pade internet po 30 verinach

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
amosatko
Návštěvník
Návštěvník
Příspěvky: 119
Registrován: 22 Pro 2008 19:24

Re: pade internet po 30 verinach

#16 Příspěvek od amosatko »

otl


OTL logfile created on: 8.9.2010 8:55:45 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 78,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 39,07 Gb Total Space | 1,01 Gb Free Space | 2,59% Space Free | Partition Type: NTFS
Drive D: | 106,07 Gb Total Space | 87,69 Gb Free Space | 82,67% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1,97 Gb Total Space | 1,25 Gb Free Space | 63,53% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVID-MSI
Current User Name: NTB
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.09.08 08:53:22 | 000,574,976 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2010.08.22 13:02:26 | 000,133,432 | ---- | M] (ICQ, LLC.) -- C:\Program Files\ICQ7.0\ICQ.exe
PRC - [2010.08.03 10:42:46 | 003,037,696 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
PRC - [2010.08.03 10:42:46 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2010.07.31 05:51:43 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010.05.15 18:15:48 | 000,249,376 | ---- | M] (UNICON Co., Ltd.) -- C:\WINDOWS\system32\NETHDD.exe
PRC - [2010.05.06 22:59:42 | 002,815,192 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009.07.24 09:51:42 | 002,048,000 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MGSysCtrl.exe
PRC - [2009.07.09 15:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2009.05.19 17:11:52 | 000,136,544 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
PRC - [2009.03.24 04:00:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.02.22 10:04:42 | 002,938,184 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2008.01.22 20:13:08 | 000,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2008.01.11 22:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
PRC - [2007.10.29 14:30:14 | 000,278,528 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2007.10.04 18:39:42 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2007.09.28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007.09.28 16:03:46 | 000,075,136 | ---- | M] ( TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
PRC - [2005.11.24 11:12:34 | 000,491,520 | ---- | M] (FinePrint Software, LLC) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis2a.exe
PRC - [2004.06.16 06:03:04 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010.09.08 08:53:22 | 000,574,976 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
MOD - [2009.07.17 13:46:00 | 000,007,680 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MGKBHook.dll
MOD - [2008.07.25 11:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.08.03 10:42:46 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.05.15 18:15:48 | 000,249,376 | ---- | M] (UNICON Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\NETHDD.exe -- (NETHDD)
SRV - [2010.05.13 21:15:33 | 000,077,944 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009.07.09 15:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2007.09.28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\NTB\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010.08.03 10:42:46 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.05.15 18:15:46 | 000,018,432 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nethddim.sys -- (NETHDDIM)
DRV - [2010.05.13 19:57:08 | 000,685,816 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010.05.06 22:39:23 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010.05.06 22:39:00 | 000,164,048 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010.05.06 22:34:27 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010.05.06 22:33:59 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010.05.06 22:33:47 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.05.06 22:33:29 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008.07.10 19:33:40 | 000,306,176 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rtl8187Se.sys -- (rtl8187Se)
DRV - [2008.06.11 05:23:07 | 000,106,368 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.06.11 05:23:01 | 000,156,160 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTS5121.sys -- (RSUSBSTOR)
DRV - [2008.05.19 22:49:14 | 000,625,792 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2860.sys -- (RT80x86)
DRV - [2008.05.08 06:21:40 | 004,739,072 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.02.15 15:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008.01.31 15:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008.01.22 20:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007.12.19 20:32:12 | 005,854,688 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007.11.29 09:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007.10.18 14:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007.10.02 11:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006.10.10 19:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2005.01.07 05:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004.12.23 04:47:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ULCDRHlp.sys -- (ULCDRHlp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

IE - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.07.22 19:56:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010.05.12 08:17:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Mozilla\Extensions
[2010.05.12 08:17:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\NTB\Data aplikací\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

O1 HOSTS File: ([2010.09.05 09:03:17 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Micro-Star International Co., Ltd.)
O4 - HKLM..\Run: [pdfFactory Pro Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [ICQ] C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 168.95.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\NTB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\NTB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.08.29 16:41:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 30 Days ==========

