Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Zpomalený internet - Trojan.ExOptions.Gen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#16 Příspěvek od Daru »

Ještě jestli jsem to správně pochopil, tak Trojan.ExOptions.Gen nemusí vůbec být příčinou pomalého (občasného) připojení? Doufejme, že na příčinu přijde. Díky, zítra
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#17 Příspěvek od Daru »

Internet je zpomalený občas, pomalu se načítají stránky, když dám v outloku přijmou - odeslat poštu, tak to projede rychle. Budu postupovat podle tvých pokynů.
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#18 Příspěvek od Daru »

OTL.txt

OTL logfile created on: 10.5.2010 16:21:48 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\Ruda\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

831,00 Mb Total Physical Memory | 523,00 Mb Available Physical Memory | 63,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1248 2496 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18,64 Gb Total Space | 2,42 Gb Free Space | 13,00% Space Free | Partition Type: NTFS
Drive D: | 38,34 Gb Total Space | 20,57 Gb Free Space | 53,63% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HANA-6D657F31AA
Current User Name: Ruda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
PRC - [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
PRC - [2010.05.07 17:56:16 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2010.04.28 13:45:50 | 000,835,952 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2010.03.31 08:23:00 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2010.03.31 08:22:20 | 002,145,000 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008.04.14 05:22:35 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.) -- C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe


========== Modules (SafeList) ==========

MOD - [2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
MOD - [2008.04.14 05:19:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010.05.07 17:56:16 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.03.31 08:27:24 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.03.31 08:23:00 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2005.11.14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - [2010.05.07 17:56:14 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.03.31 08:23:56 | 000,095,872 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2010.03.31 08:22:32 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.03.31 08:17:48 | 000,140,216 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) Herní ovladač SoundFusion(tm)
DRV - [2008.04.13 20:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) Ovladač zvukové karty USB (WDM)
DRV - [2006.09.05 21:00:54 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58obex.sys -- (se58obex)
DRV - [2006.09.05 21:00:06 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mgmt.sys -- (se58mgmt) Sony Ericsson Device 088 USB WMC Device Management Drivers (WDM)
DRV - [2006.09.05 20:59:18 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdm.sys -- (se58mdm)
DRV - [2006.09.05 20:59:14 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdfl.sys -- (se58mdfl)
DRV - [2006.09.05 20:58:26 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58bus.sys -- (se58bus) Sony Ericsson Device 088 driver (WDM)
DRV - [2006.09.05 20:57:54 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58nd5.sys -- (se58nd5) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (NDIS)
DRV - [2006.09.05 20:57:48 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58unic.sys -- (se58unic) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (WDM)
DRV - [2005.05.11 01:33:12 | 000,032,256 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdrbsdrv.sys -- (cdrbsdrv)
DRV - [2004.08.04 00:32:26 | 000,048,640 | ---- | M] (Crystal Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwrwdm.sys -- (cwrwdm) Ovladač SoundFusion(tm)
DRV - [2004.08.04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001.08.17 22:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchT ... f8&oe=utf8
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.04.24 22:17:03 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2006.03.02 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (Media Access Startup) - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - Reg Error: Value error. File not found
O2 - BHO: (NP Helper Class) - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - Reg Error: Value error. File not found
O2 - BHO: (System Search Dispatcher) - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - Reg Error: Value error. File not found
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (no name) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\Toolbar\WebBrowser: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupda ... 7640033004 (WUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.22 16:23:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008.11.16 22:26:41 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - lvcodec2.dll File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\Pvmjpg21.dll (Pegasus Imaging Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (55745656140070912)

========== Files/Folders - Created Within 7 Days ==========

[2010.05.09 19:28:25 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010.05.09 15:37:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.05.09 15:37:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.09 15:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2010.05.09 15:37:03 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.09 15:08:29 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.05.09 15:00:10 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 14:42:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.05.09 14:36:10 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.05.09 14:35:56 | 000,000,000 | ---D | C] -- C:\rsit
[2010.05.09 13:45:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2010.05.09 13:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2010.05.07 19:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2010.05.07 17:56:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2010.05.07 17:55:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.07 17:55:34 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator

========== Files - Modified Within 7 Days ==========

[2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.10 16:02:31 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 16:02:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 16:02:21 | 871,948,288 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.09 22:25:14 | 005,505,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT
[2010.05.09 22:25:14 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ruda\ntuser.ini
[2010.05.09 22:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010.05.09 18:57:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 18:51:27 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\Ruda\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.09 16:24:00 | 003,683,355 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.07 19:32:06 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.05.05 17:37:46 | 000,000,616 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.05 17:28:53 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Opera.lnk

========== Files Created - No Company Name ==========

[2010.05.09 18:57:12 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 16:19:44 | 003,683,355 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.07 19:32:06 | 000,000,797 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityFRA.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityESP.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityENG.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityDEU.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityCZE.dll
[2009.07.27 21:38:46 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\ToolUtil.dll
[2009.07.27 21:38:45 | 000,905,290 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2009.07.27 21:38:45 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\Util.dll
[2009.07.27 21:38:45 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\VideoLib.dll
[2009.07.27 21:38:45 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\AudioLib.dll

========== LOP Check ==========

[2007.12.21 16:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.04.24 22:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ESET
[2009.12.25 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2010.05.09 17:04:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.09 14:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2009.08.02 15:01:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2008.08.25 21:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\Happy Foto
[2007.12.22 21:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ
[2007.12.22 21:03:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ Toolbar
[2007.12.25 22:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\OLYMPUS
[2010.05.09 22:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"MSMSGS" = "C:\Program Files\Messenger\msmsgs.exe" /background -- [2008.04.14 05:22:36 | 001,695,232 | ---- | M] (Microsoft Corporation)
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"OM_Monitor" = C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -- [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com)

