XP internet security- hází varovné hlášky- prosím o kontrolu

Zpráva

Ecinazuz · #61 Příspěvek od **Ecinazuz** » 26 dub 2010 19:46

děkuju

....

protokol zde:

========== OTL ==========
Error: No service named rpcnet) Remote Procedure Call (RPC was found to stop!
Service\Driver key rpcnet) Remote Procedure Call (RPC not found.
C:\Windows\System32\rpcnet.exe moved successfully.
C:\Windows\System32\rpcnet.dll moved successfully.
C:\Windows\System32\rpcnetp.exe moved successfully.
========== FILES ==========
C:\Windows\System32\rpcnetp.dll moved successfully.

OTL by OldTimer - Version 3.2.3.0 log created on 04262010_204434

nový log OTL v příloze

dobrou- zítra!

Ecinazuz · #62 Příspěvek od **Ecinazuz** » 27 dub 2010 12:09

ahoj ;.)

opraveno- log:

========== OTL ==========
No active process named rpcnetp.exe was found!
Error: No service named rpcnet) Remote Procedure Call (RPC was found to stop!
Service\Driver key rpcnet) Remote Procedure Call (RPC not found.
Error: No service named rpcnetp was found to stop!
Service\Driver key rpcnetp not found.
C:\Windows\System32\rpcnetp.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Windows\System32\rpcnetp.exe moved successfully.
C:\Windows\System32\rpcnet.dll moved successfully.
C:\Windows\System32\rpcnet.exe moved successfully.
File C:\windows\System32\NTAgent.exe not found.
File C:\windows\System32\rpcnetp.dll not found.
C:\Users\Zuzana\Desktop\abraka.com.exe moved successfully.
File C:\Windows\System32\rpcnet.dll not found.
File C:\Windows\System32\rpcnet.exe not found.
File C:\Windows\System32\rpcnetp.dll not found.
File C:\Windows\System32\rpcnetp.exe not found.

OTL by OldTimer - Version 3.2.3.0 log created on 04272010_125736

log vyvoj.exe:

c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 2f4158cfe7801a73beaa7e8a9dfcad26
SHA1: 54f8866720054252de75a2f05643ce98b5a9d253
SHA256: c959993db45d484da3a811f2dd6a8bf522fcd15afa05b46053e061db500d66f3
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
Signing date: 19:38 3.3.2009
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 449bf2e12822299c0b153b61c5b8d58e
SHA1: c1e87a13152a35b325ed25062e38ed3f115affce
SHA256: d62fd3d2c44b8f540166b3cfce930ae6b5e2e54a724dc6c784241d9a5e44b644
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 12:34 21.10.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: af9e3107108e70c1af9f3831622068a3
SHA1: 0b6339b91dc49ccf962ee304e6829cce2e8ded81
SHA256: 839bd6d7ffb088c88d4a672a6c74c2ba50647a513134d1afbf9ad11e3fa7cf30
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 5a186198384a33ff53fb5b3a26368bb3
SHA1: b3dec5473d1ab94dd8bb73b636a8dcc5134008fc
SHA256: 74b32d14661941083554d260c7a9b38283e9830378608da3c71d380ad183396a
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 01a19f74cfb19cc61d62009bcfa59961
SHA1: bc03a872dc393db966a527eb8f58a97050dde13e
SHA256: 72e751793b7a2e960bfb687f06621d1113b502d10f061c1101670e64bd174b50
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
Signing date: 21:15 29.1.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 647826de6f7979432b360d38773570d4
SHA1: 64a242d08374a55f1d8de5e2f0f34fa982cd7f90
SHA256: a5c35f8d9ef78b5f0f3c8bca1cdcac71a7dfbddf247810107f344c0e88e07201
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 13:01 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 09781f9ca8277f1c99ea6c7c1e7f30ee
SHA1: fd54f2150cf473c41d93c021e0bbd68d497f0b87
SHA256: d9cb7c4ced24db58f206dc6fb026190b6bfddd4a7a902c52f988e11373b60b7a
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: c14731d94af1ef0cab3da53bdf8710e1
SHA1: f32db75af71d18007fb6e678c9be1e95dd5b3683
SHA256: a3ca85a2ad102c06d59ba32ccffcede6cc0f0e231cc29b6f41b49d309a46d55e
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 01a19f74cfb19cc61d62009bcfa59961
SHA1: bc03a872dc393db966a527eb8f58a97050dde13e
SHA256: 72e751793b7a2e960bfb687f06621d1113b502d10f061c1101670e64bd174b50
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
Signing date: 21:15 29.1.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 647826de6f7979432b360d38773570d4
SHA1: 64a242d08374a55f1d8de5e2f0f34fa982cd7f90
SHA256: a5c35f8d9ef78b5f0f3c8bca1cdcac71a7dfbddf247810107f344c0e88e07201
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 13:01 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 09781f9ca8277f1c99ea6c7c1e7f30ee
SHA1: fd54f2150cf473c41d93c021e0bbd68d497f0b87
SHA256: d9cb7c4ced24db58f206dc6fb026190b6bfddd4a7a902c52f988e11373b60b7a
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: c14731d94af1ef0cab3da53bdf8710e1
SHA1: f32db75af71d18007fb6e678c9be1e95dd5b3683
SHA256: a3ca85a2ad102c06d59ba32ccffcede6cc0f0e231cc29b6f41b49d309a46d55e

a u toho posledního OTL, kde vložím toto.
/md5start
autochk.exe
autoconv.exe
rpcnetp.exe
rpcnetp.dll
rpcnet.exe
rpcnet.dll
NTAgent.exe
/md5stop
mám dát vyčistit, prohledat nebo opravit?

#63 Příspěvek od **cernohous13** » 27 dub 2010 13:38

XP home SP3

autochk.zip: (222.3 KiB) Staženo 83 x

Ecinazuz · #64 Příspěvek od **Ecinazuz** » 27 dub 2010 13:49

ahoj- mám nového rádce?
promiň- nevím jestli se zase neptám blbě

- ale v tom noťasu, kterého se to teď týká mám Visty....ne XP
a ještě jsem nedokončila poslední proces v OTL...čekám na odpověď/pro jistotu/

#65 Příspěvek od **cernohous13** » 27 dub 2010 14:31

zůstáváš s Naughty - jen jsem mu chtěl usnadnit hledání - ale na Visty nemám, takže spam sorry

Ecinazuz · #66 Příspěvek od **Ecinazuz** » 27 dub 2010 17:13

ahoj

děkuji za nápovědu

zde log:

OTL logfile created on: 27.4.2010 18:06:43 - Run 3
OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Zuzana\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 61,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,88 Gb Total Space | 165,64 Gb Free Space | 74,32% Space Free | Partition Type: NTFS
Drive D: | 9,00 Gb Total Space | 2,01 Gb Free Space | 22,28% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1021,00 Mb Total Space | 1018,75 Mb Free Space | 99,78% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ZUZANA-PC
Current User Name: Zuzana
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.27 13:04:22 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
PRC - [2010.04.26 18:28:41 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Users\Zuzana\Desktop\OTL.exe
PRC - [2009.09.06 13:01:57 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.19 14:30:02 | 000,222,456 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2008.06.02 19:57:40 | 000,238,984 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
PRC - [2008.06.02 19:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
PRC - [2008.05.30 18:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
PRC - [2008.05.21 02:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe
PRC - [2008.05.14 19:55:14 | 000,077,824 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
PRC - [2008.05.14 19:54:36 | 010,244,096 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
PRC - [2008.05.13 11:47:28 | 001,624,616 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008.05.13 11:47:28 | 000,727,592 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008.05.12 15:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2008.04.04 17:10:24 | 001,314,816 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2008.03.31 23:41:22 | 000,091,440 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
PRC - [2008.01.21 04:33:00 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007.12.21 08:21:16 | 000,468,224 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2007.12.21 08:21:06 | 001,443,072 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2007.12.11 14:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2007.10.19 09:28:24 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE
PRC - [2007.05.16 01:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe
PRC - [2007.05.16 01:08:38 | 000,095,024 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\acevents.exe
PRC - [2007.05.16 01:08:08 | 000,293,168 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
PRC - [2007.03.06 19:20:00 | 000,536,576 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2007.01.29 21:12:14 | 000,030,248 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2007.01.05 04:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