[2010.09.05 22:30:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Data aplikací\Malwarebytes
[2010.09.05 22:29:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.09.05 22:29:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.09.05 22:29:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
[2010.09.05 22:29:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.09.05 11:16:19 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.09.05 09:05:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010.09.04 19:53:28 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.09.04 19:53:28 | 000,000,000 | ---D | C] -- C:\rsit
[2010.09.04 19:48:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\NTB\Recent
[2010.09.04 19:33:25 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.09.04 19:33:25 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.09.04 19:33:25 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.09.04 19:33:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.09.04 19:32:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.09.04 19:31:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.09.04 07:42:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\BUK
[2010.09.03 15:29:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Broskve
[2010.09.03 15:18:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\reklama
[2010.09.03 12:59:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Grilovacka
[2010.09.02 12:29:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Dokumenty\Corel User Files
[2010.08.25 23:09:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\SOUNDTRACK-Pearl Harbor
[2010.08.22 17:21:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF22
[2010.08.18 17:11:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Králův Dvůr
[2010.08.17 18:59:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\DCIM
[2010.08.16 16:46:23 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010.08.16 13:27:27 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbprint.sys
[2010.08.15 12:44:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Nová složka
[2010.08.15 00:26:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\ZÁMEK VIMPERK
[2010.08.15 00:25:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\HUSINECKÁ PŘEHRADA
[2010.08.15 00:25:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\SAUNA ŽERNOVICE
[2010.08.15 00:21:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF11
[2010.08.12 21:55:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\HokusPhotoPokus
[2010.08.12 18:45:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF
[2010.08.12 07:46:26 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010.07.12 19:24:00 | 000,099,840 | R--- | C] ( ) -- C:\WINDOWS\System32\Zipdll.dll
[2010.07.12 19:24:00 | 000,094,208 | R--- | C] ( ) -- C:\WINDOWS\System32\Unzdll.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.09.08 08:51:16 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.09.08 08:51:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.08 08:50:54 | 2136,268,800 | -HS- | M] () -- C:\hiberfil.sys
[2010.09.07 22:29:36 | 004,718,592 | -H-- | M] () -- C:\Documents and Settings\NTB\NTUSER.DAT
[2010.09.07 22:29:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\NTB\ntuser.ini
[2010.09.07 22:29:34 | 002,205,456 | -H-- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\IconCache.db
[2010.09.05 22:30:00 | 000,000,741 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.09.05 11:14:18 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.05 09:03:29 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.09.05 09:03:17 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.09.04 19:30:26 | 003,835,729 | R--- | M] () -- C:\Documents and Settings\NTB\Plocha\ComboFix.exe
[2010.09.04 14:03:12 | 007,167,738 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00174.JPG
[2010.09.03 15:18:08 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Převodem.xls
[2010.09.03 14:31:17 | 000,753,368 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f51-FJ.pdf
[2010.09.03 14:30:46 | 000,727,118 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f50-FJ.pdf
[2010.09.03 14:30:14 | 000,650,847 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f49-JOSTRA.pdf
[2010.09.03 14:29:56 | 000,727,145 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f48-IU.pdf
[2010.09.03 14:29:32 | 001,273,172 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f46-SMV.pdf
[2010.09.03 14:28:59 | 000,877,118 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f47-TS.pdf
[2010.09.02 21:48:33 | 001,036,079 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\reklama-konec.jpg
[2010.09.02 20:44:25 | 005,618,354 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\reklama.CDR
[2010.09.02 20:39:22 | 005,616,528 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Záloha_reklama.CDR
[2010.08.26 23:09:02 | 733,945,420 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.avi
[2010.08.26 22:14:04 | 000,080,568 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.srt
[2010.08.26 10:41:46 | 000,060,416 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Peněžní denník 2010 - 0.0.2010.xls
[2010.08.23 22:19:01 | 000,001,605 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.08.23 22:14:33 | 000,000,230 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2010.08.23 22:00:44 | 000,080,372 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\44424_141737985865199_100000869945374_186470_1093087_n.jpg
[2010.08.22 16:57:34 | 000,002,286 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Google Chrome.lnk
[2010.08.21 23:17:06 | 038,383,194 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Sidewalks.rar
[2010.08.17 09:24:06 | 005,070,285 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00014.JPG
[2010.08.16 19:06:37 | 002,102,873 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\ospalec.jpg
[2010.08.16 18:58:40 | 000,411,581 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Snímek 002.jpg
[2010.08.16 18:58:40 | 000,397,327 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Snímek 001.jpg
[2010.08.16 16:46:26 | 000,000,812 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\EVEREST Home Edition.lnk
[2010.08.16 11:01:32 | 012,026,816 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\3D.pln
[2010.08.16 10:14:19 | 006,532,232 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\D03_Wood_Floors.rar
[2010.08.14 23:31:34 | 004,111,129 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00069.JPG
[2010.08.13 09:34:38 | 000,352,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.12 13:54:28 | 000,033,399 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\jj.jpg
[2010.08.12 07:50:37 | 000,000,573 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.08.12 07:48:17 | 000,988,064 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.08.12 07:48:17 | 000,435,594 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.08.12 07:48:17 | 000,432,516 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.08.12 07:48:17 | 000,079,440 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.08.12 07:48:17 | 000,068,490 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.08.11 22:45:03 | 003,456,275 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00022.jpg
[2010.08.11 22:41:36 | 000,101,128 | ---- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.08.10 12:01:29 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Název zboží množství sleva.doc
[2010.08.09 20:35:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.09.08 08:50:54 | 2136,268,800 | -HS- | C] () -- C:\hiberfil.sys
[2010.09.05 22:30:00 | 000,000,741 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.09.05 09:45:39 | 007,167,738 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00174.JPG
[2010.09.05 08:45:50 | 003,835,729 | R--- | C] () -- C:\Documents and Settings\NTB\Plocha\ComboFix.exe
[2010.09.04 19:33:25 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.09.04 19:33:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.09.04 19:33:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.09.04 19:33:25 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.09.04 19:33:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.09.03 14:31:47 | 000,753,368 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f51-FJ.pdf
[2010.09.03 14:31:47 | 000,727,118 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f50-FJ.pdf
[2010.09.03 14:31:46 | 001,273,172 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f46-SMV.pdf
[2010.09.03 14:31:46 | 000,877,118 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f47-TS.pdf
[2010.09.03 14:31:46 | 000,727,145 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f48-IU.pdf
[2010.09.03 14:31:46 | 000,650,847 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f49-JOSTRA.pdf
[2010.09.02 21:48:32 | 001,036,079 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\reklama-konec.jpg
[2010.09.02 12:57:44 | 005,616,528 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Záloha_reklama.CDR
[2010.09.02 12:27:56 | 005,618,354 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\reklama.CDR
[2010.08.26 23:06:38 | 733,945,420 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.avi
[2010.08.26 22:14:03 | 000,080,568 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.srt
[2010.08.24 21:20:28 | 000,032,768 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Převodem.xls
[2010.08.24 21:20:27 | 000,060,416 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Peněžní denník 2010 - 0.0.2010.xls
[2010.08.23 22:00:44 | 000,080,372 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\44424_141737985865199_100000869945374_186470_1093087_n.jpg
[2010.08.18 16:32:20 | 005,070,285 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00014.JPG
[2010.08.16 19:06:33 | 002,102,873 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\ospalec.jpg
[2010.08.16 16:46:26 | 000,000,812 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\EVEREST Home Edition.lnk
[2010.08.16 10:57:54 | 012,026,816 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\3D.pln
[2010.08.16 10:27:03 | 038,383,194 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Sidewalks.rar
[2010.08.16 10:12:09 | 006,532,232 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\D03_Wood_Floors.rar
[2010.08.15 13:36:45 | 004,111,129 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00069.JPG
[2010.08.12 13:54:28 | 000,033,399 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\jj.jpg
[2010.08.11 22:44:44 | 003,456,275 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00022.jpg
[2010.08.10 12:01:28 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Název zboží množství sleva.doc
[2010.08.03 10:42:46 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.07.12 19:24:00 | 004,677,632 | R--- | C] () -- C:\WINDOWS\System32\ri.dll
[2010.07.12 19:24:00 | 000,618,496 | R--- | C] () -- C:\WINDOWS\System32\stlpmt45.dll
[2010.07.12 19:24:00 | 000,618,496 | R--- | C] () -- C:\WINDOWS\System32\stlp45.dll
[2010.07.12 19:24:00 | 000,230,912 | R--- | C] () -- C:\WINDOWS\System32\Zipit.dll
[2010.07.12 19:24:00 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\vc4_jpeg.dll
[2010.07.12 19:24:00 | 000,098,304 | R--- | C] () -- C:\WINDOWS\System32\VC4_TIFF.dll
[2010.07.12 19:24:00 | 000,090,112 | R--- | C] () -- C:\WINDOWS\System32\sdr.dll
[2010.07.12 19:24:00 | 000,040,720 | R--- | C] () -- C:\WINDOWS\System32\oledb32r.dll
[2010.07.12 19:24:00 | 000,033,280 | R--- | C] () -- C:\WINDOWS\System32\SP32W.DLL
[2010.07.12 19:24:00 | 000,005,392 | R--- | C] () -- C:\WINDOWS\System32\oledb32x.dll
[2010.07.12 19:23:58 | 000,315,904 | R--- | C] () -- C:\WINDOWS\System32\glu.dll
[2010.07.12 19:23:58 | 000,172,032 | R--- | C] () -- C:\WINDOWS\System32\glut32.dll
[2010.07.12 19:23:58 | 000,084,992 | R--- | C] () -- C:\WINDOWS\System32\HASPVB32.DLL
[2010.07.12 19:23:58 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2010.07.07 13:03:49 | 000,000,230 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2010.05.14 08:53:22 | 000,001,605 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2010.05.14 00:23:57 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.13 20:05:57 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.08.30 01:25:37 | 000,001,168 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008.08.29 19:01:37 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008.08.29 18:55:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2008.08.29 17:59:48 | 006,184,960 | R--- | C] () -- C:\WINDOWS\System32\RTS5121icon.dll
[2008.08.29 17:46:15 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2007.12.21 16:46:32 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2005.07.22 21:30:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2003.04.09 15:38:04 | 000,005,664 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010.05.12 10:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
[2010.05.13 21:41:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Autodesk
[2010.05.15 20:28:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonBJ
[2010.05.16 11:30:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonIJEGV
[2010.05.24 18:38:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonIJScan
[2010.05.06 10:19:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PassMark
[2010.09.07 19:03:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
[2010.05.13 19:56:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Ulead Systems
[2010.05.13 21:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Autodesk
[2010.06.16 19:13:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Canon
[2010.09.08 08:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\ICQ
[2010.09.04 18:14:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Spyware Terminator
[2010.05.12 08:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Thunderbird
[2010.05.13 19:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Ulead Systems
[2010.06.27 09:27:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Zoner