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.04.15 20:35:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Adobe
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2009.07.10 22:24:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Google
[2010.02.17 22:52:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2009.01.24 15:27:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Help
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.11.16 22:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Identities
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2008.11.17 00:49:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Macromedia
[2010.05.09 15:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.04.09 21:35:48 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Ruda\Data aplikací\Microsoft
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2008.11.19 22:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mozilla
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2009.04.26 12:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\skypePM
[2009.01.22 19:16:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Sony Ericsson
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2009.03.11 21:26:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2007.03.22 12:46:40 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncher.exe
[2010.04.04 17:30:29 | 005,806,080 | ---- | M] (Gretech Corp.) -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncherTempSetup.exe
[2010.03.18 01:54:54 | 008,681,984 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy\WeFiSetup_5_142_513.exe.exe


< MD5 for: AGP440.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006.03.02 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: CDROM.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006.03.02 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2006.03.02 14:00:00 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2006.03.02 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006.03.02 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2006.03.02 14:00:00 | 000,081,280 | ---- | M] (Microsoft Corporation) MD5=4AF58CA3425F28FC5E3DB47DC122F722 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:27 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2006.03.02 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2006.03.02 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006.03.02 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2006.03.02 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2006.03.02 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2006.03.02 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2006.03.02 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2006.03.02 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2006.03.02 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006.03.02 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2006.03.02 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.11.16 23:03:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.11.16 23:03:09 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.11.16 23:03:09 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >
[2010.05.07 17:56:14 | 000,142,592 | ---- | M] () -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys

< %systemroot%\system32\*.* /3 >
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
< End of report >
Přílohy
Extras.rar
(4.97 KiB) Staženo 61 x
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#19 Příspěvek od Daru »

Např. dnes, když jsem kolem 16 hod. zapl počítač, tak se stránky načítaly hrozně pomalu, teď už je to v pohodě. kritické to bývá zhruba 18 - 22 hod., pak už je to taky lepší, někdy je to špatné i odpoledne. jak jsem psal nemělo by to být připojením, protože syn má přes reuter druhý počítač a tam to jede bez problémů.
Musím na chvíli od počítače, budu vděčný za další rady
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#20 Příspěvek od Daru »

Teď se mi třeba zase načítání zpomalilo. Když se načte stránka, tak místo kurzoru jsou dlouhou dobu přesýpací hodiny



========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35B8D58C-B0CB-46b0-BA64-05B3804E4E86}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-1547161642-1343024091-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

OTL by OldTimer - Version 3.2.4.1 log created on 05102010_174216
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#21 Příspěvek od Daru »

Ted jsem mluvil z technikem poskytovatele, ten mi řekl, že z tohoto počítače jsou neustálé dotazy, že to má být zna spywaru

OTL logfile created on: 10.5.2010 17:58:21 - Run 2
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\Ruda\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

831,00 Mb Total Physical Memory | 527,00 Mb Available Physical Memory | 63,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 1248 2496 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18,64 Gb Total Space | 2,31 Gb Free Space | 12,40% Space Free | Partition Type: NTFS
Drive D: | 38,34 Gb Total Space | 20,57 Gb Free Space | 53,63% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HANA-6D657F31AA
Current User Name: Ruda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
PRC - [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
PRC - [2010.05.07 17:56:16 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2010.04.28 13:45:50 | 000,835,952 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2010.03.31 08:23:00 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2010.03.31 08:22:20 | 002,145,000 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.) -- C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe


========== Modules (SafeList) ==========

MOD - [2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
MOD - [2008.04.14 05:19:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010.05.07 17:56:16 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.03.31 08:27:24 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.03.31 08:23:00 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2005.11.14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - [2010.05.07 17:56:14 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.03.31 08:23:56 | 000,095,872 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2010.03.31 08:22:32 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.03.31 08:17:48 | 000,140,216 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) Herní ovladač SoundFusion(tm)
DRV - [2008.04.13 20:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) Ovladač zvukové karty USB (WDM)
DRV - [2006.09.05 21:00:54 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58obex.sys -- (se58obex)
DRV - [2006.09.05 21:00:06 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mgmt.sys -- (se58mgmt) Sony Ericsson Device 088 USB WMC Device Management Drivers (WDM)
DRV - [2006.09.05 20:59:18 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdm.sys -- (se58mdm)
DRV - [2006.09.05 20:59:14 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdfl.sys -- (se58mdfl)
DRV - [2006.09.05 20:58:26 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58bus.sys -- (se58bus) Sony Ericsson Device 088 driver (WDM)
DRV - [2006.09.05 20:57:54 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58nd5.sys -- (se58nd5) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (NDIS)
DRV - [2006.09.05 20:57:48 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58unic.sys -- (se58unic) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (WDM)
DRV - [2005.05.11 01:33:12 | 000,032,256 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdrbsdrv.sys -- (cdrbsdrv)
DRV - [2004.08.04 00:32:26 | 000,048,640 | ---- | M] (Crystal Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwrwdm.sys -- (cwrwdm) Ovladač SoundFusion(tm)
DRV - [2004.08.04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001.08.17 22:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchT ... f8&oe=utf8
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.04.24 22:17:03 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2006.03.02 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\Toolbar\WebBrowser: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupda ... 7640033004 (WUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.22 16:23:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008.11.16 22:26:41 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - lvcodec2.dll File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\Pvmjpg21.dll (Pegasus Imaging Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (55745656140070912)