========== Modules (SafeList) ==========

MOD - [2010.04.26 18:28:41 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Users\Zuzana\Desktop\OTL.exe
MOD - [2009.04.11 08:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008.05.21 02:42:48 | 000,080,656 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\ItClient.dll
MOD - [2008.05.13 11:46:58 | 000,208,896 | ---- | M] (Broadcom Corporation.) -- C:\Windows\System32\BtMmHook.dll
MOD - [2008.03.25 14:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\Windows\System32\APSHook.dll
MOD - [2008.01.21 04:33:43 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll

========== Win32 Services (SafeList) ==========

SRV - [2010.04.27 13:04:22 | 000,057,752 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\System32\rpcnet.exe -- (rpcnet) Remote Procedure Call (RPC)
SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.05.10 15:14:48 | 000,306,432 | ---- | M] (TuneUp Software GmbH) [On_Demand | Stopped] -- C:\Windows\System32\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2009.02.18 20:38:43 | 000,129,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008.10.19 14:30:02 | 000,222,456 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008.06.02 19:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2008.05.30 18:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)
SRV - [2008.05.21 02:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)
SRV - [2008.05.21 02:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)
SRV - [2008.05.14 19:55:14 | 000,077,824 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)
SRV - [2008.05.12 15:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2008.01.21 04:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.12.21 08:22:44 | 000,019,200 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2007.12.21 08:21:16 | 000,468,224 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2007.12.20 10:41:56 | 000,029,440 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2007.12.11 14:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2007.10.19 09:28:24 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)
SRV - [2007.05.16 01:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)
SRV - [2007.01.19 12:54:14 | 000,097,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc)
SRV - [2007.01.05 04:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

========== Driver Services (SafeList) ==========

DRV - [2009.03.27 06:48:22 | 001,810,992 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.11.21 21:53:40 | 001,204,128 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008.05.30 18:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SbAlg.sys -- (SbAlg)
DRV - [2008.05.30 18:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\Windows\System32\drivers\SbFsLock.sys -- (SbFsLock)
DRV - [2008.05.30 18:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\Windows\System32\drivers\rsvlock.sys -- (RsvLock)
DRV - [2008.05.30 18:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SafeBoot.sys -- (SafeBoot)
DRV - [2008.05.28 14:27:42 | 000,016,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2008.05.28 14:27:40 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2008.05.28 14:27:40 | 000,080,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2008.05.21 12:35:06 | 003,552,768 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.04.28 11:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2008.04.14 23:39:06 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2008.04.11 16:38:44 | 000,382,464 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2008.04.07 20:13:46 | 000,025,448 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)
DRV - [2008.04.07 20:13:42 | 000,034,664 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2008.04.03 23:57:00 | 000,310,272 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
DRV - [2008.03.27 21:06:00 | 000,199,472 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2008.03.21 20:35:24 | 001,207,288 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2008.01.21 04:32:53 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008.01.21 04:32:53 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008.01.21 04:32:52 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008.01.21 04:32:52 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008.01.21 04:32:52 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Boot | Running] -- C:\windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008.01.21 04:32:52 | 000,045,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2008.01.21 04:32:52 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008.01.21 04:32:51 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008.01.21 04:32:51 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008.01.21 04:32:50 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008.01.21 04:32:50 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008.01.21 04:32:50 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008.01.21 04:32:49 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008.01.21 04:32:49 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Boot | Running] -- C:\windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008.01.21 04:32:49 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008.01.21 04:32:49 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008.01.21 04:32:49 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\arc.sys -- (arc)
DRV - [2008.01.21 04:32:48 | 000,342,584 | ---- | M] (Emulex) [Kernel | Boot | Running] -- C:\windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008.01.21 04:32:48 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008.01.21 04:32:47 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008.01.21 04:32:47 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008.01.21 04:32:46 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008.01.21 04:32:45 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008.01.21 04:32:44 | 000,179,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2008.01.21 04:32:21 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008.01.21 04:32:21 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008.01.21 04:32:21 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007.12.21 08:21:54 | 000,053,768 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2007.12.21 08:21:52 | 000,030,728 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2007.12.21 08:21:46 | 000,071,176 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfw.sys -- (epfw)
DRV - [2007.12.21 08:20:14 | 000,030,216 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\easdrv.sys -- (easdrv)
DRV - [2007.12.21 08:19:54 | 000,039,944 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\eamon.sys -- (eamon)
DRV - [2007.06.19 02:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006.12.20 05:58:26 | 000,097,920 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\adusbser.sys -- (adusbser)
DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Boot | Running] -- C:\windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] -- C:\windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Boot | Running] -- C:\windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4068558042-2140266930-2156247005-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
IE - HKU\S-1-5-21-4068558042-2140266930-2156247005-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-4068558042-2140266930-2156247005-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-4068558042-2140266930-2156247005-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_result ... id=afex&q="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.19 18:22:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.25 19:54:21 | 000,000,000 | ---D | M]

