XP internet security- hází varovné hlášky- prosím o kontrolu

[Ecinazuz]

haha...díky - máš ho tu- snad to nebude tak hrozné jako ten předchozí PC /červenat bych se měla já, nebo ten z rodiny, který tam tu havěť pozval /

Log z noťasu:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Zuzana at 2010-04-25 17:42:53
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 169 GB (74%) free of 228 GB
Total RAM: 1788 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:43:36, on 25.4.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\windows\system32\taskeng.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Zuzana\Desktop\RSIT.exe
C:\windows\system32\SearchFilterHost.exe
C:\Program Files\trend micro\Zuzana.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe /tray
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Hledání panelu &AOL Toolbar - C:\ProgramData\AOL\ieToolbar\resources\cs-CZ\local\search.html
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\windows\system32\Hpservice.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\windows\system32\rpcnet.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\windows\System32\TuneUpDefragService.exe

--
End of file - 12747 bytes

======Scheduled tasks folder======

C:\windows\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-09-06 329312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3134413B-49B4-425C-98A5-893C1F195601}]
BHO_Startup Class - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2008-05-14 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll [2008-03-25 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar BHO - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-02-03 1185120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}]
Credential Manager for HP ProtectTools - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll [2008-05-21 58128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0BF43445-2F28-4351-9252-17FE6E806AA0}
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-02-03 1185120]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"StartCCC"=c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
""= []
"accrdsub"=c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [2007-05-16 293168]
"PTHOSTTR"=c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [2008-06-02 238984]
"CognizanceTS"=c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll [2008-05-21 24848]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2008-05-12 318488]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-27 1045800]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752]
"File Sanitizer"=C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [2008-05-14 10244096]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [2008-03-25 144784]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2008-05-14 177456]
"WatchDog"=C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2008-05-24 197904]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\soundmax.exe [2008-03-19 3842048]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2007-12-21 1443072]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]
"PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2007-01-29 30248]
"IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2007-01-29 46632]
"PPort11reminder"=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-02-01 255528]
"BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-03-12 663552]
"ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2007-01-26 65536]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-09-06 198160]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]
"HP Health Check Scheduler"=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09 75008]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-04-04 1314816]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-03-18 2289664]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-04-16 24264488]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="APSHook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{419fd94f-9310-11de-8ca3-0021867955c0}]
shell\AutoRun\command - G:\EmDesk.exe
shell\EmDesk\command - G:\EmDesk.exe


======File associations======

.js - edit - C:\windows\System32\Notepad.exe %1
.js - open - C:\windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-04-25 17:42:53 ----D---- C:\rsit
2010-04-25 17:42:53 ----D---- C:\Program Files\trend micro
2010-04-15 13:31:27 ----A---- C:\windows\system32\mshtml.dll
2010-04-15 13:31:20 ----A---- C:\windows\system32\ieframe.dll
2010-04-15 13:31:18 ----A---- C:\windows\system32\iertutil.dll
2010-04-15 13:31:17 ----A---- C:\windows\system32\urlmon.dll
2010-04-15 13:31:16 ----A---- C:\windows\system32\wininet.dll
2010-04-15 13:31:15 ----A---- C:\windows\system32\msfeeds.dll
2010-04-15 13:31:14 ----A---- C:\windows\system32\occache.dll
2010-04-15 13:31:14 ----A---- C:\windows\system32\iedkcs32.dll
2010-04-15 13:31:13 ----A---- C:\windows\system32\mstime.dll
2010-04-15 13:31:09 ----A---- C:\windows\system32\ieui.dll
2010-04-15 13:31:08 ----A---- C:\windows\system32\iepeers.dll
2010-04-15 13:31:06 ----A---- C:\windows\system32\ieUnatt.exe
2010-04-15 13:31:05 ----A---- C:\windows\system32\msfeedsbs.dll
2010-04-15 13:31:05 ----A---- C:\windows\system32\iesysprep.dll
2010-04-15 13:31:04 ----A---- C:\windows\system32\jsproxy.dll
2010-04-15 13:31:02 ----A---- C:\windows\system32\msfeedssync.exe
2010-04-15 13:31:02 ----A---- C:\windows\system32\ie4uinit.exe
2010-04-15 13:31:01 ----A---- C:\windows\system32\iesetup.dll
2010-04-15 13:31:00 ----A---- C:\windows\system32\iernonce.dll
2010-04-15 13:23:34 ----A---- C:\windows\system32\ntoskrnl.exe
2010-04-15 13:23:33 ----A---- C:\windows\system32\ntkrnlpa.exe
2010-04-15 13:23:03 ----A---- C:\windows\system32\vbscript.dll
2010-04-15 13:17:46 ----A---- C:\windows\system32\iphlpsvc.dll
2010-04-15 13:04:01 ----A---- C:\windows\system32\wintrust.dll
2010-04-15 13:03:55 ----A---- C:\windows\system32\cabview.dll