========== Files/Folders - Created Within 7 Days ==========

[2010.05.09 19:28:25 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010.05.09 15:37:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.05.09 15:37:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.09 15:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2010.05.09 15:37:03 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.09 15:08:29 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.05.09 15:00:10 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 14:42:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.05.09 14:36:10 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.05.09 14:35:56 | 000,000,000 | ---D | C] -- C:\rsit
[2010.05.09 13:45:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2010.05.09 13:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2010.05.07 19:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2010.05.07 17:56:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2010.05.07 17:55:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.07 17:55:34 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator

========== Files - Modified Within 7 Days ==========

[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010.05.10 17:48:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 17:48:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 17:48:29 | 871,948,288 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.10 17:47:12 | 005,505,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT
[2010.05.10 17:47:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ruda\ntuser.ini
[2010.05.10 16:40:17 | 000,005,085 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 18:57:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 18:51:27 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\Ruda\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.09 16:24:00 | 003,683,355 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.07 19:32:06 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.05.05 17:37:46 | 000,000,616 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.05 17:28:53 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Opera.lnk

========== Files Created - No Company Name ==========

[2010.05.10 16:40:17 | 000,005,085 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.09 18:57:12 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 16:19:44 | 003,683,355 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.07 19:32:06 | 000,000,797 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityFRA.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityESP.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityENG.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityDEU.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityCZE.dll
[2009.07.27 21:38:46 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\ToolUtil.dll
[2009.07.27 21:38:45 | 000,905,290 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2009.07.27 21:38:45 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\Util.dll
[2009.07.27 21:38:45 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\VideoLib.dll
[2009.07.27 21:38:45 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\AudioLib.dll

========== LOP Check ==========

[2007.12.21 16:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.04.24 22:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ESET
[2009.12.25 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2010.05.10 17:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.09 14:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2009.08.02 15:01:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2008.08.25 21:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\Happy Foto
[2007.12.22 21:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ
[2007.12.22 21:03:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ Toolbar
[2007.12.25 22:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\OLYMPUS
[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"MSMSGS" = "C:\Program Files\Messenger\msmsgs.exe" /background -- [2008.04.14 05:22:36 | 001,695,232 | ---- | M] (Microsoft Corporation)
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"OM_Monitor" = C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -- [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com)

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.04.15 20:35:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Adobe
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2009.07.10 22:24:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Google
[2010.02.17 22:52:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2009.01.24 15:27:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Help
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.11.16 22:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Identities
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2008.11.17 00:49:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Macromedia
[2010.05.09 15:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.04.09 21:35:48 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Ruda\Data aplikací\Microsoft
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2008.11.19 22:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mozilla
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2009.04.26 12:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\skypePM
[2009.01.22 19:16:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Sony Ericsson
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2009.03.11 21:26:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2007.03.22 12:46:40 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncher.exe
[2010.04.04 17:30:29 | 005,806,080 | ---- | M] (Gretech Corp.) -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncherTempSetup.exe
[2010.03.18 01:54:54 | 008,681,984 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy\WeFiSetup_5_142_513.exe.exe


< MD5 for: AGP440.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006.03.02 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: CDROM.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006.03.02 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2006.03.02 14:00:00 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2006.03.02 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006.03.02 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2006.03.02 14:00:00 | 000,081,280 | ---- | M] (Microsoft Corporation) MD5=4AF58CA3425F28FC5E3DB47DC122F722 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:27 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2006.03.02 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2006.03.02 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006.03.02 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2006.03.02 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2006.03.02 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2006.03.02 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2006.03.02 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2006.03.02 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2006.03.02 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006.03.02 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2006.03.02 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.11.16 23:03:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.11.16 23:03:09 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.11.16 23:03:09 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2008.04.14 05:21:36 | 000,098,304 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\actxprxy.dll

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
< End of report >
[2010.05.10 18:16:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Plocha
[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010.05.10 17:54:25 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT.LOG
[2010.05.10 17:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.10 17:48:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 17:48:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 17:47:12 | 005,505,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT
[2010.05.10 17:47:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ruda\ntuser.ini
[2010.05.10 17:42:53 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2010.05.10 16:40:52 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\Ruda\Recent
[2010.05.10 16:40:17 | 000,005,085 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 18:57:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 18:51:27 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\Ruda\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2010.05.09 18:28:05 | 000,000,000 | ---D | M] -- C:\Program Files\Spyware Terminator
[2010.05.09 18:27:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Cookies
[2010.05.09 17:48:17 | 000,000,000 | ---D | M] -- C:\Program Files\trend micro
[2010.05.09 16:24:00 | 003,683,355 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:36 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\Ruda\Data aplikací
[2010.05.09 15:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.05.09 15:37:27 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.09 15:37:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Plocha
[2010.05.09 15:37:05 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací
[2010.05.09 15:37:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2010.05.09 14:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.07 19:32:06 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 19:22:10 | 000,000,000 | ---D | M] -- C:\Program Files\Crawler
[2010.05.05 17:37:46 | 000,000,616 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.05 17:28:53 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Opera.lnk
[2010.05.05 17:28:37 | 000,000,000 | ---D | M] -- C:\Program Files\Opera

========== Files - Modified Within 7 Days ==========



< %systemroot%\system32\*.dll /lockedfiles >

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl

< End of report >
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#22 Příspěvek od Daru »

[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010.05.10 17:48:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 17:48:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 17:48:29 | 871,948,288 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.10 17:47:12 | 005,505,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT
[2010.05.10 17:47:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ruda\ntuser.ini
[2010.05.10 16:40:17 | 000,005,085 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 18:57:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 18:51:27 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\Ruda\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.09 16:24:00 | 003,683,355 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.07 19:32:06 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.05.05 17:37:46 | 000,000,616 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.05 17:28:53 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Opera.lnk