[2009.05.10 15:26:06 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Extensions
[2010.04.26 16:57:40 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\extensions
[2009.09.03 13:37:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.01.11 15:10:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.04.26 16:26:52 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-1.xml
[2010.03.26 13:34:42 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-10.xml
[2010.04.19 18:22:28 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-11.xml
[2009.07.30 07:55:45 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-2.xml
[2009.08.05 15:22:07 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-3.xml
[2009.09.23 14:08:47 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-4.xml
[2009.11.06 13:39:04 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-5.xml
[2009.12.18 14:46:01 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-6.xml
[2010.01.11 15:10:18 | 000,000,961 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-7.xml
[2010.02.23 13:37:08 | 000,000,961 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-8.xml
[2010.03.12 13:59:54 | 000,000,950 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin-9.xml
[2008.03.31 10:52:00 | 000,000,168 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin.gif
[2008.03.31 10:52:00 | 000,000,618 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin.src
[2009.06.09 13:38:18 | 000,000,944 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Mozilla\Firefox\Profiles\yj5lnyok.default\searchplugins\icqplugin.xml
[2010.04.26 16:57:40 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.05.10 21:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.04.26 16:55:20 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.03.12 13:59:44 | 000,000,638 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\jyxo-cz.xml
[2010.03.12 13:59:44 | 000,001,687 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\mall-cz.xml
[2010.03.12 13:59:44 | 000,001,367 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\seznam-cz.xml
[2010.03.12 13:59:44 | 000,000,654 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\slunecnice-cz.xml
[2010.03.12 13:59:44 | 000,001,179 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (BHO_Startup Class) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKU\S-1-5-21-4068558042-2140266930-2156247005-1004\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [accrdsub] c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CognizanceTS] c:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Bioscrypt Inc.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Zuzana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Hledání panelu &AOL Toolbar - C:\ProgramData\AOL\ieToolbar\resources\cs-CZ\local\search.html ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\APSHook.dll) - C:\Windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - AppInit_DLLs: (C:\Windows\System32\APSHook.dll) - C:\Windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - AppInit_DLLs: (C:\Windows\System32\APSHook.dll) - C:\Windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - AppInit_DLLs: (C:\Windows\System32\APSHook.dll) - C:\Windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - AppInit_DLLs: (APSHook.dll) - C:\windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Zuzana\Pictures\P1000442.JPG
O24 - Desktop BackupWallPaper: C:\Users\Zuzana\Pictures\P1000442.JPG
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{419fd94f-9310-11de-8ca3-0021867955c0}\Shell\AutoRun\command - "" = G:\EmDesk.exe -- File not found
O33 - MountPoints2\{419fd94f-9310-11de-8ca3-0021867955c0}\Shell\EmDesk\command - "" = G:\EmDesk.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.04.27 13:04:51 | 000,057,752 | ---- | C] (Absolute Software Corp.) -- C:\windows\System32\rpcnet.exe
[2010.04.27 13:04:51 | 000,057,752 | ---- | C] (Absolute Software Corp.) -- C:\windows\System32\rpcnet.dll
[2010.04.26 20:44:34 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.04.26 18:28:00 | 000,563,712 | ---- | C] (OldTimer Tools) -- C:\Users\Zuzana\Desktop\OTL.exe
[2010.04.26 18:15:41 | 000,000,000 | --SD | C] -- C:\abraka
[2010.04.26 18:15:00 | 000,212,480 | ---- | C] (SteelWerX) -- C:\windows\SWXCACLS.exe
[2010.04.26 17:03:11 | 000,031,232 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2010.04.26 17:03:07 | 000,161,792 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2010.04.26 17:03:05 | 000,136,704 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2010.04.26 17:02:15 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.04.26 16:55:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010.04.26 16:35:53 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
[2010.04.26 16:34:51 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010.04.25 19:54:21 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\deploytk.dll
[2010.04.25 19:54:20 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe
[2010.04.25 19:54:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe
[2010.04.25 19:54:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe
[2010.04.25 19:15:42 | 000,000,000 | ---D | C] -- C:\Users\Zuzana\plocha
[2010.04.25 17:42:53 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.04.25 17:42:53 | 000,000,000 | ---D | C] -- C:\rsit
[2010.04.15 13:31:15 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll
[2010.04.15 13:31:14 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll
[2010.04.15 13:31:13 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstime.dll
[2010.04.15 13:31:10 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl
[2010.04.15 13:31:09 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll
[2010.04.15 13:31:08 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll
[2010.04.15 13:31:06 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe
[2010.04.15 13:31:05 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesysprep.dll
[2010.04.15 13:31:05 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll
[2010.04.15 13:31:04 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll
[2010.04.15 13:31:02 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ie4uinit.exe
[2010.04.15 13:31:02 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe
[2010.04.15 13:31:01 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesetup.dll
[2010.04.15 13:31:00 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb
[2010.04.15 13:31:00 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iernonce.dll
[2010.04.15 13:23:34 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntoskrnl.exe
[2010.04.15 13:23:33 | 003,600,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntkrnlpa.exe
[2010.04.15 13:23:03 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\vbscript.dll
[2010.04.15 13:18:10 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\windows\System32\l3codeca.acm
[2010.04.15 13:18:08 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\windows\System32\l3codecp.acm
[2010.04.14 11:00:38 | 000,000,000 | ---D | C] -- C:\Users\Zuzana\Desktop\dovolená egypt
[2009.05.10 13:10:45 | 000,180,224 | ---- | C] ( ) -- C:\windows\System32\rsnp2uvc.dll
[2008.10.09 03:28:56 | 000,195,120 | ---- | C] ( ) -- C:\windows\System32\csnp2uvc.dll

========== Files - Modified Within 30 Days ==========

[2010.04.27 18:08:30 | 002,621,440 | -HS- | M] () -- C:\Users\Zuzana\NTUSER.DAT
[2010.04.27 16:59:18 | 001,516,682 | ---- | M] () -- C:\windows\System32\PerfStringBackup.INI
[2010.04.27 16:59:18 | 000,639,248 | ---- | M] () -- C:\windows\System32\perfh005.dat
[2010.04.27 16:59:18 | 000,628,486 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2010.04.27 16:59:18 | 000,135,978 | ---- | M] () -- C:\windows\System32\perfc005.dat
[2010.04.27 16:59:18 | 000,117,988 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2010.04.27 16:55:05 | 000,017,408 | ---- | M] () -- C:\windows\System32\rpcnetp.exe
[2010.04.27 16:55:03 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\windows\System32\rpcnet.dll
[2010.04.27 16:54:51 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.04.27 16:54:51 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.04.27 16:54:51 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
[2010.04.27 16:54:44 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2010.04.27 16:54:40 | 1875,763,200 | -HS- | M] () -- C:\hiberfil.sys
[2010.04.27 14:53:45 | 000,000,012 | ---- | M] () -- C:\windows\bthservsdp.dat
[2010.04.27 14:53:35 | 000,524,288 | -HS- | M] () -- C:\Users\Zuzana\NTUSER.DAT{c78acd14-0c69-11dd-a5c3-001560bf5b5e}.TMContainer00000000000000000001.regtrans-ms
[2010.04.27 14:53:35 | 000,065,536 | -HS- | M] () -- C:\Users\Zuzana\NTUSER.DAT{c78acd14-0c69-11dd-a5c3-001560bf5b5e}.TM.blf
[2010.04.27 14:53:21 | 002,679,169 | -H-- | M] () -- C:\Users\Zuzana\AppData\Local\IconCache.db
[2010.04.27 13:08:05 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010.04.27 13:08:05 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.04.27 13:06:07 | 000,007,000 | ---- | M] () -- C:\Users\Zuzana\Desktop\log- vývoj.exe
[2010.04.27 13:04:22 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\windows\System32\rpcnet.exe
[2010.04.27 13:01:50 | 000,017,408 | ---- | M] () -- C:\windows\System32\rpcnetp.dll
[2010.04.26 21:17:53 | 000,002,936 | ---- | M] () -- C:\Users\Zuzana\Documents\cc_20100426_211746.reg
[2010.04.26 18:28:41 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Users\Zuzana\Desktop\OTL.exe
[2010.04.26 17:57:08 | 003,923,062 | ---- | M] () -- C:\Users\Zuzana\Desktop\abraka.com
[2010.04.26 16:55:08 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.04.26 16:35:10 | 000,000,913 | ---- | M] () -- C:\Users\Zuzana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010.04.26 16:35:02 | 000,000,733 | ---- | M] () -- C:\Users\Zuzana\Desktop\NTREGOPT.lnk
[2010.04.26 16:35:02 | 000,000,714 | ---- | M] () -- C:\Users\Zuzana\Desktop\ERUNT.lnk
[2010.04.25 19:54:00 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaws.exe
[2010.04.25 19:54:00 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\javaw.exe
[2010.04.25 19:53:58 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\java.exe
[2010.04.25 19:53:57 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\windows\System32\deploytk.dll
[2010.04.25 19:29:52 | 000,377,624 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2010.04.25 19:14:12 | 000,206,992 | ---- | M] () -- C:\Users\Zuzana\Desktop\vyvoj.exe
[2010.04.25 18:44:15 | 000,000,835 | ---- | M] () -- C:\Users\Zuzana\Desktop\hijackthis – zástupce.lnk
[2010.04.25 17:40:07 | 000,000,385 | ---- | M] () -- C:\windows\red_dialer.ini
[2010.04.25 17:38:34 | 000,781,909 | ---- | M] () -- C:\Users\Zuzana\Desktop\RSIT.exe
[2010.04.23 13:50:16 | 000,000,464 | ---- | M] () -- C:\Users\Zuzana\Documents\cc_20100423_135012.reg
[2010.04.14 16:16:55 | 000,002,675 | ---- | M] () -- C:\Users\Zuzana\Desktop\Microsoft Office Word 2007.lnk

