -------- d-----w- c:\windows\Internet Logs
2010-02-03 16:05 . 2010-02-03 16:05 -------- d-----w- c:\program files\DigiDNA
2010-02-02 15:35 . 2010-02-02 15:39 16 ----a-w- c:\windows\system32\utinfo.dat
2010-02-02 15:35 . 2009-08-17 20:02 20552 ----a-w- c:\windows\system32\drivers\utdrv.sys
2010-02-02 15:35 . 2010-02-02 15:40 -------- d-----w- c:\program files\USBTrace
2010-02-02 15:18 . 2010-02-02 15:18 -------- d-----w- c:\program files\iPod
2010-02-02 15:18 . 2010-02-02 15:20 -------- d-----w- c:\program files\iTunes
2010-02-01 15:58 . 2010-02-01 15:58 -------- d-----w- c:\program files\Winamp Detect
2010-02-01 14:14 . 2010-02-01 14:14 -------- d-----w- c:\program files\Stanza
2010-01-31 18:34 . 2010-01-31 18:35 -------- d-----w- c:\program files\USBInfo
2010-01-31 17:07 . 2010-01-31 17:08 -------- d-----w- c:\program files\Cacheman
2010-01-29 00:15 . 2010-01-29 00:16 -------- d-----w- c:\program files\iBrick
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\Techlogg.com ToneShop
2010-01-28 19:29 . 2010-01-28 19:29 -------- d-----w- c:\program files\Air Mouse
2010-01-28 18:25 . 2010-01-28 18:25 -------- d-----w- c:\program files\Logitech Touch Mouse Server
2010-01-26 23:21 . 2010-01-26 23:21 -------- d-----w- c:\windows\Downloaded Installations
2010-01-26 17:56 . 2010-01-26 17:56 -------- d-----w- c:\program files\!iPhone utilities
2010-01-26 17:12 . 2010-01-26 21:44 -------- d-----w- c:\program files\SharePod
2010-01-26 14:35 . 2010-02-01 14:38 -------- d-----w- c:\program files\Bonjour
2010-01-26 14:34 . 2010-01-26 14:34 -------- d-----w- c:\program files\QuickTime
2010-01-26 14:30 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-01-22 20:56 . 2010-01-22 20:56 -------- d-----w- c:\program files\TryMedia
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 19:07 . 2008-09-25 16:42 4718592 ----a-w- c:\documents and settings\chces_tvaruzek\NTUSER.DAT
2010-02-08 16:30 . 2009-04-13 21:50 -------- d-----w- c:\program files\Garena_official
2010-02-04 13:03 . 2009-05-08 17:55 -------- d-----w- c:\program files\ParadisePoker
2010-02-02 23:32 . 2008-09-25 18:09 -------- d-----w- c:\program files\SpeedFan
2010-02-02 15:18 . 2008-11-25 09:03 -------- d-----w- c:\program files\Common Files\Apple
2010-02-01 15:59 . 2008-09-25 21:15 -------- d-----w- c:\program files\Winamp
2010-02-01 09:39 . 2009-01-26 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 18:34 . 2008-11-20 14:07 249856 ------w- c:\windows\Setup1.exe
2010-01-31 18:34 . 2008-11-20 14:07 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-27 17:45 . 2008-09-25 16:44 -------- d-----w- c:\program files\totalcmd
2010-01-26 20:34 . 2009-05-28 20:04 -------- d-----w- c:\program files\Orbitdownloader
2010-01-07 15:07 . 2009-01-26 21:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-01-26 21:25 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 18:24 . 2010-01-04 18:24 -------- d-----w- c:\program files\PFPortChecker
2009-12-30 11:21 . 2009-02-04 22:32 -------- d-----w- c:\program files\WEPOS
2009-11-21 08:46 . 2009-11-21 08:46 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-11-20 21:34 . 2004-07-17 09:36 28400 ----a-w- c:\windows\system32\drivers\secdrv.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-02-08_18.17.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-08 19:09 . 2010-02-08 19:09 16384 c:\windows\Temp\Perflib_Perfdata_4e8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"Cacheman"="c:\progra~1\Cacheman\Cacheman.exe" [2003-07-31 1290752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 53248]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-11 1236992]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 421888]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
c:\documents and settings\chces_tvaruzek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-9-25 2860792]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Air Mouse.lnk - c:\program files\Air Mouse\Air Mouse\Air Mouse.exe [2010-1-21 505344]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-26 13:47 229376 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wbsys.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Acer Empowering Technology.lnk]
backup=c:\windows\pss\Acer Empowering Technology.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Handwizard.lnk]
backup=c:\windows\pss\Handwizard.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^chces_tvaruzek^Nabídka Start^Programy^Po spuštění^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\365dni]
2007-01-06 17:16 753664 ----a-w- c:\program files\365dníNET\365dniNET.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
2006-03-15 20:12 579584 ----a-w- c:\acer\Empowering Technology\ePower\Boot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2006-05-30 10:11 421888 ----a-w- c:\acer\Empowering Technology\ePower\ePower_DMC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-30 15:28 133104 ----atw- c:\documents and settings\chces_tvaruzek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 18:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:58 1667584 ------w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2008-11-10 14:07 1253376 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-12-03 11:47 1205760 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-19 09:59 1217808 ----a-w- c:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