======List of files/folders modified in the last 1 months======

2010-04-25 17:43:11 ----D---- C:\windows\Prefetch
2010-04-25 17:43:03 ----D---- C:\windows\Temp
2010-04-25 17:42:53 ----RD---- C:\Program Files
2010-04-25 17:42:33 ----D---- C:\Users\Zuzana\AppData\Roaming\Skype
2010-04-25 17:41:23 ----D---- C:\Windows
2010-04-25 17:40:08 ----D---- C:\Program Files\Ufonuv fofr internet
2010-04-25 17:40:07 ----A---- C:\windows\red_dialer.ini
2010-04-25 16:02:46 ----D---- C:\Users\Zuzana\AppData\Roaming\skypePM
2010-04-25 13:27:48 ----SHD---- C:\System Volume Information
2010-04-25 07:36:25 ----D---- C:\windows\System32
2010-04-25 07:36:25 ----D---- C:\windows\inf
2010-04-25 07:36:25 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-04-25 07:31:37 ----A---- C:\windows\system32\rpcnetp.exe
2010-04-25 07:31:35 ----A---- C:\windows\system32\rpcnet.dll
2010-04-25 07:31:34 ----D---- C:\ProgramData\hpqLog
2010-04-23 13:50:29 ----D---- C:\windows\Debug
2010-04-19 18:22:19 ----D---- C:\Program Files\Mozilla Firefox
2010-04-19 12:29:19 ----D---- C:\windows\winsxs
2010-04-19 12:19:11 ----D---- C:\windows\system32\catroot
2010-04-19 12:16:23 ----D---- C:\windows\system32\drivers
2010-04-19 12:16:22 ----D---- C:\windows\system32\migration
2010-04-19 12:16:22 ----D---- C:\Program Files\Windows Mail
2010-04-19 12:16:22 ----D---- C:\Program Files\Internet Explorer
2010-04-19 12:00:53 ----SHD---- C:\windows\Installer
2010-04-19 12:00:46 ----D---- C:\ProgramData\Microsoft Help
2010-04-15 13:15:53 ----D---- C:\windows\system32\catroot2
2010-04-15 12:58:21 ----D---- C:\windows\ModemLogs
2010-04-14 11:03:02 ----SD---- C:\Users\Zuzana\AppData\Roaming\Microsoft
2010-04-06 19:52:54 ----A---- C:\windows\system32\mrt.exe
2010-03-29 06:55:28 ----D---- C:\ProgramData\Real
2010-03-29 06:55:20 ----D---- C:\Users\Zuzana\AppData\Roaming\Real

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\windows\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 epfwtdi;epfwtdi; C:\windows\system32\DRIVERS\epfwtdi.sys [2007-12-21 53768]
R1 RsvLock;RsvLock; C:\windows\system32\drivers\RsvLock.sys [2008-05-30 12496]
R2 eamon;EAMON; C:\windows\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R2 epfw;epfw; C:\windows\system32\DRIVERS\epfw.sys [2007-12-21 71176]
R3 Accelerometer;HP Accelerometer; C:\windows\system32\DRIVERS\Accelerometer.sys [2008-04-07 34664]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\ADIHdAud.sys [2008-04-11 382464]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\windows\system32\DRIVERS\AGRSM.sys [2008-11-21 1204128]
R3 atikmdag;atikmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2008-05-21 3552768]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\windows\system32\DRIVERS\bcmwl6.sys [2008-03-21 1207288]
R3 BthEnum;Služba Bluetooth Enumerator; C:\windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
R3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys [2008-05-28 80424]
R3 btwavdt;Bluetooth AVDT; C:\windows\system32\drivers\btwavdt.sys [2008-05-28 81960]
R3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys [2008-05-28 16168]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 Epfwndis;Eset Personal Firewall; C:\windows\system32\DRIVERS\Epfwndis.sys [2007-12-21 30728]
R3 HBtnKey;HBtnKey; C:\windows\system32\DRIVERS\cpqbttn.sys [2008-04-14 9344]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\windows\system32\DRIVERS\HpqKbFiltr.sys [2007-06-19 16768]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\windows\system32\DRIVERS\snp2uvc.sys [2009-03-27 1810992]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2008-03-27 199472]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\windows\system32\DRIVERS\yk60x86.sys [2008-04-03 310272]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\windows\system32\DRIVERS\adusbser.sys [2006-12-20 97920]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\windows\system32\drivers\errdev.sys [2008-01-21 6656]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 TPM;TPM; C:\windows\system32\drivers\tpm.sys [2008-01-21 45624]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 accoca;ActivClient Middleware Service; c:\Program Files\ActivIdentity\ActivClient\accoca.exe [2007-05-16 182576]
R2 AEADIFilters;Andrea ADI Filters Service; C:\windows\system32\AEADISRV.EXE [2007-10-19 86016]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2007-12-11 12800]
R2 ASBroker;Logon Session Broker; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 ASChannel;Local Communication Channel; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 Ati External Event Utility;Ati External Event Utility; C:\windows\system32\Ati2evxx.exe [2008-05-21 671744]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\windows\system32\svchost.exe [2008-01-21 21504]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2008-10-09 94208]
R2 HP ProtectTools Service;HP ProtectTools Service; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]
R2 HpFkCryptService;Drive Encryption Service; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]
R2 HPFSService;File Sanitizer for HP ProtectTools; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]
R2 hpsrv;HP Service; C:\windows\system32\Hpservice.exe [2008-04-07 24936]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-10-19 222456]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-05 112152]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-03-18 73728]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2008-05-12 576024]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2008-01-21 21504]
R2 rpcnet;Remote Procedure Call (RPC) Net; C:\windows\system32\rpcnet.exe [2009-09-24 56680]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\windows\System32\svchost.exe [2008-01-21 21504]
R3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2008-04-16 165192]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2007-12-21 19200]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\windows\system32\svchost.exe [2008-01-21 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\windows\System32\TuneUpDefragService.exe [2009-05-10 306432]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

-----------------EOF-----------------

P.S. - tady to tak nespěchá- takže v klidu, ať to nevypadá, že tě honím

[Ecinazuz]

OK- pro jistotu....tyhle 3 odstranit v tomto: Hijackthis http://www.viry.cz/forum/viewtopic.php?f=24&t=5640

R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

[Ecinazuz]

ha!...ani jsem nevěděla, že ho tam mám .....položky odstraněny!

výsledek z virustotal:
http://www.virustotal.com/cs/analisis/d ... 1272214242

Soubor rpcnet.exe přijatý 2010.04.25 16:50:42 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/41 (0%)