========== LOP Check ==========

[2007.12.21 16:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.04.24 22:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ESET
[2009.12.25 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2010.05.10 17:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.09 14:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2009.08.02 15:01:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2008.08.25 21:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\Happy Foto
[2007.12.22 21:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ
[2007.12.22 21:03:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ Toolbar
[2007.12.25 22:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\OLYMPUS
[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"MSMSGS" = "C:\Program Files\Messenger\msmsgs.exe" /background -- [2008.04.14 05:22:36 | 001,695,232 | ---- | M] (Microsoft Corporation)
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"OM_Monitor" = C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -- [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com)

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.04.15 20:35:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Adobe
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2009.07.10 22:24:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Google
[2010.02.17 22:52:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2009.01.24 15:27:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Help
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.11.16 22:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Identities
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2008.11.17 00:49:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Macromedia
[2010.05.09 15:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.04.09 21:35:48 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Ruda\Data aplikací\Microsoft
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2008.11.19 22:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mozilla
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2009.04.26 12:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\skypePM
[2009.01.22 19:16:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Sony Ericsson
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2009.03.11 21:26:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2007.03.22 12:46:40 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncher.exe
[2010.04.04 17:30:29 | 005,806,080 | ---- | M] (Gretech Corp.) -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncherTempSetup.exe
[2010.03.18 01:54:54 | 008,681,984 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy\WeFiSetup_5_142_513.exe.exe


< MD5 for: AGP440.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006.03.02 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: CDROM.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006.03.02 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2006.03.02 14:00:00 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2006.03.02 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006.03.02 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2006.03.02 14:00:00 | 000,081,280 | ---- | M] (Microsoft Corporation) MD5=4AF58CA3425F28FC5E3DB47DC122F722 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:27 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2006.03.02 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2006.03.02 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006.03.02 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2006.03.02 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2006.03.02 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2006.03.02 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2006.03.02 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2006.03.02 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2006.03.02 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006.03.02 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2006.03.02 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008.04.14 05:22:05 | 000,098,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\winscard.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.11.16 23:03:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.11.16 23:03:09 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.11.16 23:03:09 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl

< End of report >
SRV - [2010.05.07 17:56:16 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.03.31 08:27:24 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.03.31 08:23:00 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2005.11.14 02:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - [2010.05.07 17:56:14 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.03.31 08:23:56 | 000,095,872 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2010.03.31 08:22:32 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.03.31 08:17:48 | 000,140,216 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2008.04.13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) Herní ovladač SoundFusion(tm)
DRV - [2008.04.13 20:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) Ovladač zvukové karty USB (WDM)
DRV - [2006.09.05 21:00:54 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58obex.sys -- (se58obex)
DRV - [2006.09.05 21:00:06 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mgmt.sys -- (se58mgmt) Sony Ericsson Device 088 USB WMC Device Management Drivers (WDM)
DRV - [2006.09.05 20:59:18 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdm.sys -- (se58mdm)
DRV - [2006.09.05 20:59:14 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58mdfl.sys -- (se58mdfl)
DRV - [2006.09.05 20:58:26 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58bus.sys -- (se58bus) Sony Ericsson Device 088 driver (WDM)
DRV - [2006.09.05 20:57:54 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58nd5.sys -- (se58nd5) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (NDIS)
DRV - [2006.09.05 20:57:48 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se58unic.sys -- (se58unic) Sony Ericsson Device 088 USB Ethernet Emulation SEMC58 (WDM)
DRV - [2005.05.11 01:33:12 | 000,032,256 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdrbsdrv.sys -- (cdrbsdrv)
DRV - [2004.08.04 00:32:26 | 000,048,640 | ---- | M] (Crystal Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwrwdm.sys -- (cwrwdm) Ovladač SoundFusion(tm)
DRV - [2004.08.04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001.08.17 22:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchT ... f8&oe=utf8
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.04.24 22:17:03 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2006.03.02 14:00:00 | 000,000,737 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\..\Toolbar\WebBrowser: (&Crawler lišta) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1547161642-1343024091-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupda ... 7640033004 (WUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.22 16:23:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 7 Days ==========

[2010.05.09 19:28:25 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010.05.09 15:37:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.05.09 15:37:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.09 15:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2010.05.09 15:37:03 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.09 15:08:29 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.05.09 15:00:10 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 14:42:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.05.09 14:36:10 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.05.09 14:35:56 | 000,000,000 | ---D | C] -- C:\rsit
[2010.05.09 13:45:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2010.05.09 13:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2010.05.07 19:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2010.05.07 17:56:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2010.05.07 17:55:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.07 17:55:34 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator

========== Files - Modified Within 7 Days ==========

[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010.05.10 17:48:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 17:48:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 17:48:29 | 871,948,288 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.10 17:47:12 | 005,505,024 | -H-- | M] () -- C:\Documents and Settings\Ruda\NTUSER.DAT
[2010.05.10 17:47:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ruda\ntuser.ini
[2010.05.10 16:40:17 | 000,005,085 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.10 16:19:05 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ruda\Plocha\OTL.exe
[2010.05.09 18:57:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 18:51:27 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\Ruda\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.09 16:24:00 | 003,683,355 | ---- | M] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.09 12:55:55 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.05.08 19:50:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.07 19:32:06 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.05.05 17:37:46 | 000,000,616 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.05 17:28:53 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Opera.lnk