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"Google Update" = "C:\Documents and Settings\NTB\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c -- [2010.04.23 21:46:25 | 000,136,176 | ---- | M] (Google Inc.)
"DAEMON Tools" = "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -- [2007.09.18 16:16:16 | 000,171,464 | ---- | M] (DT Soft Ltd.)
"AdobeUpdater" = "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" -- [2010.04.25 03:52:03 | 002,356,088 | ---- | M] (Adobe Systems Incorporated)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.08.03 10:42:46 | 003,037,696 | ---- | M] (Crawler.com)
"ICQ" = "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4 -- [2010.08.22 13:02:26 | 000,133,432 | ---- | M] (ICQ, LLC.)

< c:\windows\*.* /U >
[1 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.09.05 10:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Adobe
[2010.05.13 21:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Autodesk
[2010.06.16 19:13:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Canon
[2010.05.14 14:17:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Corel
[2010.09.08 08:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\ICQ
[2008.08.29 16:41:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Identities
[2008.08.29 17:58:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\InstallShield
[2010.04.23 21:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Macromedia
[2010.09.05 22:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Malwarebytes
[2010.06.30 19:07:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NTB\Data aplikací\Microsoft
[2010.05.12 08:17:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Mozilla
[2010.07.21 10:52:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\PSpad
[2010.09.07 09:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Skype
[2010.09.07 08:45:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\skypePM
[2010.09.04 18:14:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Spyware Terminator
[2010.05.12 08:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Thunderbird
[2010.05.13 19:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Ulead Systems
[2010.05.14 08:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\WinRAR
[2010.06.27 09:27:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Zoner

< %APPDATA%\*.exe /s >


< MD5 for: AGP440.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\ATAPI.SYS
[2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\ATAPI.SYS
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys

< MD5 for: CDROM.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:cdrom.sys
[2008.04.14 14:00:00 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2005.03.25 15:00:00 | 000,052,224 | ---- | M] (Microsoft Corporation) MD5=DD6A189894B14E24A14B4D182F5F3949 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\CDROM.SYS
[2005.03.25 15:00:00 | 000,052,224 | ---- | M] (Microsoft Corporation) MD5=DD6A189894B14E24A14B4D182F5F3949 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\CDROM.SYS

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ERDNT\cache\cryptsvc.dll
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\dllcache\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: HAL.DLL >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:hal.dll
[2008.04.14 14:00:00 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=4329EE7D502C9113EBA0F9570392F5EE -- C:\WINDOWS\system32\hal.dll
[2005.03.25 15:00:00 | 000,109,568 | ---- | M] (Microsoft Corporation) MD5=EB0D4F2DED96775E9C272BBDFAA7B923 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\HAL.DLL
[2005.03.25 15:00:00 | 000,109,568 | ---- | M] (Microsoft Corporation) MD5=EB0D4F2DED96775E9C272BBDFAA7B923 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:Changer.sys