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.04.25 -
AhnLab-V3 5.0.0.2 2010.04.24 -
AntiVir 8.2.1.224 2010.04.23 -
Antiy-AVL 2.0.3.7 2010.04.23 -
Authentium 5.2.0.5 2010.04.25 -
Avast 4.8.1351.0 2010.04.25 -
Avast5 5.0.332.0 2010.04.25 -
AVG 9.0.0.787 2010.04.25 -
BitDefender 7.2 2010.04.25 -
CAT-QuickHeal 10.00 2010.04.23 -
ClamAV 0.96.0.3-git 2010.04.25 -
Comodo 4678 2010.04.25 -
DrWeb 5.0.2.03300 2010.04.25 -
eSafe 7.0.17.0 2010.04.25 -
eTrust-Vet 35.2.7448 2010.04.24 -
F-Prot 4.5.1.85 2010.04.25 -
F-Secure 9.0.15370.0 2010.04.25 -
Fortinet 4.0.14.0 2010.04.25 -
GData 21 2010.04.25 -
Ikarus T3.1.1.80.0 2010.04.25 -
Jiangmin 13.0.900 2010.04.25 -
Kaspersky 7.0.0.125 2010.04.25 -
McAfee 5.400.0.1158 2010.04.25 -
McAfee-GW-Edition 6.8.5 2010.04.23 -
Microsoft 1.5703 2010.04.25 -
NOD32 5059 2010.04.25 -
Norman 6.04.11 2010.04.25 -
nProtect 2010-04-25.01 2010.04.25 -
Panda 10.0.2.7 2010.04.24 -
PCTools 7.0.3.5 2010.04.25 -
Prevx 3.0 2010.04.25 -
Rising 22.44.06.04 2010.04.25 -
Sophos 4.53.0 2010.04.25 -
Sunbelt 6221 2010.04.25 -
Symantec 20091.2.0.41 2010.04.25 -
TheHacker 6.5.2.0.268 2010.04.25 -
TrendMicro 9.120.0.1004 2010.04.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.25 -
VBA32 3.12.12.4 2010.04.23 -
ViRobot 2010.4.24.2293 2010.04.25 -
VirusBuster 5.0.27.0 2010.04.24 -
Rozšiřující informace
File size: 56680 bytes
MD5...: 449bf2e12822299c0b153b61c5b8d58e
SHA1..: c1e87a13152a35b325ed25062e38ed3f115affce
SHA256: d62fd3d2c44b8f540166b3cfce930ae6b5e2e54a724dc6c784241d9a5e44b644
ssdeep: 768:EJTMRW36uadqY3bIxaiXssKrXbdURa1MRAn/v2mN90ebqAMt2IHjPz3Ot0qP
G4Pb:rW3/aEwsK7iCMun/eAeydt0Yw4G4
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1c10
timedatestamp.....: 0x49ad6b29 (Tue Mar 03 17:38:49 2009)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9129 0x9200 6.51 9becfb7d2513d33591ab673115bba95f
.data 0xb000 0x1d74 0x1e00 3.36 62bbc527cc88a05d5c449d6103467740
.cdata 0xd000 0x298 0x400 2.66 c93e206aac1e4e4b1506d414a18738eb
.rsrc 0xe000 0x448 0x600 2.54 66c04b9abc0c570bb3b2612f0ccfd50b
.reloc 0xf000 0x9ee 0xa00 6.24 3a404a244b8c32be9260e308210f9344

( 7 imports )
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -
> TAPI32.dll: lineDeallocateCall, lineMakeCall, lineSetDevConfig, lineGetID, lineSetStatusMessages, lineGetDevCaps, lineInitialize, lineGetDevConfig, lineOpen, lineShutdown, lineGetCallStatus, lineDrop, lineClose
> NETAPI32.dll: Netbios
> USERENV.dll: CreateEnvironmentBlock, DestroyEnvironmentBlock
> KERNEL32.dll: lstrcatA, lstrcpyA, MapViewOfFile, CreateFileMappingA, SetEvent, ResetEvent, WaitForSingleObject, LocalAlloc, CreateThread, GetLastError, BackupRead, BackupWrite, OpenProcess, GetCurrentProcessId, GetCurrentProcess, FreeLibrary, GetProcAddress, LoadLibraryA, DeleteFileA, lstrlenA, CreateFileA, BackupSeek, GetFileAttributesExA, SetFileTime, SetFileAttributesA, CreateEventA, GetVersionExA, GetSystemDirectoryA, FindClose, FindFirstFileA, lstrcmpiA, lstrcmpA, LoadLibraryExA, GetModuleHandleA, WriteFile, GetWindowsDirectoryA, GetEnvironmentVariableA, GetExitCodeThread, WaitForMultipleObjects, CreateRemoteThread, VirtualFreeEx, WriteProcessMemory, VirtualAllocEx, SetFilePointer, CopyFileA, GetModuleFileNameA, SetStdHandle, TerminateProcess, CreateProcessA, ReadProcessMemory, GetStdHandle, HeapAlloc, HeapFree, GetProcessHeap, RaiseException, GetVersion, RtlUnwind, ClearCommError, PurgeComm, GetOverlappedResult, EnterCriticalSection, LeaveCriticalSection, WaitCommEvent, SetCommMask, ReadFile, Sleep, DeleteCriticalSection, SetThreadPriority, InitializeCriticalSection, SetCommTimeouts, SetCommState, GetCommState, SetupComm, GetCommProperties, GetCurrentThreadId, GetLocalTime, GetCommandLineA, FlushFileBuffers, ExitProcess, ResumeThread, GetComputerNameA, TerminateThread, LocalFree, CloseHandle, UnmapViewOfFile, ExitThread
> USER32.dll: PeekMessageA, KillTimer, PostMessageA, GetMessageA, TranslateMessage, PostQuitMessage, DefWindowProcA, wsprintfA, RegisterClassA, CreateWindowExA, DispatchMessageA, MsgWaitForMultipleObjects, SendMessageA, PostThreadMessageA, SetTimer
> ADVAPI32.dll: ControlService, DeleteService, CreateServiceA, QueryServiceConfigA, ChangeServiceConfigA, OpenSCManagerA, OpenServiceA, QueryServiceStatus, StartServiceA, CloseServiceHandle, EqualSid, RegisterServiceCtrlHandlerA, SetServiceStatus, StartServiceCtrlDispatcherA, DuplicateTokenEx, SetTokenInformation, CreateProcessAsUserA, RegOpenKeyA, RegCreateKeyExA, RegSetValueExA, SetKernelObjectSecurity, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, GetTokenInformation, AdjustTokenPrivileges, GetKernelObjectSecurity, AllocateAndInitializeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclA, FreeSid