========== Files Created - No Company Name ==========

[2010.04.27 13:08:05 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2010.04.27 13:08:05 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2010.04.27 13:06:07 | 000,007,000 | ---- | C] () -- C:\Users\Zuzana\Desktop\log- vývoj.exe
[2010.04.27 13:01:50 | 000,017,408 | ---- | C] () -- C:\windows\System32\rpcnetp.dll
[2010.04.27 13:01:28 | 000,017,408 | ---- | C] () -- C:\windows\System32\rpcnetp.exe
[2010.04.26 21:17:48 | 000,002,936 | ---- | C] () -- C:\Users\Zuzana\Documents\cc_20100426_211746.reg
[2010.04.26 18:25:09 | 003,923,062 | ---- | C] () -- C:\Users\Zuzana\Desktop\abraka.com
[2010.04.26 17:03:12 | 000,077,312 | ---- | C] () -- C:\windows\MBR.exe
[2010.04.26 17:03:08 | 000,261,632 | ---- | C] () -- C:\windows\PEV.exe
[2010.04.26 17:03:07 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2010.04.26 17:03:06 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2010.04.26 17:03:06 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2010.04.26 16:55:08 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.04.26 16:35:10 | 000,000,913 | ---- | C] () -- C:\Users\Zuzana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010.04.26 16:35:02 | 000,000,733 | ---- | C] () -- C:\Users\Zuzana\Desktop\NTREGOPT.lnk
[2010.04.26 16:35:02 | 000,000,714 | ---- | C] () -- C:\Users\Zuzana\Desktop\ERUNT.lnk
[2010.04.25 19:14:07 | 000,206,992 | ---- | C] () -- C:\Users\Zuzana\Desktop\vyvoj.exe
[2010.04.25 18:44:15 | 000,000,835 | ---- | C] () -- C:\Users\Zuzana\Desktop\hijackthis – zástupce.lnk
[2010.04.25 17:37:26 | 000,781,909 | ---- | C] () -- C:\Users\Zuzana\Desktop\RSIT.exe
[2010.04.23 13:50:14 | 000,000,464 | ---- | C] () -- C:\Users\Zuzana\Documents\cc_20100423_135012.reg
[2009.09.11 11:37:17 | 000,117,248 | ---- | C] () -- C:\windows\System32\EhStorAuthn.dll
[2009.05.16 12:34:30 | 000,000,416 | ---- | C] () -- C:\windows\BRWMARK.INI
[2009.05.16 12:34:30 | 000,000,027 | ---- | C] () -- C:\windows\BRPP2KA.INI
[2009.05.16 12:31:27 | 000,000,213 | ---- | C] () -- C:\windows\Brpfx04a.ini
[2009.05.16 12:31:27 | 000,000,094 | ---- | C] () -- C:\windows\brpcfx.ini
[2009.05.16 12:23:14 | 000,031,567 | ---- | C] () -- C:\windows\maxlink.ini
[2009.05.13 17:04:50 | 000,000,385 | ---- | C] () -- C:\windows\red_dialer.ini
[2009.05.10 13:10:44 | 000,015,497 | ---- | C] () -- C:\windows\snp2uvc.ini
[2009.03.27 06:48:22 | 001,810,992 | ---- | C] () -- C:\windows\System32\drivers\snp2uvc.sys
[2009.03.27 06:48:12 | 000,034,096 | ---- | C] () -- C:\windows\System32\drivers\sncduvc.sys
[2008.08.04 16:43:08 | 000,204,800 | ---- | C] () -- C:\windows\System32\IVIresizeW7.dll
[2008.08.04 16:43:08 | 000,200,704 | ---- | C] () -- C:\windows\System32\IVIresizeA6.dll
[2008.08.04 16:43:08 | 000,192,512 | ---- | C] () -- C:\windows\System32\IVIresizeP6.dll
[2008.08.04 16:43:08 | 000,192,512 | ---- | C] () -- C:\windows\System32\IVIresizeM6.dll
[2008.08.04 16:43:08 | 000,188,416 | ---- | C] () -- C:\windows\System32\IVIresizePX.dll
[2008.08.04 16:43:08 | 000,020,480 | ---- | C] () -- C:\windows\System32\IVIresize.dll
[2008.08.04 16:16:55 | 000,000,000 | ---- | C] () -- C:\windows\HPMProp.INI
[2008.05.30 18:36:58 | 000,108,752 | ---- | C] () -- C:\windows\System32\drivers\SafeBoot.sys
[2008.05.21 11:38:12 | 000,159,744 | ---- | C] () -- C:\windows\System32\atitmmxx.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\windows\System32\pacerprf.ini
[2006.03.09 11:58:00 | 001,060,424 | ---- | C] () -- C:\windows\System32\WdfCoInstaller01000.dll
[2005.04.04 00:30:00 | 000,110,592 | ---- | C] () -- C:\windows\System32\scardsyn.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\windows\System32\lcppn21.dll
[1998.05.07 05:10:00 | 000,069,632 | ---- | C] () -- C:\windows\System32\ODMA32.dll

========== LOP Check ==========

[2009.05.10 15:18:07 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\ESET
[2009.05.10 21:19:26 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\ICQ
[2009.10.19 15:08:10 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\InterVideo
[2009.05.10 15:14:52 | 000,000,000 | ---D | M] -- C:\Users\Zuzana\AppData\Roaming\TuneUp Software
[2009.10.23 17:57:56 | 000,000,378 | ---- | M] () -- C:\Windows\Tasks\1-Click Maintenance.job
[2010.04.27 14:53:47 | 000,032,602 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< MD5 for: AUTOCONV.EXE >
[2009.04.11 08:27:20 | 000,656,896 | ---- | M] (Microsoft Corporation) MD5=15B7BDA10B91FE62466F2A18682C16E8 -- C:\Windows\System32\autoconv.exe
[2009.04.11 08:27:20 | 000,656,896 | ---- | M] (Microsoft Corporation) MD5=15B7BDA10B91FE62466F2A18682C16E8 -- C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6002.18005_none_9ec0c3c7a573ff4b\autoconv.exe
[2008.01.21 04:34:23 | 000,656,384 | ---- | M] (Microsoft Corporation) MD5=E14D99D44A4D3AF60EA8BC7E7CF8B000 -- C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6001.18000_none_9cd54abba85233ff\autoconv.exe