< MD5 for: IASTOR.SYS >
[2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\IASTOR.SYS
[2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\IASTOR.SYS

< MD5 for: ISAPNP.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:isapnp.sys
[2005.03.25 15:00:00 | 000,037,888 | ---- | M] (Microsoft Corporation) MD5=4EA2CC0CC091854FB1A07B6758BB68C0 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\ISAPNP.SYS
[2005.03.25 15:00:00 | 000,037,888 | ---- | M] (Microsoft Corporation) MD5=4EA2CC0CC091854FB1A07B6758BB68C0 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\ISAPNP.SYS
[2008.04.14 07:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\dllcache\isapnp.sys
[2008.04.14 07:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys
[2008.04.14 14:00:00 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\isapnp.sys

< MD5 for: LSASS.EXE >
[2005.03.25 15:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=D4B61A935670C57A0DEA81B4F4A12169 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\LSASS.EXE
[2005.03.25 15:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=D4B61A935670C57A0DEA81B4F4A12169 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\LSASS.EXE
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ERDNT\cache\lsass.exe
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\dllcache\lsass.exe
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ERDNT\cache\ndis.sys
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\dllcache\ndis.sys
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2005.03.25 15:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=FDB9275EB5E75A456BD26F4479103C19 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\NDIS.SYS
[2005.03.25 15:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=FDB9275EB5E75A456BD26F4479103C19 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\NDIS.SYS

< MD5 for: NETLOGON.DLL >
[2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\NETLOGON.DLL
[2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\NETLOGON.DLL
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SCECLI.DLL
[2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SCECLI.DLL
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2005.03.25 15:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) MD5=5912CC8F61CF76E4FADC6F34C8F92DDB -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SMSS.EXE
[2005.03.25 15:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) MD5=5912CC8F61CF76E4FADC6F34C8F92DDB -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SMSS.EXE
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\dllcache\smss.exe
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe
[2008.04.14 14:00:00 | 000,481,792 | ---- | M] (Microsoft Corporation) MD5=F209B5C79A87A9521DC0BD88B039EEE3 -- C:\WINDOWS\I386\SYSTEM32\SMSS.EXE

< MD5 for: SVCHOST.EXE >
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2005.03.25 15:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=CA8E6441930B54A8B8210061CE5FCCE7 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SVCHOST.EXE
[2005.03.25 15:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=CA8E6441930B54A8B8210061CE5FCCE7 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SVCHOST.EXE

< MD5 for: SYMMPI.SYS >
[2005.03.25 15:00:00 | 000,049,664 | ---- | M] (LSI Logic) MD5=868204832E011E2D64281D7EABEE572E -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\SYMMPI.SYS
[2005.03.25 15:00:00 | 000,049,664 | ---- | M] (LSI Logic) MD5=868204832E011E2D64281D7EABEE572E -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\SYMMPI.SYS

< MD5 for: TCPIP.SYS >
[2008.04.14 14:00:00 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\ERDNT\cache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2005.03.25 15:00:00 | 000,333,312 | ---- | M] (Microsoft Corporation) MD5=EC676733442B122F1828FCD03B86C20B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\TCPIP.SYS
[2005.03.25 15:00:00 | 000,333,312 | ---- | M] (Microsoft Corporation) MD5=EC676733442B122F1828FCD03B86C20B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\TCPIP.SYS

< MD5 for: USERINIT.EXE >
[2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\USERINIT.EXE
[2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\USERINIT.EXE
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\WINLOGON.EXE
[2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\WINLOGON.EXE
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ERDNT\cache\ws2_32.dll
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\dllcache\ws2_32.dll
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll
[2005.03.25 15:00:00 | 000,083,968 | ---- | M] (Microsoft Corporation) MD5=DB060880F9C349F597AFA270D1D01B68 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\WS2_32.DLL
[2005.03.25 15:00:00 | 000,083,968 | ---- | M] (Microsoft Corporation) MD5=DB060880F9C349F597AFA270D1D01B68 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\WS2_32.DLL

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.08.29 18:31:41 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.08.29 18:31:41 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.08.29 18:31:40 | 000,483,328 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
Nahoru
amosatko
Návštěvník
Návštěvník
Příspěvky: 119
Registrován: 22 Pro 2008 19:24

Re: pade internet po 30 verinach

#17 Příspěvek od amosatko »