========== Files Created - No Company Name ==========

[2010.05.10 16:40:17 | 000,005,085 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\Extras.rar
[2010.05.09 18:57:12 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\gmer.zip
[2010.05.09 16:19:44 | 003,683,355 | ---- | C] () -- C:\Documents and Settings\Ruda\Plocha\Uninstall.exe
[2010.05.09 15:37:27 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.05.07 19:32:06 | 000,000,797 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\Spyware Terminator.lnk
[2010.05.07 17:56:14 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityFRA.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityESP.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityENG.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityDEU.dll
[2009.07.27 21:38:46 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ResUtilityCZE.dll
[2009.07.27 21:38:46 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\ToolUtil.dll
[2009.07.27 21:38:45 | 000,905,290 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2009.07.27 21:38:45 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\Util.dll
[2009.07.27 21:38:45 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\VideoLib.dll
[2009.07.27 21:38:45 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\AudioLib.dll

========== LOP Check ==========

[2007.12.21 16:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2010.04.24 22:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ESET
[2009.12.25 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2010.05.10 17:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
[2010.05.09 14:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2009.08.02 15:01:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2008.08.25 21:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\Happy Foto
[2007.12.22 21:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ
[2007.12.22 21:03:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\ICQ Toolbar
[2007.12.25 22:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Data aplikací\OLYMPUS
[2010.05.10 18:01:02 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"MSMSGS" = "C:\Program Files\Messenger\msmsgs.exe" /background -- [2008.04.14 05:22:36 | 001,695,232 | ---- | M] (Microsoft Corporation)
"CTFMON.EXE" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 05:22:17 | 000,015,360 | ---- | M] (Microsoft Corporation)
"OM_Monitor" = C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -- [2006.05.16 18:51:00 | 000,057,344 | ---- | M] (OLYMPUS IMAGING CORP.)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.05.07 17:56:23 | 003,037,696 | ---- | M] (Crawler.com)

< c:\windows\*.* /U >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2009.04.18 19:53:29 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Ruda\Data aplikací\.#
[2010.04.15 20:35:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Adobe
[2010.05.09 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\CBS Interactive
[2009.03.22 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ESET
[2009.07.10 22:24:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Google
[2010.02.17 22:52:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH
[2010.04.01 14:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Happy Foto
[2009.01.24 15:27:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Help
[2010.02.02 19:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\ICQ
[2008.11.16 22:44:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Identities
[2008.12.26 11:07:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Leadertech
[2008.11.17 00:49:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Macromedia
[2010.05.09 15:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Malwarebytes
[2010.04.09 21:35:48 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Ruda\Data aplikací\Microsoft
[2009.07.10 11:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mikrotik
[2008.11.19 22:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Mozilla
[2009.01.20 21:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OLYMPUS
[2010.05.09 15:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy
[2009.03.07 18:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Opera
[2009.04.26 12:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\skypePM
[2009.01.22 19:16:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Sony Ericsson
[2010.05.09 18:28:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Spyware Terminator
[2009.01.22 19:20:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\Teleca
[2009.03.11 21:26:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ruda\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2007.03.22 12:46:40 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncher.exe
[2010.04.04 17:30:29 | 005,806,080 | ---- | M] (Gretech Corp.) -- C:\Documents and Settings\Ruda\Data aplikací\GRETECH\GomPlayer\GrLauncherTempSetup.exe
[2010.03.18 01:54:54 | 008,681,984 | ---- | M] () -- C:\Documents and Settings\Ruda\Data aplikací\OpenCandy\WeFiSetup_5_142_513.exe.exe


< MD5 for: AGP440.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004.08.04 01:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006.03.02 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: CDROM.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006.03.02 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2006.03.02 14:00:00 | 000,060,416 | ---- | M] (Microsoft Corporation) MD5=70D2A1756F4B2067658A186C963FCABD -- C:\WINDOWS\$NtServicePackUninstall$\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ServicePackFiles\i386\cryptsvc.dll
[2008.04.14 05:21:38 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 05:21:41 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll
[2006.03.02 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=6EB66066D5C0175320CFEA0A4C74C88F -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006.03.02 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2006.03.02 14:00:00 | 000,081,280 | ---- | M] (Microsoft Corporation) MD5=4AF58CA3425F28FC5E3DB47DC122F722 -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:27 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2006.03.02 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008.04.13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: ISAPNP.SYS >
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2009.03.22 00:36:21 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:isapnp.sys
[2006.03.02 14:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) MD5=1091528512E4DD7ED5FDDCC4DF1C53D7 -- C:\WINDOWS\$NtServicePackUninstall$\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\ServicePackFiles\i386\isapnp.sys
[2008.04.14 04:27:53 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys

< MD5 for: LSASS.EXE >
[2006.03.02 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=82A362FE1D4980B71B588D9C10748511 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
[2008.04.14 05:22:29 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008.04.13 21:20:37 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006.03.02 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2006.03.02 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=2591CADAEF7D2242039255028E577688 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 05:21:50 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2006.03.02 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2006.03.02 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=04B69D49D7FC3358A372E97DB6D39447 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
[2008.04.14 05:22:47 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2006.03.02 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2006.03.02 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2006.03.02 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006.03.02 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2006.03.02 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=382E9B87F1282E697C67AF84E34E35E2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
[2008.04.14 05:22:06 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.11.16 23:03:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.11.16 23:03:09 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.11.16 23:03:09 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#23 Příspěvek od Daru »

Úplně se mi to seklo, proto to zpoždění. OTL je na dvakrát
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#24 Příspěvek od Daru »

Virus Total:

Soubor dxtmsft.dll přijatý 2010.05.10 16:51:51 (UTC)Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.09.00 2010.05.08 -
AntiVir 8.2.1.236 2010.05.10 -
Antiy-AVL 2.0.3.7 2010.05.10 -
Authentium 5.2.0.5 2010.05.10 -
Avast 4.8.1351.0 2010.05.10 -
Avast5 5.0.332.0 2010.05.10 -
AVG 9.0.0.787 2010.05.10 -
BitDefender 7.2 2010.05.10 -
CAT-QuickHeal 10.00 2010.05.10 -
ClamAV 0.96.0.3-git 2010.05.10 -
Comodo 4815 2010.05.10 -
DrWeb 5.0.2.03300 2010.05.10 -
eSafe 7.0.17.0 2010.05.10 -
eTrust-Vet 35.2.7477 2010.05.10 -
F-Prot 4.5.1.85 2010.05.10 -
F-Secure 9.0.15370.0 2010.05.10 -
Fortinet 4.1.133.0 2010.05.10 -
GData 21 2010.05.10 -
Ikarus T3.1.1.84.0 2010.05.10 -
Jiangmin 13.0.900 2010.05.10 -
Kaspersky 7.0.0.125 2010.05.10 -
McAfee 5.400.0.1158 2010.05.09 -
McAfee-GW-Edition 2010.1 2010.05.10 -
Microsoft 1.5703 2010.05.10 -
NOD32 5102 2010.05.10 -
Norman 6.04.12 2010.05.10 -
nProtect 2010-05-10.01 2010.05.10 -
Panda 10.0.2.7 2010.05.10 -
PCTools 7.0.3.5 2010.05.10 -
Prevx 3.0 2010.05.10 -
Rising 22.47.00.04 2010.05.10 -
Sophos 4.53.0 2010.05.10 -
Sunbelt 6284 2010.05.10 -
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.10 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 -
ViRobot 2010.5.10.2308 2010.05.10 -
VirusBuster 5.0.27.0 2010.05.10 -

Rozšiřující informace
File size: 348160 bytes
MD5...: 057d53f1490598d41d9d4dee9a92b0b1
SHA1..: ccd75fc6be525aa11747b15216ff3297b0bf51e9
SHA256: 3b085c27a91bf708b475250630545ecf0d57c454f8c4b21fdd40c81c0b9621b6
ssdeep: 6144:GuiouY9kZzfdX+KISI1aoTMXDXWt699I:3SMK5V5<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x52a2<BR>timedatestamp.....: 0x49b3ac9a (Sun Mar 08 11:31:38 2009)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x3bb6c 0x3bc00 6.51 54d74d519e933fa3fea1ee99c5a85e4f<BR>.data 0x3d000 0x17f0 0x1800 3.40 d105f7e04dc88d25cc4fd2c84765039e<BR>.rsrc 0x3f000 0x13658 0x13800 5.46 d05729af89028558101ed08849ddbf98<BR>.reloc 0x53000 0x3f48 0x4000 6.51 8f7a05aacaf90e27b387460448d25e82<BR><BR>( 9 imports ) <BR>> msvcrt.dll: rand, _CIsin, _CIsqrt, _CIcos, _purecall, time, _adjust_fdiv, _amsg_exit, _initterm, _XcptFilter, memcpy, memset, __CxxFrameHandler, malloc, free, srand, _vsnwprintf, _wcsicmp, _resetstkoflw, _CIpow<BR>> ATL.DLL: -, -, -, -, -, -<BR>> KERNEL32.dll: DeleteCriticalSection, VirtualQuery, GetCurrentProcess, GetModuleHandleW, WideCharToMultiByte, EnterCriticalSection, VirtualAlloc, CreateEventW, IsBadWritePtr, VirtualProtect, GetCurrentThreadId, CloseHandle, HeapAlloc, HeapFree, GetProcessHeap, GetProcAddress, GetVersion, RtlUnwind, InterlockedExchange, Sleep, InterlockedCompareExchange, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, IsBadCodePtr, InitializeCriticalSection, IsBadReadPtr, InterlockedDecrement, InterlockedIncrement, GetVersionExW, DisableThreadLibraryCalls, GetSystemInfo<BR>> USER32.dll: CopyRect, GetSysColor, OffsetRect, IntersectRect<BR>> ole32.dll: CoCreateFreeThreadedMarshaler, CoCreateInstance<BR>> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -<BR>> GDI32.dll: CreateCompatibleBitmap, SelectObject, DeleteDC, CreateCompatibleDC, BitBlt, DeleteColorSpace, DeleteObject, SetDIBitsToDevice, SetColorSpace, CreateColorSpaceW, SetICMMode, GetDIBits<BR>> dxtrans.dll: _DXOverArray@@YGXPAVDXPMSAMPLE@@PBV1@K@Z, _DXDitherArray@@YGXPBUDXDITHERDESC@@@Z, _DXOverArrayMMX@@YGXPAVDXPMSAMPLE@@PBV1@K@Z<BR>> SHLWAPI.dll: UrlCombineW<BR><BR>( 5 exports ) <BR>DllCanUnloadNow, DllEnumClassObjects, DllGetClassObject, DllRegisterServer, DllUnregisterServer<BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -
trid..: Windows OCX File (90.7%)<BR>Win32 Executable Generic (6.2%)<BR>Generic Win/DOS Executable (1.4%)<BR>DOS Executable Generic (1.4%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:<BR>publisher....: Microsoft Corporation<BR>copyright....: (c) Microsoft Corporation. All rights reserved.<BR>product......: Windows_ Internet Explorer<BR>description..: DirectX Media -- Image DirectX Transforms<BR>original name: DXTMSFT.DLL<BR>internal name: DXTMSFT<BR>file version.: 8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#25 Příspěvek od Daru »