( 1 exports )
ServiceMain
RDS...: NSRL Reference Data Set
-
pdfid.: -
sigcheck:
publisher....: Absolute Software Corp.
copyright....: Copyright (c) 1997-2009 Absolute Software Corporation. All Rights Reserved.
product......: Installation/Management Application
description..: rpcnet
original name: rpcnet.dll
internal name: rpcnet
file version.: 8.0.885.0
comments.....:
signers......: Absolute Software Corp.
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 7:38 PM 3/3/2009
verified.....: -
trid..: Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)

[Ecinazuz]

jejda ...co jsi objevil????

log zde:

c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 2f4158cfe7801a73beaa7e8a9dfcad26
SHA1: 54f8866720054252de75a2f05643ce98b5a9d253
SHA256: c959993db45d484da3a811f2dd6a8bf522fcd15afa05b46053e061db500d66f3
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
Signing date: 19:38 3.3.2009
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 449bf2e12822299c0b153b61c5b8d58e
SHA1: c1e87a13152a35b325ed25062e38ed3f115affce
SHA256: d62fd3d2c44b8f540166b3cfce930ae6b5e2e54a724dc6c784241d9a5e44b644
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 12:34 21.10.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: af9e3107108e70c1af9f3831622068a3
SHA1: 0b6339b91dc49ccf962ee304e6829cce2e8ded81
SHA256: 839bd6d7ffb088c88d4a672a6c74c2ba50647a513134d1afbf9ad11e3fa7cf30
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 5a186198384a33ff53fb5b3a26368bb3
SHA1: b3dec5473d1ab94dd8bb73b636a8dcc5134008fc
SHA256: 74b32d14661941083554d260c7a9b38283e9830378608da3c71d380ad183396a

[Ecinazuz]

no- nejsem si vědomá, myslím že ne- nic...měla jsem ho puštěný hned od rána, abych měla v případě výpadku komunikaci zde....teď si nejsem vědoma, zda jsem tam strkala flash disk- dnes nebo už včera...hmm
OK - otestuju a hodím sem- za chvilku

[Ecinazuz]

http://www.virustotal.com/cs/analisis/b ... 1272217135

Soubor autochk.exe přijatý 2010.04.25 17:38:55 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/41 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: 2.
Odhadovaný čas začátku mezi 49 a 70 sekundami.
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.04.25 -
AhnLab-V3 5.0.0.2 2010.04.24 -
AntiVir 8.2.1.224 2010.04.23 -
Antiy-AVL 2.0.3.7 2010.04.23 -
Authentium 5.2.0.5 2010.04.25 -
Avast 4.8.1351.0 2010.04.25 -
Avast5 5.0.332.0 2010.04.25 -
AVG 9.0.0.787 2010.04.25 -
BitDefender 7.2 2010.04.25 -
CAT-QuickHeal 10.00 2010.04.23 -
ClamAV 0.96.0.3-git 2010.04.25 -
Comodo 4678 2010.04.25 -
DrWeb 5.0.2.03300 2010.04.25 -
eSafe 7.0.17.0 2010.04.25 -
eTrust-Vet 35.2.7448 2010.04.24 -
F-Prot 4.5.1.85 2010.04.25 -
F-Secure 9.0.15370.0 2010.04.25 -
Fortinet 4.0.14.0 2010.04.25 -
GData 21 2010.04.25 -
Ikarus T3.1.1.80.0 2010.04.25 -
Jiangmin 13.0.900 2010.04.25 -
Kaspersky 7.0.0.125 2010.04.25 -
McAfee 5.400.0.1158 2010.04.25 -
McAfee-GW-Edition 6.8.5 2010.04.23 -
Microsoft 1.5703 2010.04.25 -
NOD32 5059 2010.04.25 -
Norman 6.04.11 2010.04.25 -
nProtect 2010-04-25.01 2010.04.25 -
Panda 10.0.2.7 2010.04.24 -
PCTools 7.0.3.5 2010.04.25 -
Prevx 3.0 2010.04.25 -
Rising 22.44.06.04 2010.04.25 -
Sophos 4.53.0 2010.04.25 -
Sunbelt 6221 2010.04.25 -
Symantec 20091.2.0.41 2010.04.25 -
TheHacker 6.5.2.0.268 2010.04.25 -
TrendMicro 9.120.0.1004 2010.04.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.25 -
VBA32 3.12.12.4 2010.04.23 -
ViRobot 2010.4.24.2293 2010.04.25 -
VirusBuster 5.0.27.0 2010.04.24 -
Rozšiřující informace
File size: 643072 bytes
MD5...: 10761177a6ebe45843f443e99509f5e7
SHA1..: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
ssdeep: 12288:tSEAtt25iCeWblH8BYP7JcCAUC6B+KYQmvFNo:t4/u/VbbPdcC/XBbYFv3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xe6f5
timedatestamp.....: 0x49e01952 (Sat Apr 11 04:15:14 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x610e4 0x61200 6.14 2b2e69931e8222c604a51d37f21cefec
.data 0x63000 0x3100 0x2c00 4.06 0353998f17a5811aacd414d4e2719b8a
.rsrc 0x67000 0x36ca0 0x36e00 3.44 09a73089ca0835379346e7fb315e8e97
.reloc 0x9e000 0x1f42 0x2000 5.62 92ce97169bf800e3ccbf3a50c2b2d864