otl


OTL logfile created on: 8.9.2010 8:55:45 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 78,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 93,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 39,07 Gb Total Space | 1,01 Gb Free Space | 2,59% Space Free | Partition Type: NTFS
Drive D: | 106,07 Gb Total Space | 87,69 Gb Free Space | 82,67% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 1,97 Gb Total Space | 1,25 Gb Free Space | 63,53% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVID-MSI
Current User Name: NTB
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.09.08 08:53:22 | 000,574,976 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2010.08.22 13:02:26 | 000,133,432 | ---- | M] (ICQ, LLC.) -- C:\Program Files\ICQ7.0\ICQ.exe
PRC - [2010.08.03 10:42:46 | 003,037,696 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
PRC - [2010.08.03 10:42:46 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2010.07.31 05:51:43 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010.05.15 18:15:48 | 000,249,376 | ---- | M] (UNICON Co., Ltd.) -- C:\WINDOWS\system32\NETHDD.exe
PRC - [2010.05.06 22:59:42 | 002,815,192 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009.07.24 09:51:42 | 002,048,000 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MGSysCtrl.exe
PRC - [2009.07.09 15:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2009.05.19 17:11:52 | 000,136,544 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
PRC - [2009.03.24 04:00:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.02.22 10:04:42 | 002,938,184 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2008.01.22 20:13:08 | 000,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2008.01.11 22:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
PRC - [2007.10.29 14:30:14 | 000,278,528 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2007.10.04 18:39:42 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2007.09.28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007.09.28 16:03:46 | 000,075,136 | ---- | M] ( TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
PRC - [2005.11.24 11:12:34 | 000,491,520 | ---- | M] (FinePrint Software, LLC) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis2a.exe
PRC - [2004.06.16 06:03:04 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010.09.08 08:53:22 | 000,574,976 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
MOD - [2009.07.17 13:46:00 | 000,007,680 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MGKBHook.dll
MOD - [2008.07.25 11:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.08.03 10:42:46 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2010.05.15 18:15:48 | 000,249,376 | ---- | M] (UNICON Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\NETHDD.exe -- (NETHDD)
SRV - [2010.05.13 21:15:33 | 000,077,944 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010.05.06 22:59:38 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009.07.09 15:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008.07.29 19:16:38 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2007.09.28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\NTB\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010.08.03 10:42:46 | 000,142,592 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010.05.15 18:15:46 | 000,018,432 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nethddim.sys -- (NETHDDIM)
DRV - [2010.05.13 19:57:08 | 000,685,816 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010.05.06 22:39:23 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010.05.06 22:39:00 | 000,164,048 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010.05.06 22:34:27 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010.05.06 22:33:59 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010.05.06 22:33:47 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.05.06 22:33:29 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008.07.10 19:33:40 | 000,306,176 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rtl8187Se.sys -- (rtl8187Se)
DRV - [2008.06.11 05:23:07 | 000,106,368 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.06.11 05:23:01 | 000,156,160 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTS5121.sys -- (RSUSBSTOR)
DRV - [2008.05.19 22:49:14 | 000,625,792 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2860.sys -- (RT80x86)
DRV - [2008.05.08 06:21:40 | 004,739,072 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.02.15 15:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008.01.31 15:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008.01.22 20:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007.12.19 20:32:12 | 005,854,688 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2007.11.29 09:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007.10.18 14:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007.10.02 11:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006.10.10 19:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2005.01.07 05:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004.12.23 04:47:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ULCDRHlp.sys -- (ULCDRHlp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

IE - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.07.22 19:56:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010.05.12 08:17:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Mozilla\Extensions
[2010.05.12 08:17:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\NTB\Data aplikací\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

O1 HOSTS File: ([2010.09.05 09:03:17 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Micro-Star International Co., Ltd.)
O4 - HKLM..\Run: [pdfFactory Pro Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [ICQ] C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Akcelerátor spuštění AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2640306841-2079858896-2257336040-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 168.95.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\NTB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\NTB\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.08.29 16:41:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 30 Days ==========