Skenuji MBAm
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#26 Příspěvek od Daru »

O.k. nevím přesně jak se sem zítra dostanu, snad na chvilku kolem 18 hod. a potom asi až po 20 hod. Zatím díky!
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#27 Příspěvek od Daru »

MBAm

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4086

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.5.2010 20:26:08
mbam-log-2010-05-10 (20-26-08).txt

Typ skenu: Úplný sken (C:\|D:\|)
Skenované objekty: 192119
Uplynulý čas: 1 hodina(y), 19 minuta(y), 17 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 58
Infikované hodnoty registru: 1
Infikované datové položky registru: 0
Infikované složky: 68
Infikované soubory: 59

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\aimactivexdll.aimhelper (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\aimactivexdll.aimhelper.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{57aba38e-6535-48f3-99fd-efdc62137c78} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2e8e2100-98cb-4aac-9480-63a281acaff5} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Installer\Features\e5a579d1621164f44a32148791436ae3 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Installer\Products\e5a579d1621164f44a32148791436ae3 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\b0f0eb6ec578ec54f90b6fcd03d7dd95 (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{c28a0312-c403-417b-a425-a915bc0519cd} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\b0f0eb6ec578ec54f90b6fcd03d7dd95 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02705fd89352ce24bab275ac5589e38c (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06b0d94320dd05a4e9db282f94c0da38 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22f45360de7c90b439a645289cf9b2dd (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2677411f68e73a14b94ea51766ac0760 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6b1d2633a813ea645a5b4b57d73edeac (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6c07fc781abbbeb41a95822938168847 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\746d1df045c9e4c49b480d77d5d41737 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8c6ff01e712e0b04b8aba6074b0f4656 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\913971928d8605c40879db575b7a7c4b (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98a12ed2f6ef15746866d10403464f8a (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\991b13f7bf5972e40ac7059929ecfba0 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9dc359691a7a8af49a18461e15b4af0a (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\b7e05f91ec77f73439fab74946182c65 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\bb5f2c7ed86329349bf6c4c455476cef (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\c33adbfa7b15a9947a8bc54299b85da5 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\c762a014430216b44a4d962ce9bdff7b (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\d2c0c17a2e0bc2849b0d2a0edf5743b2 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\d2f71258b0760d94f92cc1bc754b71bf (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\f572404d07a14014093fb02b74bcba69 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\e5a579d1621164f44a32148791436ae3 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1d975a5e-1126-4f46-a423-41781934a63e} (Adware.DoubleD) -> No action taken.
HKEY_CLASSES_ROOT\AppID\AIMActiveXDLL.dll (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins\OEActiveXDLL.DesktopOEAddin1 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JuicyAccess Toolbar (Adware.DoubleD) -> No action taken.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Funband Serach (Adware.DoubleD) -> No action taken.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Funband Serach (Adware.DoubleD) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> No action taken.

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9} (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\15D3A7BB (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\15D3A7BB\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\24618E3F (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\24618E3F\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\29A73ACD (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\29A73ACD\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\2A3DCDAF (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\2A3DCDAF\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\36F1A852 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\36F1A852\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\3FA86A06 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\3FA86A06\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4DAC9037 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4DAC9037\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4F73E13A (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4F73E13A\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\50EF6DF6 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\50EF6DF6\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\51B9750F (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\51B9750F\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\6216A4BD (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\6216A4BD\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\62404B3E (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\62404B3E\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\628759C1 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\628759C1\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\69E6D3E5 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\69E6D3E5\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\879169BE (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\879169BE\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\9B242A8C (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\9B242A8C\611F5CA (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A26F7F7 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A26F7F7\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A53562F1 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A53562F1\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\B3AC8875 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\B3AC8875\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\B75FA91E (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\B75FA91E\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\BED3DEFB (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\BED3DEFB\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C3C6C2CD (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C3C6C2CD\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C41B8701 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C41B8701\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C90EEF64 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C90EEF64\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\CC8FDF08 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\CC8FDF08\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\CE8732D (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\CE8732D\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\D5797E3B (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\D5797E3B\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\EB91CE86 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\EB91CE86\3E688669 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\F0A80E14 (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\F0A80E14\5702F56C (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mIDEFunc.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mIDEWriteReg.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mMSI.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840 (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data (Adware.DoubleD) -> No action taken.