< MD5 for: AUTOCHK.EXE >
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] (Microsoft Corporation) MD5=10761177A6EBE45843F443E99509F5E7 -- C:\Windows\System32\autochk.exe
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] (Microsoft Corporation) MD5=10761177A6EBE45843F443E99509F5E7 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6002.18005_none_e3df6655bee2ee3b\autochk.exe
[2008.01.21 04:34:33 | 000,642,560 | ---- | M] () MD5=41D968409C9846B49BC5F20137C72241 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe

< MD5 for: RPCNET.DLL >
[2010.04.27 12:54:30 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=01A19F74CFB19CC61D62009BCFA59961 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnet.dll
[2010.04.27 16:55:03 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=01A19F74CFB19CC61D62009BCFA59961 -- C:\Windows\System32\rpcnet.dll
[2010.04.26 18:21:16 | 000,056,680 | ---- | M] (Absolute Software Corp.) MD5=2F4158CFE7801A73BEAA7E8A9DFCAD26 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnet.dll

< MD5 for: RPCNET.EXE >
[2009.09.24 09:56:32 | 000,056,680 | ---- | M] (Absolute Software Corp.) MD5=449BF2E12822299C0B153B61C5B8D58E -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnet.exe
[2010.04.26 20:54:53 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=647826DE6F7979432B360D38773570D4 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnet.exe
[2010.04.27 13:04:22 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=647826DE6F7979432B360D38773570D4 -- C:\Windows\System32\rpcnet.exe

< MD5 for: RPCNETP.DLL >
[2010.04.26 20:50:39 | 000,017,408 | ---- | M] () MD5=09781F9CA8277F1C99EA6C7C1E7F30EE -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnetp.dll
[2010.04.27 13:01:50 | 000,017,408 | ---- | M] () MD5=09781F9CA8277F1C99EA6C7C1E7F30EE -- C:\Windows\System32\rpcnetp.dll
[2009.10.21 12:34:54 | 000,017,408 | ---- | M] () MD5=AF9E3107108E70C1AF9F3831622068A3 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnetp.dll

< MD5 for: RPCNETP.EXE >
[2010.04.26 18:21:18 | 000,017,408 | ---- | M] () MD5=5A186198384A33FF53FB5B3A26368BB3 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnetp.exe
[2010.04.27 12:54:33 | 000,017,408 | ---- | M] () MD5=C14731D94AF1EF0CAB3DA53BDF8710E1 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnetp.exe
[2010.04.27 16:55:05 | 000,017,408 | ---- | M] () MD5=C14731D94AF1EF0CAB3DA53BDF8710E1 -- C:\Windows\System32\rpcnetp.exe
< End of report >

Ecinazuz · #67 Příspěvek od **Ecinazuz** » 27 dub 2010 17:43

toto do OTL?

Ecinazuz · #68 Příspěvek od **Ecinazuz** » 27 dub 2010 17:54

log z OTL:

ll processes killed
========== PROCESSES ==========
No active process named autoconv.exe was found!
No active process named autochk.exe was found!
========== OTL ==========
Process rpcnet.exe killed successfully!
Error: No service named rpcnet) Remote Procedure Call (RPC was found to stop!
Service\Driver key rpcnet) Remote Procedure Call (RPC not found.
C:\Windows\System32\rpcnet.exe moved successfully.
File C:\windows\System32\rpcnet.exe not found.
C:\Windows\System32\rpcnet.dll moved successfully.
C:\Windows\System32\rpcnetp.dll moved successfully.
C:\Windows\System32\rpcnetp.exe moved successfully.
C:\Users\Zuzana\Desktop\log- vývoj.exe moved successfully.
========== FILES ==========
Unable to replace file: C:\Windows\System32\autoconv.exe with C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6001.18000_none_9cd54abba85233ff\autoconv.exe without a reboot.
Unable to replace file: C:\Windows\System32\autochk.exe with C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe without a reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

User: Public

User: Zuzana
->Temp folder emptied: 30815256 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 12162884 bytes
->FireFox cache emptied: 49912013 bytes
->Google Chrome cache emptied: 6349211 bytes
->Flash cache emptied: 42293 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 831585 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 96,00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Zuzana
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.3.0 log created on 04272010_185056

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Ecinazuz · #69 Příspěvek od **Ecinazuz** » 27 dub 2010 17:59