[2010.09.05 22:30:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Data aplikací\Malwarebytes
[2010.09.05 22:29:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.09.05 22:29:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.09.05 22:29:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
[2010.09.05 22:29:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.09.05 11:16:19 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.09.05 09:05:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010.09.04 19:53:28 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010.09.04 19:53:28 | 000,000,000 | ---D | C] -- C:\rsit
[2010.09.04 19:48:30 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\NTB\Recent
[2010.09.04 19:33:25 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.09.04 19:33:25 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.09.04 19:33:25 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.09.04 19:33:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.09.04 19:32:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.09.04 19:31:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.09.04 07:42:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\BUK
[2010.09.03 15:29:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Broskve
[2010.09.03 15:18:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\reklama
[2010.09.03 12:59:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Grilovacka
[2010.09.02 12:29:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Dokumenty\Corel User Files
[2010.08.25 23:09:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\SOUNDTRACK-Pearl Harbor
[2010.08.22 17:21:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF22
[2010.08.18 17:11:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Králův Dvůr
[2010.08.17 18:59:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\DCIM
[2010.08.16 16:46:23 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010.08.16 13:27:27 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbprint.sys
[2010.08.15 12:44:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\Nová složka
[2010.08.15 00:26:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\ZÁMEK VIMPERK
[2010.08.15 00:25:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\HUSINECKÁ PŘEHRADA
[2010.08.15 00:25:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\SAUNA ŽERNOVICE
[2010.08.15 00:21:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF11
[2010.08.12 21:55:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\HokusPhotoPokus
[2010.08.12 18:45:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NTB\Plocha\100MSDCF
[2010.08.12 07:46:26 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010.07.12 19:24:00 | 000,099,840 | R--- | C] ( ) -- C:\WINDOWS\System32\Zipdll.dll
[2010.07.12 19:24:00 | 000,094,208 | R--- | C] ( ) -- C:\WINDOWS\System32\Unzdll.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.09.08 08:51:16 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.09.08 08:51:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.08 08:50:54 | 2136,268,800 | -HS- | M] () -- C:\hiberfil.sys
[2010.09.07 22:29:36 | 004,718,592 | -H-- | M] () -- C:\Documents and Settings\NTB\NTUSER.DAT
[2010.09.07 22:29:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\NTB\ntuser.ini
[2010.09.07 22:29:34 | 002,205,456 | -H-- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\IconCache.db
[2010.09.05 22:30:00 | 000,000,741 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.09.05 11:14:18 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.05 09:03:29 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.09.05 09:03:17 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.09.04 19:30:26 | 003,835,729 | R--- | M] () -- C:\Documents and Settings\NTB\Plocha\ComboFix.exe
[2010.09.04 14:03:12 | 007,167,738 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00174.JPG
[2010.09.03 15:18:08 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Převodem.xls
[2010.09.03 14:31:17 | 000,753,368 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f51-FJ.pdf
[2010.09.03 14:30:46 | 000,727,118 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f50-FJ.pdf
[2010.09.03 14:30:14 | 000,650,847 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f49-JOSTRA.pdf
[2010.09.03 14:29:56 | 000,727,145 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f48-IU.pdf
[2010.09.03 14:29:32 | 001,273,172 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f46-SMV.pdf
[2010.09.03 14:28:59 | 000,877,118 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\f47-TS.pdf
[2010.09.02 21:48:33 | 001,036,079 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\reklama-konec.jpg
[2010.09.02 20:44:25 | 005,618,354 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\reklama.CDR
[2010.09.02 20:39:22 | 005,616,528 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Záloha_reklama.CDR
[2010.08.26 23:09:02 | 733,945,420 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.avi
[2010.08.26 22:14:04 | 000,080,568 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.srt
[2010.08.26 10:41:46 | 000,060,416 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Peněžní denník 2010 - 0.0.2010.xls
[2010.08.23 22:19:01 | 000,001,605 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.08.23 22:14:33 | 000,000,230 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2010.08.23 22:00:44 | 000,080,372 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\44424_141737985865199_100000869945374_186470_1093087_n.jpg
[2010.08.22 16:57:34 | 000,002,286 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Google Chrome.lnk
[2010.08.21 23:17:06 | 038,383,194 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Sidewalks.rar
[2010.08.17 09:24:06 | 005,070,285 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00014.JPG
[2010.08.16 19:06:37 | 002,102,873 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\ospalec.jpg
[2010.08.16 18:58:40 | 000,411,581 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Snímek 002.jpg
[2010.08.16 18:58:40 | 000,397,327 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Snímek 001.jpg
[2010.08.16 16:46:26 | 000,000,812 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\EVEREST Home Edition.lnk
[2010.08.16 11:01:32 | 012,026,816 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\3D.pln
[2010.08.16 10:14:19 | 006,532,232 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\D03_Wood_Floors.rar
[2010.08.14 23:31:34 | 004,111,129 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00069.JPG
[2010.08.13 09:34:38 | 000,352,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.12 13:54:28 | 000,033,399 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\jj.jpg
[2010.08.12 07:50:37 | 000,000,573 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.08.12 07:48:17 | 000,988,064 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.08.12 07:48:17 | 000,435,594 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.08.12 07:48:17 | 000,432,516 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2010.08.12 07:48:17 | 000,079,440 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2010.08.12 07:48:17 | 000,068,490 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.08.11 22:45:03 | 003,456,275 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\DSC00022.jpg
[2010.08.11 22:41:36 | 000,101,128 | ---- | M] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
[2010.08.10 12:01:29 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\NTB\Plocha\Název zboží množství sleva.doc
[2010.08.09 20:35:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.09.08 08:50:54 | 2136,268,800 | -HS- | C] () -- C:\hiberfil.sys
[2010.09.05 22:30:00 | 000,000,741 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2010.09.05 09:45:39 | 007,167,738 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00174.JPG
[2010.09.05 08:45:50 | 003,835,729 | R--- | C] () -- C:\Documents and Settings\NTB\Plocha\ComboFix.exe
[2010.09.04 19:33:25 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.09.04 19:33:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.09.04 19:33:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.09.04 19:33:25 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.09.04 19:33:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.09.03 14:31:47 | 000,753,368 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f51-FJ.pdf
[2010.09.03 14:31:47 | 000,727,118 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f50-FJ.pdf
[2010.09.03 14:31:46 | 001,273,172 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f46-SMV.pdf
[2010.09.03 14:31:46 | 000,877,118 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f47-TS.pdf
[2010.09.03 14:31:46 | 000,727,145 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f48-IU.pdf
[2010.09.03 14:31:46 | 000,650,847 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\f49-JOSTRA.pdf
[2010.09.02 21:48:32 | 001,036,079 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\reklama-konec.jpg
[2010.09.02 12:57:44 | 005,616,528 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Záloha_reklama.CDR
[2010.09.02 12:27:56 | 005,618,354 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\reklama.CDR
[2010.08.26 23:06:38 | 733,945,420 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.avi
[2010.08.26 22:14:03 | 000,080,568 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\stargate_universe_s01e01-e02-air_parts_1_and_2.srt
[2010.08.24 21:20:28 | 000,032,768 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Převodem.xls
[2010.08.24 21:20:27 | 000,060,416 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Peněžní denník 2010 - 0.0.2010.xls
[2010.08.23 22:00:44 | 000,080,372 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\44424_141737985865199_100000869945374_186470_1093087_n.jpg
[2010.08.18 16:32:20 | 005,070,285 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00014.JPG
[2010.08.16 19:06:33 | 002,102,873 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\ospalec.jpg
[2010.08.16 16:46:26 | 000,000,812 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\EVEREST Home Edition.lnk
[2010.08.16 10:57:54 | 012,026,816 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\3D.pln
[2010.08.16 10:27:03 | 038,383,194 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Sidewalks.rar
[2010.08.16 10:12:09 | 006,532,232 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\D03_Wood_Floors.rar
[2010.08.15 13:36:45 | 004,111,129 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00069.JPG
[2010.08.12 13:54:28 | 000,033,399 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\jj.jpg
[2010.08.11 22:44:44 | 003,456,275 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\DSC00022.jpg
[2010.08.10 12:01:28 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\NTB\Plocha\Název zboží množství sleva.doc
[2010.08.03 10:42:46 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.07.12 19:24:00 | 004,677,632 | R--- | C] () -- C:\WINDOWS\System32\ri.dll
[2010.07.12 19:24:00 | 000,618,496 | R--- | C] () -- C:\WINDOWS\System32\stlpmt45.dll
[2010.07.12 19:24:00 | 000,618,496 | R--- | C] () -- C:\WINDOWS\System32\stlp45.dll
[2010.07.12 19:24:00 | 000,230,912 | R--- | C] () -- C:\WINDOWS\System32\Zipit.dll
[2010.07.12 19:24:00 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\vc4_jpeg.dll
[2010.07.12 19:24:00 | 000,098,304 | R--- | C] () -- C:\WINDOWS\System32\VC4_TIFF.dll
[2010.07.12 19:24:00 | 000,090,112 | R--- | C] () -- C:\WINDOWS\System32\sdr.dll
[2010.07.12 19:24:00 | 000,040,720 | R--- | C] () -- C:\WINDOWS\System32\oledb32r.dll
[2010.07.12 19:24:00 | 000,033,280 | R--- | C] () -- C:\WINDOWS\System32\SP32W.DLL
[2010.07.12 19:24:00 | 000,005,392 | R--- | C] () -- C:\WINDOWS\System32\oledb32x.dll
[2010.07.12 19:23:58 | 000,315,904 | R--- | C] () -- C:\WINDOWS\System32\glu.dll
[2010.07.12 19:23:58 | 000,172,032 | R--- | C] () -- C:\WINDOWS\System32\glut32.dll
[2010.07.12 19:23:58 | 000,084,992 | R--- | C] () -- C:\WINDOWS\System32\HASPVB32.DLL
[2010.07.12 19:23:58 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2010.07.07 13:03:49 | 000,000,230 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2010.05.14 08:53:22 | 000,001,605 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2010.05.14 00:23:57 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\NTB\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.13 20:05:57 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.08.30 01:25:37 | 000,001,168 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008.08.29 19:01:37 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008.08.29 18:55:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2008.08.29 17:59:48 | 006,184,960 | R--- | C] () -- C:\WINDOWS\System32\RTS5121icon.dll
[2008.08.29 17:46:15 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2007.12.21 16:46:32 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2005.07.22 21:30:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2003.04.09 15:38:04 | 000,005,664 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010.05.12 10:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
[2010.05.13 21:41:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Autodesk
[2010.05.15 20:28:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonBJ
[2010.05.16 11:30:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonIJEGV
[2010.05.24 18:38:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\CanonIJScan
[2010.05.06 10:19:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PassMark
[2010.09.07 19:03:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
[2010.05.13 19:56:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Ulead Systems
[2010.05.13 21:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Autodesk
[2010.06.16 19:13:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Canon
[2010.09.08 08:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\ICQ
[2010.09.04 18:14:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Spyware Terminator
[2010.05.12 08:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Thunderbird
[2010.05.13 19:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Ulead Systems
[2010.06.27 09:27:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Zoner

