Modrá obrazovka při startupu

[shitman]

Dobrý den, mám tady problém při startu PC. Je zřejmě způsobena virem, můžete mi k tomu prosím něco říct? Děkuji


Logfile of random's system information tool 1.08 (written by random/random)
Run by MAREK at 2010-11-29 15:20:41
Microsoft Windows XP Professional Service Pack 3
System drive C: has 21 GB (55%) free of 38 GB
Total RAM: 510 MB (46% free)


======Scheduled tasks folder======

C:\WINDOWS\tasks\HP Usg Daily.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-18 61888]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-12-18 40368]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2004-05-04 176128]
"HPHUPD05"=c:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe [2004-04-01 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664]
"HP Software Update"=c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2003-12-05 49152]
"HPHmon05"=C:\WINDOWS\system32\hphmon05.exe [2004-05-05 491520]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-10-26 81920]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"vyryfo"=C:\WINDOWS\system32\boutucik.exe [2010-11-29 461824]
"Windows Firewall"=C:\DOCUME~1\MAREK\LOCALS~1\Temp\lsass.exe [2010-11-17 57344]
"wuaucldt"=c:\windows\system32\wuaucldt.exe [2010-11-22 33280]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"AutoStart"=C:\DOCUME~1\MAREK\LOCALS~1\Temp\617.exe [2010-11-29 49696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-10-26 81920]
"Windows Firewall"=C:\DOCUME~1\MAREK\LOCALS~1\Temp\lsass.exe [2010-11-17 57344]
"wuaucldt"=c:\documents and settings\marek\wuaucldt.exe [2010-11-22 33280]
"MSConfig"=C:\Documents and Settings\MAREK\wrvxcs.exe [2010-11-24 18432]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe [2010-10-13 232912]