( 1 imports )
> ntdll.dll: _wcsicmp, wcsstr, NtClose, NtQueryValueKey, NtOpenKey, RtlInitUnicodeString, NtQuerySymbolicLinkObject, NtOpenSymbolicLinkObject, RtlPrefixUnicodeString, RtlEqualUnicodeString, NtQueryDirectoryObject, NtOpenDirectoryObject, LdrSetMUICacheType, NtTerminateProcess, RtlUnhandledExceptionFilter, RtlUnwind, DbgBreakPoint, RtlFreeAnsiString, RtlAllocateHeap, isspace, RtlUnicodeStringToAnsiString, RtlNormalizeProcessParams, _vsnwprintf, NtDelayExecution, isprint, memcpy, memset, NtDeviceIoControlFile, _allmul, _alldiv, NtWriteFile, NtReadFile, NtQueryVolumeInformationFile, NtFsControlFile, NtOpenFile, NtQueryInformationFile, RtlRaiseStatus, memmove, _chkstk, wcsspn, _vsnprintf, RtlOemToUnicodeN, RtlMultiByteToUnicodeN, RtlUnicodeToOemN, RtlUnicodeToMultiByteN, _wcsupr, _wcslwr, _atoi64, atol, _allshl, _aulldiv, RtlFreeUnicodeString, RtlDosPathNameToNtPathName_U, NtShutdownSystem, NtAdjustPrivilegesToken, NtOpenProcessToken, NtQuerySystemTime, NtQuerySystemInformation, NtSetInformationFile, NtCreateFile, RtlValidRelativeSecurityDescriptor, RtlExpandEnvironmentStrings_U, NtSetThreadExecutionState, RtlRandomEx, RtlFreeHeap, RtlSizeHeap, qsort, NtDisplayString, NtWaitForMultipleObjects, NtCreateEvent, RtlFormatMessage, RtlAnsiStringToUnicodeString, RtlInitAnsiStringEx, RtlFindMessage, wcsncmp, RtlQueryRegistryValues, RtlWriteRegistryValue, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, RtlAddAce, RtlCopySid, RtlLengthSid, RtlQueryInformationAcl, RtlCreateAcl, RtlAddAccessAllowedAce, RtlVerifyVersionInfo, VerSetConditionMask, RtlLengthSecurityDescriptor, RtlValidSecurityDescriptor, RtlNewSecurityObject, RtlSetDaclSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlCreateSecurityDescriptor, RtlTimeToTimeFields, RtlSystemTimeToLocalTime, _allrem, RtlDecompressBuffer, RtlUpcaseUnicodeString, NtTerminateThread, NtSetEvent, NtWaitForSingleObject, NtQueryInformationThread, RtlCreateUserThread, RtlComputeCrc32, DbgPrint, RtlDeleteElementGenericTable, RtlFindSetBits, RtlClearBits, RtlInitializeBitMap, RtlLookupElementGenericTable, RtlNumberOfSetBits, RtlEnumerateGenericTableWithoutSplaying, RtlSetBits, RtlInsertElementGenericTable, RtlInitializeGenericTable, _aulldvrm, RtlAnsiCharToUnicodeChar

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Auto Check Utility
original name: AutoChk.Exe
internal name: AutoChk
file version.: 6.0.6002.18005 (lh_sp2rtm.090410-1830)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

[Ecinazuz]

zajímavé, že mi to napsalo, že soubor byl testován...i ten předchozí

http://www.virustotal.com/cs/analisis/6 ... 1272217307

Soubor autoconv.exe přijatý 2010.04.25 17:41:47 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/41 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: ___.
Odhadovaný čas začátku mezi ___ a ___ .
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.04.25 -
AhnLab-V3 5.0.0.2 2010.04.24 -
AntiVir 8.2.1.224 2010.04.23 -
Antiy-AVL 2.0.3.7 2010.04.23 -
Authentium 5.2.0.5 2010.04.25 -
Avast 4.8.1351.0 2010.04.25 -
Avast5 5.0.332.0 2010.04.25 -
AVG 9.0.0.787 2010.04.25 -
BitDefender 7.2 2010.04.25 -
CAT-QuickHeal 10.00 2010.04.23 -
ClamAV 0.96.0.3-git 2010.04.25 -
Comodo 4678 2010.04.25 -
DrWeb 5.0.2.03300 2010.04.25 -
eSafe 7.0.17.0 2010.04.25 -
eTrust-Vet 35.2.7448 2010.04.24 -
F-Prot 4.5.1.85 2010.04.25 -
F-Secure 9.0.15370.0 2010.04.25 -
Fortinet 4.0.14.0 2010.04.25 -
GData 21 2010.04.25 -
Ikarus T3.1.1.80.0 2010.04.25 -
Jiangmin 13.0.900 2010.04.25 -
Kaspersky 7.0.0.125 2010.04.25 -
McAfee 5.400.0.1158 2010.04.25 -
McAfee-GW-Edition 6.8.5 2010.04.23 -
Microsoft 1.5703 2010.04.25 -
NOD32 5059 2010.04.25 -
Norman 6.04.11 2010.04.25 -
nProtect 2010-04-25.01 2010.04.25 -
Panda 10.0.2.7 2010.04.24 -
PCTools 7.0.3.5 2010.04.25 -
Prevx 3.0 2010.04.25 -
Rising 22.44.06.04 2010.04.25 -
Sophos 4.53.0 2010.04.25 -
Sunbelt 6221 2010.04.25 -
Symantec 20091.2.0.41 2010.04.25 -
TheHacker 6.5.2.0.268 2010.04.25 -
TrendMicro 9.120.0.1004 2010.04.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.25 -
VBA32 3.12.12.4 2010.04.23 -
ViRobot 2010.4.24.2293 2010.04.25 -
VirusBuster 5.0.27.0 2010.04.24 -
Rozšiřující informace
File size: 656896 bytes
MD5...: 15b7bda10b91fe62466f2a18682c16e8
SHA1..: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
ssdeep: 12288:0YtohAlMDpvN8yDZtR06g14FbSPEHv2GFN3:SZpF7tR5g14FbSMHeG3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xd6dd
timedatestamp.....: 0x49e01952 (Sat Apr 11 04:15:14 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6461c 0x64800 6.15 1bc7e18762f0d6f0b0edb99aa8c498ec
.data 0x66000 0x31a0 0x2c00 4.07 9661a707dcdd0da49a82f462bdd7820c
.rsrc 0x6a000 0x36cd8 0x36e00 3.44 ea348fe25b63447397ea236e97826ca2
.reloc 0xa1000 0x1ff2 0x2000 5.69 54dcb35f1d28f5e0092e3a516d542b71