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"Google Update" = "C:\Documents and Settings\NTB\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c -- [2010.04.23 21:46:25 | 000,136,176 | ---- | M] (Google Inc.)
"DAEMON Tools" = "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -- [2007.09.18 16:16:16 | 000,171,464 | ---- | M] (DT Soft Ltd.)
"AdobeUpdater" = "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" -- [2010.04.25 03:52:03 | 002,356,088 | ---- | M] (Adobe Systems Incorporated)
"SpywareTerminatorUpdate" = "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" -- [2010.08.03 10:42:46 | 003,037,696 | ---- | M] (Crawler.com)
"ICQ" = "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4 -- [2010.08.22 13:02:26 | 000,133,432 | ---- | M] (ICQ, LLC.)

< c:\windows\*.* /U >
[1 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2010.09.05 10:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Adobe
[2010.05.13 21:43:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Autodesk
[2010.06.16 19:13:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Canon
[2010.05.14 14:17:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Corel
[2010.09.08 08:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\ICQ
[2008.08.29 16:41:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Identities
[2008.08.29 17:58:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\InstallShield
[2010.04.23 21:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Macromedia
[2010.09.05 22:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Malwarebytes
[2010.06.30 19:07:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NTB\Data aplikací\Microsoft
[2010.05.12 08:17:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Mozilla
[2010.07.21 10:52:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\PSpad
[2010.09.07 09:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Skype
[2010.09.07 08:45:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\skypePM
[2010.09.04 18:14:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Spyware Terminator
[2010.05.12 08:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Thunderbird
[2010.05.13 19:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Ulead Systems
[2010.05.14 08:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\WinRAR
[2010.06.27 09:27:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NTB\Data aplikací\Zoner

< %APPDATA%\*.exe /s >


< MD5 for: AGP440.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\ATAPI.SYS
[2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\ATAPI.SYS
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys

< MD5 for: CDROM.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:cdrom.sys
[2008.04.14 14:00:00 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2005.03.25 15:00:00 | 000,052,224 | ---- | M] (Microsoft Corporation) MD5=DD6A189894B14E24A14B4D182F5F3949 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\CDROM.SYS
[2005.03.25 15:00:00 | 000,052,224 | ---- | M] (Microsoft Corporation) MD5=DD6A189894B14E24A14B4D182F5F3949 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\CDROM.SYS

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\ERDNT\cache\cryptsvc.dll
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll
[2008.04.14 14:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\dllcache\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 14:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: HAL.DLL >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:hal.dll
[2008.04.14 14:00:00 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=4329EE7D502C9113EBA0F9570392F5EE -- C:\WINDOWS\system32\hal.dll
[2005.03.25 15:00:00 | 000,109,568 | ---- | M] (Microsoft Corporation) MD5=EB0D4F2DED96775E9C272BBDFAA7B923 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\HAL.DLL
[2005.03.25 15:00:00 | 000,109,568 | ---- | M] (Microsoft Corporation) MD5=EB0D4F2DED96775E9C272BBDFAA7B923 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\HAL.DLL

< MD5 for: CHANGER.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:Changer.sys

< MD5 for: IASTOR.SYS >
[2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\IASTOR.SYS
[2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\IASTOR.SYS

< MD5 for: ISAPNP.SYS >
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:isapnp.sys
[2008.04.14 14:00:00 | 020,102,206 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:isapnp.sys
[2005.03.25 15:00:00 | 000,037,888 | ---- | M] (Microsoft Corporation) MD5=4EA2CC0CC091854FB1A07B6758BB68C0 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\ISAPNP.SYS
[2005.03.25 15:00:00 | 000,037,888 | ---- | M] (Microsoft Corporation) MD5=4EA2CC0CC091854FB1A07B6758BB68C0 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\ISAPNP.SYS
[2008.04.14 07:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\dllcache\isapnp.sys
[2008.04.14 07:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys
[2008.04.14 14:00:00 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\isapnp.sys