C:\Documents and Settings\MAREK\Start Menu\Programs\Startup
0lhccyt.exe
0vrmm6i.exe
0w3iy6k.exe
0ww5x0t.exe
15itp5v.exe
1sn0eua.exe
3ef0llc.exe
3rw5you.exe
3tzpf3m.exe
3xyt26q.exe
5mc3oo3.exe
5x0t860.exe
6alwhxi.exe
6oo3aa3.exe
6wrmcd7.exe
8fqrhc1.exe
9eql21s.exe
9lm0c3o.exe
a1wm6ozz.exe
a5b0xxot.exe
albbc38u.exe
alrxsoe0.exe
avvbmc3oo.exe
bc38upgb05i.exe
bw60iepkll.exe
di3uu3gg.exe
dz02bmhndyu.exe
e1awwriitu.exe
flwhxi57a0.exe
h9itp5v0.exe
hcyjjppglhx.exe
hs3ef0llcx.exe
hyi6uu3gw1.exe
it10fflr26y.exe
jjfk3ww6ndj.exe
jppvrmm3yy.exe
jzpklgmm.exe
kfq3cc3oe6.exe
mxxyouz9.exe
o3vvgchdttp.exe
ojaavmm5.exe
ouflgmm70j.exe
oufqamridye.exe
pqw71sooja.exe
q1miiduu.exe
rh8ozp7200.exe
s0uupggbss.exe
tkpqww1sttp.exe
tozaavmmhyy.exe
ttzaavmmhyy.exe
uflgmm70jp.exe
up9rw3yy.exe
uvlrw6yi6u.exe
vmhcd720.exe
vmm5n5jpkqq.exe
vrw3iy6kff.exe
w60iepkllrn.exe
w88ozp7200.exe
wrm9ttkffw.exe
xiyzuu3gw1.exe
xttzaavm.exe
xxtjuffq70s.exe
y6kqww1s.exe
yopvqlr0nne.exe
zpklgmm70jp.exe
zpvvgchd.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\fvecbsbw]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vvwovgcd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fvecbsbw]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vvwovgcd.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\MAREK\Local Settings\Temporary Internet Files\Content.IE5\T3E2CEOC\P17535732.JPG-www.facebook[1].exe"="C:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"C:\DOCUME~1\MAREK\LOCALS~1\Temp\0696.exe"="C:\DOCUME~1\MAREK\LOCALS~1\Temp\0696.exe:*:Enabled:Microsoft Office"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\r_server.exe"="C:\WINDOWS\system32\r_server.exe:*:Enabled:r_server.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-11-29 15:20:42 ----D---- C:\Program Files\trend micro
2010-11-29 15:20:41 ----D---- C:\rsit
2010-11-29 15:19:11 ----A---- C:\WINDOWS\system32\drivers\ersbhbgx.sys
2010-11-27 19:07:12 ----A---- C:\WINDOWS\ntbtlog.txt
2010-11-26 21:13:17 ----A---- C:\WINDOWS\system32\drivers\idrnpdxc.sys
2010-11-26 21:12:34 ----A---- C:\WINDOWS\system32\drivers\ogo57ad.sys
2010-11-26 21:08:18 ----A---- C:\WINDOWS\system32\drivers\dksaae5.sys
2010-11-26 21:07:40 ----A---- C:\WINDOWS\system32\drivers\fvecbsbw.sys
2010-11-26 21:04:01 ----A---- C:\WINDOWS\system32\drivers\vefroopa.sys
2010-11-26 19:35:33 ----A---- C:\WINDOWS\system32\drivers\wcscd.sys
2010-11-25 19:15:10 ----A---- C:\psp.exe
2010-11-24 23:04:33 ----A---- C:\WINDOWS\system32\lakiloohev.exe
2010-11-24 11:24:55 ----RA---- C:\Documents and Settings\MAREK\Application Data\nK6Nk.txt
2010-11-23 20:11:50 ----HD---- C:\Documents and Settings\All Users\Application Data\Common Files
2010-11-23 19:56:59 ----D---- C:\Documents and Settings\All Users\Application Data\AVG10
2010-11-23 19:46:56 ----D---- C:\Program Files\AVG
2010-11-23 19:34:38 ----D---- C:\Documents and Settings\All Users\Application Data\MFAData
2010-11-23 19:11:58 ----RA---- C:\Documents and Settings\MAREK\Application Data\hDlkH.txt
2010-11-22 22:46:29 ----D---- C:\WINDOWS\Minidump
2010-11-22 18:11:24 ----A---- C:\WINDOWS\system32\wuaucldt.exe
2010-11-21 22:25:59 ----A---- C:\HDTV.exe
2010-11-21 21:00:36 ----RA---- C:\Documents and Settings\MAREK\Application Data\eMI80.txt
2010-11-21 18:19:38 ----RA---- C:\Documents and Settings\MAREK\Application Data\k6jLC.txt
2010-11-21 15:42:52 ----RA---- C:\Documents and Settings\MAREK\Application Data\BG0Ai.txt
2010-11-18 20:18:05 ----A---- C:\nlw.exe
2010-11-16 20:21:42 ----A---- C:\WINDOWS\system32\drivers\vvwovgcd.sys
2010-11-16 20:21:11 ----A---- C:\WINDOWS\system32\gigam.exe
2010-11-16 20:20:13 ----A---- C:\WINDOWS\system32\boutucik.exe
2010-11-16 20:19:12 ----RSH---- C:\Documents and Settings\MAREK\Application Data\juzjf.exe
2010-11-16 20:18:39 ----A---- C:\winn27.exe
2010-11-14 19:39:18 ----A---- C:\t6.exe
2010-11-08 02:08:32 ----A---- C:\ng.exe