c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto Check Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 10761177a6ebe45843f443e99509f5e7
SHA1: de672f79403f667e398ede4193a06525164a09e7
SHA256: bb51065931e61edbc920924d96b502d46e2967ffafce589171fc0d3ad43463cb
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 2f4158cfe7801a73beaa7e8a9dfcad26
SHA1: 54f8866720054252de75a2f05643ce98b5a9d253
SHA256: c959993db45d484da3a811f2dd6a8bf522fcd15afa05b46053e061db500d66f3
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
Signing date: 19:38 3.3.2009
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.885.0
File version: 8.0.885.0
MD5: 449bf2e12822299c0b153b61c5b8d58e
SHA1: c1e87a13152a35b325ed25062e38ed3f115affce
SHA256: d62fd3d2c44b8f540166b3cfce930ae6b5e2e54a724dc6c784241d9a5e44b644
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 12:34 21.10.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: af9e3107108e70c1af9f3831622068a3
SHA1: 0b6339b91dc49ccf962ee304e6829cce2e8ded81
SHA256: 839bd6d7ffb088c88d4a672a6c74c2ba50647a513134d1afbf9ad11e3fa7cf30
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 7:31 25.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 5a186198384a33ff53fb5b3a26368bb3
SHA1: b3dec5473d1ab94dd8bb73b636a8dcc5134008fc
SHA256: 74b32d14661941083554d260c7a9b38283e9830378608da3c71d380ad183396a
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 01a19f74cfb19cc61d62009bcfa59961
SHA1: bc03a872dc393db966a527eb8f58a97050dde13e
SHA256: 72e751793b7a2e960bfb687f06621d1113b502d10f061c1101670e64bd174b50
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
Signing date: 21:15 29.1.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 647826de6f7979432b360d38773570d4
SHA1: 64a242d08374a55f1d8de5e2f0f34fa982cd7f90
SHA256: a5c35f8d9ef78b5f0f3c8bca1cdcac71a7dfbddf247810107f344c0e88e07201
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 13:01 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 09781f9ca8277f1c99ea6c7c1e7f30ee
SHA1: fd54f2150cf473c41d93c021e0bbd68d497f0b87
SHA256: d9cb7c4ced24db58f206dc6fb026190b6bfddd4a7a902c52f988e11373b60b7a
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: c14731d94af1ef0cab3da53bdf8710e1
SHA1: f32db75af71d18007fb6e678c9be1e95dd5b3683
SHA256: a3ca85a2ad102c06d59ba32ccffcede6cc0f0e231cc29b6f41b49d309a46d55e
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 78d690f342e70219562e097398316292
SHA1: 2a7840b7548aa4f70b2af6b3c4abf8bbeae9f5c2
SHA256: e06d1b06b86da2e6553b36d320d7b723d771dba7e71f27de1b981eb26dee8aee
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 01a19f74cfb19cc61d62009bcfa59961
SHA1: bc03a872dc393db966a527eb8f58a97050dde13e
SHA256: 72e751793b7a2e960bfb687f06621d1113b502d10f061c1101670e64bd174b50
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
Signing date: 21:15 29.1.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 647826de6f7979432b360d38773570d4
SHA1: 64a242d08374a55f1d8de5e2f0f34fa982cd7f90
SHA256: a5c35f8d9ef78b5f0f3c8bca1cdcac71a7dfbddf247810107f344c0e88e07201
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 13:01 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 09781f9ca8277f1c99ea6c7c1e7f30ee
SHA1: fd54f2150cf473c41d93c021e0bbd68d497f0b87
SHA256: d9cb7c4ced24db58f206dc6fb026190b6bfddd4a7a902c52f988e11373b60b7a
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 13:04 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: c14731d94af1ef0cab3da53bdf8710e1
SHA1: f32db75af71d18007fb6e678c9be1e95dd5b3683
SHA256: a3ca85a2ad102c06d59ba32ccffcede6cc0f0e231cc29b6f41b49d309a46d55e
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: f1f5880d02b28195e9a159870319ea5d
SHA1: 06e6fb2a1710effab01fb3781a9d80e43e93989c
SHA256: fb36bdb4079bdbf217003fbb4555df23e01c2ef475033f308b1a43d16f85898a
c:\windows\system32\autoconv.exe:
Catalog: C:\windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_25_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.cat
Signers:
Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
Signing date: 0:30 13.4.2009
Strong Name: Unsigned
Publisher: Microsoft Corporation
Description: Auto File System Conversion Utility
Product: Microsoft® Windows® Operating System
Version: 6.0.6001.18000
File version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
MD5: 15b7bda10b91fe62466f2a18682c16e8
SHA1: 2fef29c187854a8ea8125922eb9612b25682cd25
SHA256: 6f659009541242d8957f557d7d534daf474e5a52b30537d843a56904547747fa
c:\windows\system32\autochk.exe:
Verified: Unsigned
File date: 8:27 11.4.2009
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: f1f5880d02b28195e9a159870319ea5d
SHA1: 06e6fb2a1710effab01fb3781a9d80e43e93989c
SHA256: fb36bdb4079bdbf217003fbb4555df23e01c2ef475033f308b1a43d16f85898a
c:\windows\system32\rpcnet.dll:
Verified: Unsigned
File date: 18:56 27.4.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 01a19f74cfb19cc61d62009bcfa59961
SHA1: bc03a872dc393db966a527eb8f58a97050dde13e
SHA256: 72e751793b7a2e960bfb687f06621d1113b502d10f061c1101670e64bd174b50
c:\windows\system32\rpcnet.exe:
Catalog: c:\windows\system32\rpcnet.exe
Signers:
Absolute Software Corp.
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
Signing date: 21:15 29.1.2010
Strong Name: Unsigned
Publisher: Absolute Software Corp.
Description: rpcnet
Product: Installation/Management Application
Version: 8.0.893.0
File version: 8.0.893.0
MD5: 647826de6f7979432b360d38773570d4
SHA1: 64a242d08374a55f1d8de5e2f0f34fa982cd7f90
SHA256: a5c35f8d9ef78b5f0f3c8bca1cdcac71a7dfbddf247810107f344c0e88e07201
c:\windows\system32\rpcnetp.dll:
Verified: Unsigned
File date: 18:52 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: 09781f9ca8277f1c99ea6c7c1e7f30ee
SHA1: fd54f2150cf473c41d93c021e0bbd68d497f0b87
SHA256: d9cb7c4ced24db58f206dc6fb026190b6bfddd4a7a902c52f988e11373b60b7a
c:\windows\system32\rpcnetp.exe:
Verified: Unsigned
File date: 18:56 27.4.2010
Strong Name: Unsigned
Publisher: n/a
Description: n/a
Product: n/a
Version: n/a
File version: n/a
MD5: c14731d94af1ef0cab3da53bdf8710e1
SHA1: f32db75af71d18007fb6e678c9be1e95dd5b3683
SHA256: a3ca85a2ad102c06d59ba32ccffcede6cc0f0e231cc29b6f41b49d309a46d55e

Ecinazuz · #70 Příspěvek od **Ecinazuz** » 27 dub 2010 18:28

OTL logfile created on: 27.4.2010 19:24:47 - Run 4
OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Zuzana\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 57,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,88 Gb Total Space | 165,12 Gb Free Space | 74,08% Space Free | Partition Type: NTFS
Drive D: | 9,00 Gb Total Space | 2,01 Gb Free Space | 22,28% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1021,00 Mb Total Space | 1018,75 Mb Free Space | 99,78% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ZUZANA-PC
Current User Name: Zuzana
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========

< MD5 for: AUTOCONV.EXE >
[2009.04.11 08:27:20 | 000,656,896 | ---- | M] (Microsoft Corporation) MD5=15B7BDA10B91FE62466F2A18682C16E8 -- C:\Windows\System32\autoconv.exe
[2009.04.11 08:27:20 | 000,656,896 | ---- | M] (Microsoft Corporation) MD5=15B7BDA10B91FE62466F2A18682C16E8 -- C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6002.18005_none_9ec0c3c7a573ff4b\autoconv.exe
[2008.01.21 04:34:23 | 000,656,384 | ---- | M] (Microsoft Corporation) MD5=E14D99D44A4D3AF60EA8BC7E7CF8B000 -- C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6001.18000_none_9cd54abba85233ff\autoconv.exe

< MD5 for: AUTOCHK.EXE >
[2008.01.21 04:34:33 | 000,642,560 | ---- | M] () MD5=41D968409C9846B49BC5F20137C72241 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] () MD5=F1F5880D02B28195E9A159870319EA5D -- C:\Windows\System32\autochk.exe
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] () MD5=F1F5880D02B28195E9A159870319EA5D -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6002.18005_none_e3df6655bee2ee3b\autochk.exe

< MD5 for: RPCNET.DLL >
[2010.04.27 12:54:30 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=01A19F74CFB19CC61D62009BCFA59961 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnet.dll
[2010.04.27 16:55:03 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=01A19F74CFB19CC61D62009BCFA59961 -- C:\_OTL\MovedFiles\04272010_185056\C_Windows\System32\rpcnet.dll
[2010.04.27 18:56:16 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=01A19F74CFB19CC61D62009BCFA59961 -- C:\Windows\System32\rpcnet.dll
[2010.04.26 18:21:16 | 000,056,680 | ---- | M] (Absolute Software Corp.) MD5=2F4158CFE7801A73BEAA7E8A9DFCAD26 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnet.dll

< MD5 for: RPCNET.EXE >
[2009.09.24 09:56:32 | 000,056,680 | ---- | M] (Absolute Software Corp.) MD5=449BF2E12822299C0B153B61C5B8D58E -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnet.exe
[2010.04.26 20:54:53 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=647826DE6F7979432B360D38773570D4 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnet.exe
[2010.04.27 13:04:22 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=647826DE6F7979432B360D38773570D4 -- C:\_OTL\MovedFiles\04272010_185056\C_Windows\System32\rpcnet.exe
[2010.04.27 18:55:38 | 000,057,752 | ---- | M] (Absolute Software Corp.) MD5=647826DE6F7979432B360D38773570D4 -- C:\Windows\System32\rpcnet.exe

< MD5 for: RPCNETP.DLL >
[2010.04.26 20:50:39 | 000,017,408 | ---- | M] () MD5=09781F9CA8277F1C99EA6C7C1E7F30EE -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnetp.dll
[2010.04.27 13:01:50 | 000,017,408 | ---- | M] () MD5=09781F9CA8277F1C99EA6C7C1E7F30EE -- C:\_OTL\MovedFiles\04272010_185056\C_Windows\System32\rpcnetp.dll
[2010.04.27 18:52:47 | 000,017,408 | ---- | M] () MD5=09781F9CA8277F1C99EA6C7C1E7F30EE -- C:\Windows\System32\rpcnetp.dll
[2009.10.21 12:34:54 | 000,017,408 | ---- | M] () MD5=AF9E3107108E70C1AF9F3831622068A3 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnetp.dll