( 1 imports )
> ntdll.dll: _wcsicmp, _wcsupr, NtClose, NtSetInformationFile, NtOpenFile, NtDelayExecution, _stricmp, NtLoadDriver, RtlInitUnicodeString, RtlAdjustPrivilege, LdrSetMUICacheType, NtTerminateProcess, DbgBreakPoint, RtlFreeAnsiString, RtlAllocateHeap, isspace, RtlUnicodeStringToAnsiString, RtlNormalizeProcessParams, _vsnwprintf, isprint, memcpy, _vsnprintf, RtlOemToUnicodeN, RtlMultiByteToUnicodeN, RtlUnicodeToOemN, RtlUnicodeToMultiByteN, memmove, _wcslwr, _chkstk, _allmul, _alldiv, _allshl, memset, _aulldiv, RtlFreeUnicodeString, RtlDosPathNameToNtPathName_U, NtShutdownSystem, NtAdjustPrivilegesToken, NtOpenProcessToken, NtQuerySystemTime, NtQuerySystemInformation, NtQuerySymbolicLinkObject, NtOpenSymbolicLinkObject, NtQueryInformationFile, NtWriteFile, NtCreateFile, NtFsControlFile, RtlValidRelativeSecurityDescriptor, RtlExpandEnvironmentStrings_U, NtQueryAttributesFile, NtSetThreadExecutionState, NtDeviceIoControlFile, NtReadFile, NtQueryVolumeInformationFile, RtlRaiseStatus, RtlRandomEx, NtDisplayString, NtWaitForMultipleObjects, NtCreateEvent, RtlFreeHeap, RtlSizeHeap, RtlPrefixUnicodeString, NtQueryValueKey, NtOpenKey, RtlFormatMessage, RtlAnsiStringToUnicodeString, RtlInitAnsiStringEx, RtlFindMessage, wcsncmp, RtlQueryRegistryValues, RtlWriteRegistryValue, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, RtlAddAce, RtlCopySid, RtlLengthSid, RtlQueryInformationAcl, RtlCreateAcl, RtlAddAccessAllowedAce, RtlVerifyVersionInfo, VerSetConditionMask, RtlLengthSecurityDescriptor, RtlValidSecurityDescriptor, RtlNewSecurityObject, RtlSetDaclSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlCreateSecurityDescriptor, RtlLocalTimeToSystemTime, _allrem, RtlTimeFieldsToTime, RtlTimeToTimeFields, RtlSystemTimeToLocalTime, NtTerminateThread, NtSetEvent, NtWaitForSingleObject, NtQueryInformationThread, RtlCreateUserThread, RtlUpcaseUnicodeString, RtlComputeCrc32, DbgPrint, RtlDecompressBuffer, RtlDeleteElementGenericTable, RtlFindSetBits, RtlClearBits, RtlInitializeBitMap, RtlLookupElementGenericTable, RtlNumberOfSetBits, RtlEnumerateGenericTableWithoutSplaying, RtlSetBits, RtlInsertElementGenericTable, RtlInitializeGenericTable, qsort, RtlUnhandledExceptionFilter, _aulldvrm, RtlAnsiCharToUnicodeChar, RtlUnwind

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Auto File System Conversion Utility
original name: AUTOCONV.EXE
internal name: autoconv
file version.: 6.0.6002.18005 (lh_sp2rtm.090410-1830)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

[Ecinazuz]

další.../samé zajímavé čtení...pro mě ;.)/

http://www.virustotal.com/cs/analisis/d ... 1272217500

Soubor rpcnet.exe přijatý 2010.04.25 17:45:00 (UTC)

Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/41 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: ___.
Odhadovaný čas začátku mezi ___ a ___ .
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.04.25 -
AhnLab-V3 5.0.0.2 2010.04.24 -
AntiVir 8.2.1.224 2010.04.23 -
Antiy-AVL 2.0.3.7 2010.04.23 -
Authentium 5.2.0.5 2010.04.25 -
Avast 4.8.1351.0 2010.04.25 -
Avast5 5.0.332.0 2010.04.25 -
AVG 9.0.0.787 2010.04.25 -
BitDefender 7.2 2010.04.25 -
CAT-QuickHeal 10.00 2010.04.23 -
ClamAV 0.96.0.3-git 2010.04.25 -
Comodo 4678 2010.04.25 -
DrWeb 5.0.2.03300 2010.04.25 -
eSafe 7.0.17.0 2010.04.25 -
eTrust-Vet 35.2.7448 2010.04.24 -
F-Prot 4.5.1.85 2010.04.25 -
F-Secure 9.0.15370.0 2010.04.25 -
Fortinet 4.0.14.0 2010.04.25 -
GData 21 2010.04.25 -
Ikarus T3.1.1.80.0 2010.04.25 -
Jiangmin 13.0.900 2010.04.25 -
Kaspersky 7.0.0.125 2010.04.25 -
McAfee 5.400.0.1158 2010.04.25 -
McAfee-GW-Edition 6.8.5 2010.04.23 -
Microsoft 1.5703 2010.04.25 -
NOD32 5059 2010.04.25 -
Norman 6.04.11 2010.04.25 -
nProtect 2010-04-25.01 2010.04.25 -
Panda 10.0.2.7 2010.04.24 -
PCTools 7.0.3.5 2010.04.25 -
Prevx 3.0 2010.04.25 -
Rising 22.44.06.04 2010.04.25 -
Sophos 4.53.0 2010.04.25 -
Sunbelt 6221 2010.04.25 -
Symantec 20091.2.0.41 2010.04.25 -
TheHacker 6.5.2.0.268 2010.04.25 -
TrendMicro 9.120.0.1004 2010.04.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.25 -
VBA32 3.12.12.4 2010.04.23 -
ViRobot 2010.4.24.2293 2010.04.25 -
VirusBuster 5.0.27.0 2010.04.24 -
Rozšiřující informace
File size: 56680 bytes
MD5...: 449bf2e12822299c0b153b61c5b8d58e
SHA1..: c1e87a13152a35b325ed25062e38ed3f115affce
SHA256: d62fd3d2c44b8f540166b3cfce930ae6b5e2e54a724dc6c784241d9a5e44b644
ssdeep: 768:EJTMRW36uadqY3bIxaiXssKrXbdURa1MRAn/v2mN90ebqAMt2IHjPz3Ot0qP
G4Pb:rW3/aEwsK7iCMun/eAeydt0Yw4G4
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1c10
timedatestamp.....: 0x49ad6b29 (Tue Mar 03 17:38:49 2009)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9129 0x9200 6.51 9becfb7d2513d33591ab673115bba95f
.data 0xb000 0x1d74 0x1e00 3.36 62bbc527cc88a05d5c449d6103467740
.cdata 0xd000 0x298 0x400 2.66 c93e206aac1e4e4b1506d414a18738eb
.rsrc 0xe000 0x448 0x600 2.54 66c04b9abc0c570bb3b2612f0ccfd50b
.reloc 0xf000 0x9ee 0xa00 6.24 3a404a244b8c32be9260e308210f9344