2008-08-03 15:38 61440 ----a-w- d:\gry\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Garena_official\\Garena.exe"=
"d:\\gry\\UO\\client.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\gry\\CS NS\\cstrike.exe"=
"c:\\games\\Turbine Download Manager\\TurbineMessageService.exe"=
"c:\\games\\Turbine Download Manager\\TurbineNetworkService.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\counter-strike source\\hl2.exe"=
"c:\\gry\\Steam\\SteamApps\\ahmfgc\\day of defeat source\\hl2.exe"=
"d:\\gry\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"d:\\gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech Touch Mouse Server\\iTouch-Server-Win.exe"=
"c:\\Program Files\\Air Mouse\\Air Mouse\\Air Mouse.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\Stanza.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:GAYARENA
"6113:TCP"= 6113:TCP:GAYARENA
"6114:TCP"= 6114:TCP:GAYARENA
"6115:TCP"= 6115:TCP:GAYARENA
"6116:TCP"= 6116:TCP:GAYARENA
"6117:TCP"= 6117:TCP:GAYARENA
"6118:TCP"= 6118:TCP:GAYARENA
"6119:TCP"= 6119:TCP:GAYARENA
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.10.2008 15:01 717296]
R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [12.10.2008 19:48 17952]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [1.7.2008 9:04 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1.7.2008 9:02 468224]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe -s [?]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe -s [?]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [8.11.2008 13:38 93440]
S3 LiveTurbineMessageService;Turbine Message Service - Live;c:\games\Turbine Download Manager\TurbineMessageService.exe [14.10.2009 21:21 267760]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;c:\games\Turbine Download Manager\TurbineNetworkService.exe [14.10.2009 21:21 218608]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25.1.2007 18:31 42000]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ptiusbf;PTI USB Filter;c:\windows\system32\drivers\ptiusbf.sys [14.4.2001 0:22 22474]
S3 utdrv;utdrv;c:\windows\system32\drivers\utdrv.sys [2.2.2010 16:35 20552]
.
Obsah adresáře 'Naplánované úlohy'
2010-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.atlas.cz/?from=icqhp
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm
IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
FF - ProfilePath - c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.respekt.cz
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\chces_tvaruzek\Data aplikací\Mozilla\Firefox\Profiles\0klv6ph1.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-Garena - c:\program files\Garena\uninst.exe
AddRemove-Garena Host Bot v1.01.0 - c:\program files\Garena\Garena Host Bot v1.0\uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 20:10
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89E041F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebfc3
\Driver\ACPI -> ACPI.sys @ 0xf7246cb8
\Driver\atapi -> 0x89e041f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(956)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\COMMON~1\Stardock\mcpstub.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
- - - - - - - > 'explorer.exe'(3408)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\progra~1\COMMON~1\Stardock\MCPCore.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\tray.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\progra~1\COMMON~1\Stardock\SDMCP.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Celkový čas: 2010-02-08 20:14:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-08 19:14
ComboFix2.txt 2010-02-08 18:19
ComboFix3.txt 2009-11-04 10:06
Před spuštěním: 4 956 872 704
Po spuštění: 4 824 473 600
- - End Of File - - 10DCE8F2AA8B8BE4877D63C978DE5678
-
Rudy
- Site Admin
- Příspěvky: 119497
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Zpomalené USB
Log již vypadá čistý. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
KrutyUkrutnik
- Návštěvník
- Příspěvky: 16
- Registrován: 31 kvě 2008 11:36
Re: Zpomalené USB
na rychlost USB neměla očista žádny vliv. nicméně děkuji za pomoc
-
Rudy
- Site Admin
- Příspěvky: 119497
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Zpomalené USB
Přeinstalujte ovladače zákl. desky.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
KrutyUkrutnik
- Návštěvník
- Příspěvky: 16
- Registrován: 31 kvě 2008 11:36
Re: Zpomalené USB
Díky za radu. O to už jsem se dřív pokoušel, nicméně jsem nikde na tento laptop ovladač základní desky nenašel. Tušim, že si ho WIN při instalaci tahá sám.
-
Rudy
- Site Admin
- Příspěvky: 119497
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Zpomalené USB
OK. Jde tady o verzi. Máte-li 1.1, půjde to pomaleji, než 2.0.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
KrutyUkrutnik
- Návštěvník
- Příspěvky: 16
- Registrován: 31 kvě 2008 11:36
Re: Zpomalené USB
100% mám verzi 2.0
Po formátu a čisté instalaci frčí USB jak ďas, nicméně to už jsem nějakou dobu nedělal a myslel sem, že je zpomalení způsobené nějakou havětí. Což bohužel není
Po formátu a čisté instalaci frčí USB jak ďas, nicméně to už jsem nějakou dobu nedělal a myslel sem, že je zpomalení způsobené nějakou havětí. Což bohužel není
Přispějete na provoz fóra?