< MD5 for: RPCNETP.EXE >
[2010.04.26 18:21:18 | 000,017,408 | ---- | M] () MD5=5A186198384A33FF53FB5B3A26368BB3 -- C:\_OTL\MovedFiles\04262010_204434\C_Windows\System32\rpcnetp.exe
[2010.04.27 12:54:33 | 000,017,408 | ---- | M] () MD5=C14731D94AF1EF0CAB3DA53BDF8710E1 -- C:\_OTL\MovedFiles\04272010_125736\C_Windows\System32\rpcnetp.exe
[2010.04.27 16:55:05 | 000,017,408 | ---- | M] () MD5=C14731D94AF1EF0CAB3DA53BDF8710E1 -- C:\_OTL\MovedFiles\04272010_185056\C_Windows\System32\rpcnetp.exe
[2010.04.27 18:56:20 | 000,017,408 | ---- | M] () MD5=C14731D94AF1EF0CAB3DA53BDF8710E1 -- C:\Windows\System32\rpcnetp.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rpcnet /s >
"Type" = 16
"Start" = 2
"ErrorControl" = 1
"ImagePath" = C:\windows\system32\rpcnet.exe -- [2010.04.27 18:55:38 | 000,057,752 | ---- | M] (Absolute Software Corp.)
"DisplayName" = Remote Procedure Call (RPC) Net
"ObjectName" = LocalSystem
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rpcnet\Parameters]
"ErrorControl" = 0
"Type" = [Binary data over 100 bytes]
"Security" = [Binary data over 100 bytes]

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPC /s >

< HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager /s >
"CriticalSectionTimeout" = 2592000
"GlobalFlag" = 0
"HeapDeCommitFreeBlockThreshold" = 0
"HeapDeCommitTotalFreeThreshold" = 0
"HeapSegmentCommit" = 0
"HeapSegmentReserve" = 0
"ProcessorControl" = 2
"ResourceTimeoutCount" = 648000
"BootExecute" = autocheck autochk * [binary data]
"ExcludeFromKnownDlls" = [binary data]
"ObjectDirectories" = \Windows\RPC Control [binary data]
"ProtectionMode" = 1
"NumberOfInitialSessions" = 2
"SetupExecute" = [binary data]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\AppCompatCache]
"AppCompatCache" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Configuration Manager]
"BackupCount" = 1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\DOS Devices]
"AUX" = \DosDevices\COM1 -- [1601.01.01 02:00:00 | 000,000,000 | ---- | M] ()
"MAILSLOT" = \Device\MailSlot
"NUL" = \Device\Null
"PIPE" = \Device\NamedPipe
"PRN" = \DosDevices\LPT1 -- [1601.01.01 02:00:00 | 000,000,000 | ---- | M] ()
"UNC" = \Device\Mup
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Environment]
"ComSpec" = %SystemRoot%\system32\cmd.exe -- [2008.01.21 04:33:22 | 000,318,976 | ---- | M] (Microsoft Corporation)
"FP_NO_HOST_CHECK" = NO
"OS" = Windows_NT
"Path" = %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;c:\Program Files\ATI Technologies\ATI.ACE\Core-Static;c:\Program Files\ActivIdentity\ActivClient;c:\Program Files\Hewlett-Packard\IAM\bin
"PATHEXT" = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE" = x86
"TEMP" = %SystemRoot%\TEMP -- [2010.04.27 19:26:17 | 000,000,000 | ---D | M]
"TMP" = %SystemRoot%\TEMP -- [2010.04.27 19:26:17 | 000,000,000 | ---D | M]
"USERNAME" = SYSTEM
"windir" = %SystemRoot% -- [2010.04.26 21:18:10 | 000,000,000 | ---D | M]
"PROCESSOR_LEVEL" = 17
"PROCESSOR_IDENTIFIER" = x86 Family 17 Model 3 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION" = 0301
"NUMBER_OF_PROCESSORS" = 2
"TRACE_FORMAT_SEARCH_PATH" = \\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON" = FALSE
"OnlineServices" = Online Services
"Platform" = BNB
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Executive]
"AdditionalCriticalWorkerThreads" = 0
"AdditionalDelayedWorkerThreads" = 0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\FileRenameOperations]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\I/O System]
"AllowRemoteDASD" = 0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\kernel]
"ObUnsecureGlobalNames" = [Binary data over 100 bytes]
"DisableExceptionChainValidation" = 1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\KnownDLLs]
"clbcatq" = clbcatq.dll -- [2008.01.21 04:34:05 | 000,523,776 | ---- | M] (Microsoft Corporation)
"ole32" = ole32.dll -- [2009.04.11 08:28:23 | 001,316,864 | ---- | M] (Microsoft Corporation)
"advapi32" = advapi32.dll -- [2009.04.11 08:28:17 | 000,800,768 | ---- | M] (Microsoft Corporation)
"COMDLG32" = COMDLG32.dll -- [2009.04.11 08:28:18 | 000,450,560 | ---- | M] (Microsoft Corporation)
"DllDirectory" = %SystemRoot%\system32 -- [2010.04.27 18:58:58 | 000,000,000 | ---D | M]
"gdi32" = gdi32.dll -- [2009.04.11 08:28:19 | 000,297,472 | ---- | M] (Microsoft Corporation)
"IERTUTIL" = IERTUTIL.dll -- [2010.02.23 08:33:45 | 001,985,536 | ---- | M] (Microsoft Corporation)
"IMAGEHLP" = IMAGEHLP.dll -- [2008.01.21 04:33:42 | 000,153,088 | ---- | M] (Microsoft Corporation)
"IMM32" = IMM32.dll -- [2009.04.11 08:28:20 | 000,114,688 | ---- | M] (Microsoft Corporation)
"kernel32" = kernel32.dll -- [2009.04.11 08:28:20 | 000,891,392 | ---- | M] (Microsoft Corporation)
"LPK" = LPK.dll -- [2009.06.15 16:52:42 | 000,023,552 | ---- | M] (Microsoft Corporation)
"MSCTF" = MSCTF.dll -- [2009.04.11 08:28:20 | 000,807,424 | ---- | M] (Microsoft Corporation)
"MSVCRT" = MSVCRT.dll -- [2009.04.11 08:28:22 | 000,679,936 | ---- | M] (Microsoft Corporation)
"NORMALIZ" = NORMALIZ.dll -- [2006.11.02 10:33:06 | 000,002,560 | ---- | M] (Microsoft Corporation)
"NSI" = NSI.dll -- [2008.01.21 04:34:35 | 000,008,192 | ---- | M] (Microsoft Corporation)
"OLEAUT32" = OLEAUT32.dll -- [2009.04.11 08:28:23 | 000,563,712 | ---- | M] (Microsoft Corporation)
"rpcrt4" = rpcrt4.dll -- [2009.04.23 14:15:07 | 000,784,896 | ---- | M] (Microsoft Corporation)
"Setupapi" = Setupapi.dll -- [2009.04.11 08:28:24 | 001,591,296 | ---- | M] (Microsoft Corporation)
"SHELL32" = SHELL32.dll -- [2009.04.11 08:28:24 | 011,584,000 | ---- | M] (Microsoft Corporation)
"SHLWAPI" = SHLWAPI.dll -- [2009.04.11 08:28:24 | 000,353,280 | ---- | M] (Microsoft Corporation)
"URLMON" = URLMON.dll -- [2010.02.23 08:39:00 | 001,209,344 | ---- | M] (Microsoft Corporation)
"user32" = user32.dll -- [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation)
"USP10" = USP10.dll -- [2009.04.11 08:28:25 | 000,502,272 | ---- | M] (Microsoft Corporation)
"WININET" = WININET.dll -- [2010.02.23 08:39:13 | 000,916,480 | ---- | M] (Microsoft Corporation)
"WLDAP32" = WLDAP32.dll -- [2009.04.11 08:28:25 | 000,287,744 | ---- | M] (Microsoft Corporation)
"WS2_32" = WS2_32.dll -- [2008.01.21 04:34:36 | 000,179,200 | ---- | M] (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Memory Management]
"WriteWatch" = 1
"ClearPageFileAtShutdown" = 0
"DisablePagingExecutive" = 0
"LargeSystemCache" = 0
"NonPagedPoolQuota" = 0
"NonPagedPoolSize" = 0
"PagedPoolQuota" = 0
"PagedPoolSize" = 0
"PhysicalAddressExtension" = 1
"SecondLevelDataCache" = 0
"SessionPoolSize" = 4
"SessionViewSize" = 48
"SystemPages" = 798720
"PagingFiles" = ?:\pagefile.sys [binary data]
"ExistingPageFiles" = \??\C:\pagefile.sys [binary data] -- [2010.04.27 18:52:26 | 2189,508,608 | -HS- | M] ()
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Memory Management\PrefetchParameters]
"BootId" = 317
"BaseTime" = 287187429
"VideoInitTime" = 15
"EnableSuperfetch" = 3
"EnablePrefetcher" = 3
"EnableBootTrace" = 0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Power]
"AcPolicy" = [Binary data over 100 bytes]
"DcPolicy" = [Binary data over 100 bytes]
"AcProcessorPolicy" = 01 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 28 32 00 00 02 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 28 3C 00 00 03 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 28 50 00 00 01 00 00 00 [binary data]
"DcProcessorPolicy" = 01 00 00 00 03 00 00 00 00 00 00 00 03 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 0A 14 00 00 02 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 14 28 00 00 03 00 00 00 A0 86 01 00 A0 86 01 00 A0 86 01 00 14 46 00 00 01 00 00 00 [binary data]
"PowerSettingProfile" = 0
"Heuristics" = 06 00 00 00 00 01 01 00 00 00 00 00 00 00 00 00 3F 42 0F 00 [binary data]
"SystemPowerPolicy" = [Binary data over 100 bytes]
"HiberElapsedTime" = 59635
"HiberIoTime" = 51138
"HiberInitTime" = 22
"HiberCopyTime" = 825
"HiberCopyBytes" = 1161178280
"HiberPagesWritten" = 91693
"HiberPagesProcessed" = 212274
"HiberDumpCount" = 91693
"HiberFileRuns" = 7
"HiberReadTime" = 19826
"HiberResumeAppTime" = 20646
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\Quota System]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\SubSystems]
"Debug" =
"" = mnmsrvc
"Kmode" = \SystemRoot\System32\win32k.sys
"Optional" = Posix [binary data]
"Posix" = %SystemRoot%\system32\psxss.exe -- File not found
"Required" = DebugWindows [binary data]
"Windows" = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\SubSystems\CSRSS]
"CsrSrvSharedSectionBase" = 2137980928
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\PnP]
"seed" = 1193057078
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\WPA\SigningHash-PRCRFTFJWDC296]
"SigningHashData" = 9F 81 D2 9E 9C C3 C2 DE F9 94 55 CB E3 E3 77 46 6E 99 DA E0 22 5D 4D 05 AD FD C2 DB B3 7F 85 71 7F AB AF 6F 72 32 FC B6 96 DC F7 1D 04 B1 C8 D3 7B FB B3 93 0B 11 CF B2 [binary data]
< End of report >