( 7 imports )
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -
> TAPI32.dll: lineDeallocateCall, lineMakeCall, lineSetDevConfig, lineGetID, lineSetStatusMessages, lineGetDevCaps, lineInitialize, lineGetDevConfig, lineOpen, lineShutdown, lineGetCallStatus, lineDrop, lineClose
> NETAPI32.dll: Netbios
> USERENV.dll: CreateEnvironmentBlock, DestroyEnvironmentBlock
> KERNEL32.dll: lstrcatA, lstrcpyA, MapViewOfFile, CreateFileMappingA, SetEvent, ResetEvent, WaitForSingleObject, LocalAlloc, CreateThread, GetLastError, BackupRead, BackupWrite, OpenProcess, GetCurrentProcessId, GetCurrentProcess, FreeLibrary, GetProcAddress, LoadLibraryA, DeleteFileA, lstrlenA, CreateFileA, BackupSeek, GetFileAttributesExA, SetFileTime, SetFileAttributesA, CreateEventA, GetVersionExA, GetSystemDirectoryA, FindClose, FindFirstFileA, lstrcmpiA, lstrcmpA, LoadLibraryExA, GetModuleHandleA, WriteFile, GetWindowsDirectoryA, GetEnvironmentVariableA, GetExitCodeThread, WaitForMultipleObjects, CreateRemoteThread, VirtualFreeEx, WriteProcessMemory, VirtualAllocEx, SetFilePointer, CopyFileA, GetModuleFileNameA, SetStdHandle, TerminateProcess, CreateProcessA, ReadProcessMemory, GetStdHandle, HeapAlloc, HeapFree, GetProcessHeap, RaiseException, GetVersion, RtlUnwind, ClearCommError, PurgeComm, GetOverlappedResult, EnterCriticalSection, LeaveCriticalSection, WaitCommEvent, SetCommMask, ReadFile, Sleep, DeleteCriticalSection, SetThreadPriority, InitializeCriticalSection, SetCommTimeouts, SetCommState, GetCommState, SetupComm, GetCommProperties, GetCurrentThreadId, GetLocalTime, GetCommandLineA, FlushFileBuffers, ExitProcess, ResumeThread, GetComputerNameA, TerminateThread, LocalFree, CloseHandle, UnmapViewOfFile, ExitThread
> USER32.dll: PeekMessageA, KillTimer, PostMessageA, GetMessageA, TranslateMessage, PostQuitMessage, DefWindowProcA, wsprintfA, RegisterClassA, CreateWindowExA, DispatchMessageA, MsgWaitForMultipleObjects, SendMessageA, PostThreadMessageA, SetTimer
> ADVAPI32.dll: ControlService, DeleteService, CreateServiceA, QueryServiceConfigA, ChangeServiceConfigA, OpenSCManagerA, OpenServiceA, QueryServiceStatus, StartServiceA, CloseServiceHandle, EqualSid, RegisterServiceCtrlHandlerA, SetServiceStatus, StartServiceCtrlDispatcherA, DuplicateTokenEx, SetTokenInformation, CreateProcessAsUserA, RegOpenKeyA, RegCreateKeyExA, RegSetValueExA, SetKernelObjectSecurity, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, GetTokenInformation, AdjustTokenPrivileges, GetKernelObjectSecurity, AllocateAndInitializeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclA, FreeSid

( 1 exports )
ServiceMain
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
sigcheck:
publisher....: Absolute Software Corp.
copyright....: Copyright (c) 1997-2009 Absolute Software Corporation. All Rights Reserved.
product......: Installation/Management Application
description..: rpcnet
original name: rpcnet.dll
internal name: rpcnet
file version.: 8.0.885.0
comments.....:
signers......: Absolute Software Corp.
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 7:38 PM 3/3/2009
verified.....: -

[Ecinazuz]