Infikované soubory:
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\15D3A7BB\3E688669\stbappHelper.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\29A73ACD\3E688669\stb0.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\36F1A852\3E688669\MyDll.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\3FA86A06\3E688669\HookAPINT.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4F73E13A\3E688669\stbapp.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\50EF6DF6\3E688669\Riched20Smiley.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\6216A4BD\3E688669\stbYahoo8.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\628759C1\3E688669\stbOLEX.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A26F7F7\3E688669\stbOL.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\A53562F1\3E688669\AIMActiveXDLL.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\B3AC8875\3E688669\stbMsn.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C3C6C2CD\3E688669\stbIE.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C41B8701\3E688669\stbAol.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\C90EEF64\3E688669\AxGifAnimator.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\CC8FDF08\3E688669\OEActiveXDLL.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\D5797E3B\3E688669\stbYahoo9.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\SSD.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\stbreaim.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\stbrewlm.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\stbrunwlm.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\stbsh.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\stbterm.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\instance.dat (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\mia.lib (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\Setup.dat (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\Setup.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\Setup.msi (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\Setup.par (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\Setup.res (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\{1D975A5E-1126-4F46-A423-41781934A63E} (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\{5EA804FD-5E7A-4405-A638-CAFBD22489D9} (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\24618E3F\611F5CA\Microsoft.VC80.MFC.manifest (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\2A3DCDAF\611F5CA\SkinCrafterDll.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\4DAC9037\611F5CA\gdiplus.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\62404B3E\3E688669\FFToolbar.xml (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\879169BE\611F5CA\mfc80.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\F0A80E14\5702F56C\home.juicyaccess.com.url (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\mFileBagEXE.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\AdwareSetup.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\cfcpxlog.mx (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\FFToolbar.xpi (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\HJSetup.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\libiconv2.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\libintl3.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\MsiZap.Exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\msvcp60.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\ProductInfo.mx (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\setup.exe (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\sqlite3.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\tbcore.mx (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mFileBagIDE.dll\bag\tre4.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mIDEFunc.dll\mEXEFunc.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mIDEWriteReg.dll\mEXEWriteReg.dll (Adware.DoubleD) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{5EA804FD-5E7A-4405-A638-CAFBD22489D9}\OFFLINE\mMSI.dll\mMSIExec.dll (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\unins000.dat (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\unins000.exe (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\eacore.mx (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\URLDynamic.mx (Adware.DoubleD) -> No action taken.
C:\Program Files\System Search Dispatcher\1.3.0.840\Data\URLStatic.mx (Adware.DoubleD) -> No action taken.
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#28 Příspěvek od Daru »

Ahoj,
včera jsem ten nález MBAm nevymazal, mám to skenovat znovu a vymazat?
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#29 Příspěvek od Daru »

As per the instructions you would have received, kindly ensure any onboard
script blocking tools have been disabled for they shall interfere with DDS.

DDS is a non-invasive diagnostic tool.

- DDS makes no registry writes/changes

- DDS does not create any permanent files/folders.

This scan should not take longer than three minutes to complete.

When the scan is complete, a logfile/report shall pop open.

Post the contents of the logfile to the forum where it was requested

We only require it to run just once. Dispose after use.


::
Nahoru
Daru
Návštěvník
Návštěvník
Příspěvky: 77
Registrován: 09 kvě 2010 16:42

Re: Zpomalený internet - Trojan.ExOptions.Gen

#30 Příspěvek od Daru »

Asi jsi chtěl až toto:

AV: ESET NOD32 Antivirus 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Opera\opera.exe
D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Ruda\Plocha\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.seznam.cz/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx? ... tbid=60327
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60327
mCustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
uURLSearchHooks: N/A: {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\toolbar\ctbr.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\toolbar\ctbr.dll
TB: &Crawler lišta: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\crawler\toolbar\ctbr.dll
TB: {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [OM_Monitor] c:\program files\olympus\olympus master\Monitor.exe
uRun: [SpywareTerminatorUpdate] "c:\program files\spyware terminator\SpywareTerminatorUpdate.exe"
mRun: [OM_Monitor] c:\program files\olympus\olympus master\FirstStart.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237640033004
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\crawler\toolbar\ctbr.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-3-31 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-3-31 95872]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2010-5-7 142592]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-3-31 810120]
R3 cwrwdm;Ovladač SoundFusion(tm) WDM;c:\windows\system32\drivers\cwrwdm.sys [2008-11-16 48640]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2006-3-2 69120]

=============== Created Last 30 ================

2010-05-10 19:48:34 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-05-10 19:09:15 0 d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-05-10 19:08:56 0 d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-05-10 19:08:56 0 d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-05-10 19:08:27 0 d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-05-10 18:57:23 0 d-----w- c:\docume~1\alluse~1.win\dataap~1\Spybot - Search & Destroy
2010-05-10 18:48:30 0 d-----w- c:\docume~1\ruda\dataap~1\GetRightToGo
2010-05-09 13:37:36 0 d-----w- c:\docume~1\ruda\dataap~1\Malwarebytes
2010-05-09 13:37:11 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-09 13:37:05 0 d-----w- c:\docume~1\alluse~1.win\dataap~1\Malwarebytes
2010-05-09 13:37:03 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-09 13:08:29 0 d-----w- C:\_OTL
2010-05-09 12:36:10 0 d-----w- c:\program files\trend micro
2010-05-09 11:45:33 0 d-----w- c:\docume~1\ruda\dataap~1\OpenCandy
2010-05-09 11:44:25 0 d-----w- c:\docume~1\ruda\dataap~1\CBS Interactive
2010-05-07 17:21:29 0 d-----w- c:\program files\Crawler
2010-05-07 15:56:14 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-05-07 15:56:07 0 d-----w- c:\docume~1\ruda\dataap~1\Spyware Terminator
2010-05-07 15:55:59 0 d-----w- c:\docume~1\alluse~1.win\dataap~1\Spyware Terminator
2010-05-07 15:55:34 0 d-----w- c:\program files\Spyware Terminator
2010-04-11 14:58:00 0 d-----w- c:\program files\Ask.com

==================== Find3M ====================

2010-05-09 10:55:55 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-31 06:23:56 95872 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-03-31 06:22:32 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-31 06:17:48 140216 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-03-28 15:14:19 46196 ----a-w- c:\windows\system32\perfc005.dat
2010-03-28 15:14:19 309990 ----a-w- c:\windows\system32\perfh005.dat
2010-03-10 06:17:40 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:18:56 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-17 12:09:02 2192128 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:09:02 2068992 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:35:01 100864 ----a-w- c:\windows\system32\6to4svc.dll

============= FINISH: 16:22:10,83 ===============
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“