JDU NA TEN GMER

Ecinazuz · #71 Příspěvek od **Ecinazuz** » 27 dub 2010 18:38

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-04-27 19:35:44
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Zuzana\AppData\Local\Temp\awryypow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Společnost Microsoft)
AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\tdx \Device\Ip epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

mám pokračovat podle návodu na str. 3...???
......Pak proved - odoznac (klik na ctverecek):
Sections
IAT/EAT
- neoznacuj:
Show All a jine disky nez je systemovy disk (typicky C:\)
- klik na tlacitko Scan
- klik na tlacitko Save log nasledne ho otevri s tym, ze obsah vlozis do sveho prispevku jako dlouhy log z gmeru.

Ecinazuz · #72 Příspěvek od **Ecinazuz** » 27 dub 2010 20:09

ty jo- co je tam za bestii?

syn má PC i notebook a myslím, že na obou má visty.....zjistím/teď není tu/...co konkrétně potřebuješ?....bude rozumět - ukážu mu tvůj vzkaz...

posílám log...
na to jak dlouho to skenovalo celkem krátký log

...z mého úhlu pohledu
....jinak taky přeju dobrou

a dík!

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-27 21:00:45
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Zuzana\AppData\Local\Temp\awryypow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

Device \Driver\BTHUSB \Device\000000ac bthport.sys (Ovladač sběrnice Bluetooth/Microsoft Corporation)
Device \Driver\BTHUSB \Device\000000ae bthport.sys (Ovladač sběrnice Bluetooth/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Společnost Microsoft)
AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0021867955c0
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0021867955c0 (not active ControlSet)

---- EOF - GMER 1.0.15 ----

Ecinazuz · #73 Příspěvek od **Ecinazuz** » 27 dub 2010 21:14

ty jo...no já mu to předám...už jsem to vytiskal, aby to nastudoval

...bože co to tam mám za sajrajt!?...

doplňuji dnes:asi to tak rychlé od něj nebude... dnes- středa... to nepůjde- přijede až pozdě večer, zítra až večer by na tom mohl začít dělat....Z.

Ecinazuz · #74 Příspěvek od **Ecinazuz** » 29 dub 2010 16:06

ahoj- tak snad se do toho mladej dnes pustí....

Ecinazuz · #75 Příspěvek od **Ecinazuz** » 01 kvě 2010 11:58

tak tohle /snad/ vyšlo

zde je log:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "rpcnet" deleted successfully.
File "C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6002.18005_none_9ec0c3c7a573ff4b\autoconv.exe" deleted successfully.
File "C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.0.6001.18000_none_9cd54abba85233ff\autoconv.exe" deleted successfully.
File "C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6002.18005_none_e3df6655bee2ee3b\autochk.exe" deleted successfully.
File "C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe" deleted successfully.
File "C:\Windows\System32\rpcnet.dll" deleted successfully.
File "C:\Windows\System32\rpcnet.exe" deleted successfully.
File "C:\Windows\System32\rpcnetp.dll" deleted successfully.
File "C:\Windows\System32\rpcnetp.exe" deleted successfully.
File move operation "C:\autoconv.exe|C:\Windows\System32\autoconv.exe" completed successfully.
File move operation "C:\autochk.exe|C:\Windows\System32\autochk.exe" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

VIRY.CZ

XP internet security- hází varovné hlášky- prosím o kontrolu

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont

Re: XP internet security- hází varovné hlášky- prosím o kont