poslední...tady něco je červeně

http://www.virustotal.com/cs/analisis/8 ... 1272218274

Soubor rpcnetp.dll přijatý 2010.04.25 17:57:54 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 2/41 (4.88%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: ___.
Odhadovaný čas začátku mezi ___ a ___ .
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.04.25 -
AhnLab-V3 5.0.0.2 2010.04.24 -
AntiVir 8.2.1.224 2010.04.23 -
Antiy-AVL 2.0.3.7 2010.04.23 -
Authentium 5.2.0.5 2010.04.25 -
Avast 4.8.1351.0 2010.04.25 -
Avast5 5.0.332.0 2010.04.25 -
AVG 9.0.0.787 2010.04.25 -
BitDefender 7.2 2010.04.25 -
CAT-QuickHeal 10.00 2010.04.23 -
ClamAV 0.96.0.3-git 2010.04.25 -
Comodo 4678 2010.04.25 ApplicUnsaf.Win32.Spy.Agent.~chn
DrWeb 5.0.2.03300 2010.04.25 -
eSafe 7.0.17.0 2010.04.25 -
eTrust-Vet 35.2.7448 2010.04.24 -
F-Prot 4.5.1.85 2010.04.25 -
F-Secure 9.0.15370.0 2010.04.25 -
Fortinet 4.0.14.0 2010.04.25 -
GData 21 2010.04.25 -
Ikarus T3.1.1.80.0 2010.04.25 -
Jiangmin 13.0.900 2010.04.25 -
Kaspersky 7.0.0.125 2010.04.25 -
McAfee 5.400.0.1158 2010.04.25 -
McAfee-GW-Edition 6.8.5 2010.04.23 Heuristic.BehavesLike.Win32.CodeInjection.L
Microsoft 1.5703 2010.04.25 -
NOD32 5059 2010.04.25 -
Norman 6.04.11 2010.04.25 -
nProtect 2010-04-25.01 2010.04.25 -
Panda 10.0.2.7 2010.04.24 -
PCTools 7.0.3.5 2010.04.25 -
Prevx 3.0 2010.04.25 -
Rising 22.44.06.04 2010.04.25 -
Sophos 4.53.0 2010.04.25 -
Sunbelt 6221 2010.04.25 -
Symantec 20091.2.0.41 2010.04.25 -
TheHacker 6.5.2.0.268 2010.04.25 -
TrendMicro 9.120.0.1004 2010.04.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.25 -
VBA32 3.12.12.4 2010.04.23 -
ViRobot 2010.4.24.2293 2010.04.25 -
VirusBuster 5.0.27.0 2010.04.25 -
Rozšiřující informace
File size: 17408 bytes
MD5...: af9e3107108e70c1af9f3831622068a3
SHA1..: 0b6339b91dc49ccf962ee304e6829cce2e8ded81
SHA256: 839bd6d7ffb088c88d4a672a6c74c2ba50647a513134d1afbf9ad11e3fa7cf30
ssdeep: 384:ZsGXp8CWaNqI26hYW1HY0AjQCvRS3VZ2OdyLfPj:Zlp8HDEhJHNAVvRSFIOo
P
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x34a1
timedatestamp.....: 0x45676934 (Fri Nov 24 21:50:44 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x35e6 0x3600 6.40 99f9ede84a1013437bece7405991becc
.data 0x5000 0x168 0x200 1.00 b5c9aecf7688efa830499f6fdd77d747
.cdata 0x6000 0x23c 0x400 1.32 1c5d729e2918939ddf594b7fb3d85fa4
.reloc 0x7000 0x338 0x400 5.81 68487b3d7b3b6e699e7b50df1f7f5126

( 4 imports )
> WSOCK32.dll: -, -
> USER32.dll: DefWindowProcA, wsprintfA, PostQuitMessage, RegisterClassA, TranslateMessage, GetMessageA, PeekMessageA, PostMessageA, DispatchMessageA, CreateWindowExA, SetTimer, PostThreadMessageA, KillTimer
> KERNEL32.dll: SetFilePointer, RtlUnwind, LocalAlloc, CreateProcessA, GetModuleHandleA, GetStdHandle, SetEvent, LocalFree, ReadFile, TerminateProcess, WriteProcessMemory, ReadProcessMemory, ResetEvent, LeaveCriticalSection, lstrcmpiA, ExitProcess, InitializeCriticalSection, CreateEventA, GetModuleFileNameA, GetProcAddress, WaitForSingleObject, WaitForMultipleObjects, ExitThread, TerminateThread, CreateRemoteThread, GetVersion, OpenProcess, EnterCriticalSection, lstrlenA, GetExitCodeThread, CreateThread, GetCurrentProcessId, CloseHandle, SetThreadPriority, ResumeThread, GetLastError, CreateFileA, FreeLibrary, RaiseException, lstrcpyA, GetOverlappedResult, WriteFile, CopyFileA, SetStdHandle, GetCurrentThreadId, lstrcatA, DeleteCriticalSection, VirtualAllocEx, VirtualFreeEx, Sleep, LoadLibraryA, GetEnvironmentVariableA
> ADVAPI32.dll: RegCloseKey, RegDeleteValueA, RegQueryValueExA, DuplicateTokenEx, RegOpenKeyExA, RegOpenKeyA, RegEnumValueA, SetServiceStatus, RegisterServiceCtrlHandlerA, OpenProcessToken, StartServiceCtrlDispatcherA, SetTokenInformation, CreateProcessAsUserA

( 1 exports )
rpcnetp
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

[Ecinazuz]

OK- necháme to na zítra - na mě už tu taky ,,řvou"...pokračování zítra odpoledne...
zatím dík...strávili jsme ,,spolu" pěkný víkend

[Ecinazuz]

ahoj - tak jsem tu

stáhla jsem enrur- pak restarovala PC- stáhla combofix- spustila- naběhlo modré okno- klasicky...ale během asi 2 minuty najednou vše spadlo- proběhl restart PC - s hláškou,,spustit systém windows běžnýn způsobem"....a něco o nezdařilé opravě-
spustila jsem systém- naběhlo...opět hláška o obnovení systému a neočekávaném vypnutí....log nikde...jinak žádná změna...snad vše ok

co dál- znovu?

[Ecinazuz]

hmm...tak stejné...
přejmenovala jsem, spustila- až do hlášky vyhledávám nakažené soubory vše OK- pak to spadlo

černá obraz. s hláškou- systém W. nebyl úspěšně ukončen a možnosti spuštění
vše naběhlo
log nevyběhl


/ale teď si nejsem úplně jistá, zda jsem náhodou špatně nepřetáhla ten cfscript.txt nad abraka - zůstal mi na ploše- nemá náhodou zmizet?/

dneska mám asi blbý den já- nemohla jsem udělat chybu v přejmenování souboru...minule jsem si abraka rovnou stáhla/teď už na tom odkazu nebyl/....teď jsem dala jen přejmenovat....../...bože já jsem .....

[Ecinazuz]

prostě to nejde- spadne to... ...a teď jsem to udělala 2x - pořád stejný průběh

[Ecinazuz]

oba logy v příloze- nevešlo se- ani ten první

[Ecinazuz]

ok- jasně - v pohodě
ještě nám dát prohledat nebo opravit? v OTL