< MD5 for: LSASS.EXE >
[2005.03.25 15:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=D4B61A935670C57A0DEA81B4F4A12169 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\LSASS.EXE
[2005.03.25 15:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=D4B61A935670C57A0DEA81B4F4A12169 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\LSASS.EXE
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\ERDNT\cache\lsass.exe
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\dllcache\lsass.exe
[2008.04.14 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ERDNT\cache\ndis.sys
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\dllcache\ndis.sys
[2008.04.14 14:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2005.03.25 15:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=FDB9275EB5E75A456BD26F4479103C19 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\NDIS.SYS
[2005.03.25 15:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=FDB9275EB5E75A456BD26F4479103C19 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\NDIS.SYS

< MD5 for: NETLOGON.DLL >
[2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\NETLOGON.DLL
[2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\NETLOGON.DLL
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SCECLI.DLL
[2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SCECLI.DLL
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2005.03.25 15:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) MD5=5912CC8F61CF76E4FADC6F34C8F92DDB -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SMSS.EXE
[2005.03.25 15:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) MD5=5912CC8F61CF76E4FADC6F34C8F92DDB -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SMSS.EXE
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\dllcache\smss.exe
[2008.04.14 14:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe
[2008.04.14 14:00:00 | 000,481,792 | ---- | M] (Microsoft Corporation) MD5=F209B5C79A87A9521DC0BD88B039EEE3 -- C:\WINDOWS\I386\SYSTEM32\SMSS.EXE

< MD5 for: SVCHOST.EXE >
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2005.03.25 15:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=CA8E6441930B54A8B8210061CE5FCCE7 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SVCHOST.EXE
[2005.03.25 15:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=CA8E6441930B54A8B8210061CE5FCCE7 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SVCHOST.EXE

< MD5 for: SYMMPI.SYS >
[2005.03.25 15:00:00 | 000,049,664 | ---- | M] (LSI Logic) MD5=868204832E011E2D64281D7EABEE572E -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\SYMMPI.SYS
[2005.03.25 15:00:00 | 000,049,664 | ---- | M] (LSI Logic) MD5=868204832E011E2D64281D7EABEE572E -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\SYMMPI.SYS

< MD5 for: TCPIP.SYS >
[2008.04.14 14:00:00 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\ERDNT\cache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2005.03.25 15:00:00 | 000,333,312 | ---- | M] (Microsoft Corporation) MD5=EC676733442B122F1828FCD03B86C20B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\TCPIP.SYS
[2005.03.25 15:00:00 | 000,333,312 | ---- | M] (Microsoft Corporation) MD5=EC676733442B122F1828FCD03B86C20B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\TCPIP.SYS

< MD5 for: USERINIT.EXE >
[2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\USERINIT.EXE
[2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\USERINIT.EXE
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\WINLOGON.EXE
[2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\WINLOGON.EXE
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\ERDNT\cache\ws2_32.dll
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\dllcache\ws2_32.dll
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll
[2005.03.25 15:00:00 | 000,083,968 | ---- | M] (Microsoft Corporation) MD5=DB060880F9C349F597AFA270D1D01B68 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\WS2_32.DLL
[2005.03.25 15:00:00 | 000,083,968 | ---- | M] (Microsoft Corporation) MD5=DB060880F9C349F597AFA270D1D01B68 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\WS2_32.DLL

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.08.29 18:31:41 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.08.29 18:31:41 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.08.29 18:31:40 | 000,483,328 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: pade internet po 30 verinach

#18 Příspěvek od motji »

Tyto Ip adresy znáte?
DhcpNameServer = 192.168.1.1 168.95.1.1
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
amosatko
Návštěvník
Návštěvník
Příspěvky: 119
Registrován: 22 Pro 2008 19:24

Re: pade internet po 30 verinach

#19 Příspěvek od amosatko »

192.168.1.1 je poskytovatel internetu ...

moje sit je 192.168.1.100 az 254

a tahle mi nic nerika 168.95.1.1
Nahoru
amosatko
Návštěvník
Návštěvník
Příspěvky: 119
Registrován: 22 Pro 2008 19:24

Re: pade internet po 30 verinach

#20 Příspěvek od amosatko »

k tem ostatnim muzu udelat akorat tohle
Přílohy
ip.JPG
(58.58 KiB) Staženo 25 x
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: pade internet po 30 verinach

#21 Příspěvek od motji »

Taiwan Vám něco říká? :D
http://whatismyipaddress.com/ip/168.95.1.1
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
amosatko
Návštěvník
Návštěvník
Příspěvky: 119
Registrován: 22 Pro 2008 19:24

Re: pade internet po 30 verinach

#22 Příspěvek od amosatko »

Samozrejme ze ne .... co mi tu dela.. co s tim a co dal? :-)

A jeste ten daemon :-(
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: pade internet po 30 verinach

#23 Příspěvek od motji »

Ideální by bylo v počítači znovu přednastavit Vaše Ip adresy. Takže si někde opište, jaké máte Ip adresy, já Vám přes OTL zruším nastavení a Vy si ho znovu nastavíte správně.
Po použití OTl a nsáledném restartu Vám asi nepujde internet, než si ty IP adresy znovu nastavíte.

:arrow: Spustte OTL
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 168.95.1.1

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]

-klikněte na tlačítko opravit.
-Následně se pc restartuje.
- Log vložte zde :)



:arrow: Stáhněte Bootkit Remover http://www.esagelab.com/files/bootkit_remover.rar
-uložte ho na plochu a spusťte
- pravým tlačítkem myši klikněte do černého okna, zvolte Vybrat vše, stiskněte CTRL+C a pak zde na foru CTRL+V.



Ten daemon opravíme hned potom, konkrétně Vám hlásí co? je to po použití combofixu, který ho odstavuje, jde to opravit, nebojte :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“