======List of files/folders modified in the last 1 months======

2010-11-29 15:20:42 ----RD---- C:\Program Files
2010-11-29 15:20:05 ----D---- C:\WINDOWS\system32
2010-11-27 19:07:12 ----D---- C:\WINDOWS
2010-11-26 21:13:17 ----D---- C:\WINDOWS\system32\drivers
2010-11-26 19:36:50 ----AD---- C:\WINDOWS\Temp
2010-11-26 19:07:00 ----D---- C:\WINDOWS\Prefetch
2010-11-26 17:48:29 ----RSHD---- C:\RECYCLER
2010-11-26 14:35:20 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-23 20:25:43 ----SHD---- C:\WINDOWS\Installer
2010-11-23 20:07:37 ----HD---- C:\WINDOWS\inf
2010-11-23 19:53:06 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-11-23 19:52:57 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-23 19:46:03 ----D---- C:\WINDOWS\WinSxS
2010-11-23 19:45:37 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-11-22 22:31:15 ----SD---- C:\WINDOWS\Tasks
2010-11-22 22:30:37 ----D---- C:\WINDOWS\system32\CatRoot
2010-11-17 13:49:47 ----D---- C:\WINDOWS\network diagnostic
2010-11-16 20:22:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-08 01:55:14 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-11-07 15:11:06 ----D---- C:\Program Files\Common Files\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 vvwovgcd;vvwovgcd; C:\WINDOWS\System32\Drivers\vvwovgcd.sys [2010-11-16 40128]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 cdfss;cdfss; \??\C:\WINDOWS\TEMP\cdfss []
S1 dksaae5;dksaae5; C:\WINDOWS\System32\drivers\dksaae5.sys [2010-11-26 138272]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
S1 ogo57ad;ogo57ad; C:\WINDOWS\System32\drivers\ogo57ad.sys [2010-11-26 138272]
S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-13 42752]
S1 wcscd;wcscd; C:\WINDOWS\system32\drivers\wcscd.sys [2010-11-26 30560]
S2 ersbhbgx;ersbhbgx; C:\WINDOWS\system32\drivers\ersbhbgx.sys [2010-11-29 82944]
S2 fvecbsbw;fvecbsbw; C:\WINDOWS\system32\drivers\fvecbsbw.sys [2010-11-26 82944]
S3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-03-18 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-03-18 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-03-18 21744]
S3 i81x;i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [2004-08-03 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [2004-08-03 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [2004-08-03 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [2004-08-03 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [2004-08-03 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [2004-08-03 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-03 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-03 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-03 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [2004-08-03 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [2004-08-03 19551]
S3 iAimTV2;iAimTV2; C:\WINDOWS\System32\DRIVERS\wATV03nt.sys []
S3 iAimTV3;iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [2004-08-03 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [2004-08-03 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-03 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-03 22271]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-05-28 500568]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe []
S2 diioio17uby;AOL Connectivity Service; C:\WINDOWS\system32\gigam.exe [2010-11-29 461824]
S2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 r_server;Remote Administrator Service; C:\WINDOWS\system32\r_server.exe [2004-06-23 708608]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[cernohous13]

Vítám tě u nás

Můžeme to zkusit, ale chvíli mi bude trvat sesmolit script na to smetiště - vydrž

[shitman]

Díky moc za usilí

[cernohous13]

Tak první kolo

Stáhni OTM z jednoho odkazu a ulož nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“.
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „Moveit!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\

Script OTM

Kód: Vybrat vše

:Processes
explorer.exe

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA driver monitor"=-
"Adobe ARM"=-
"vyryfo"=-
"Windows Firewall"=-
"wuaucldt"=-
"Regedit32"=-
"KernelFaultCheck"=-
"AutoStart"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA driver monitor"=-
"Windows Firewall"=-
"wuaucldt"=-
"MSConfig"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vvwovgcd.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vvwovgcd.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\fvecbsbw]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\fvecbsbw]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\MAREK\Local Settings\Temporary Internet Files\Content.IE5\T3E2CEOC\P17535732.JPG-www.facebook[1].exe"=-
"C:\Documents and Settings\Marek\Local Settings\Temp\0696.exe"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\WINDOWS\system32\r_server.exe"=-

:Files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s
P1876832.JPG-www.facebook.exe /s
P17535732.JPG-www.facebook[1].exe /s
C:\WINDOWS\nvsvc32.exe
C:\WINDOWS\system32\boutucik.exe
C:\Documents and Settings\Marek\Local Settings\temp\lsass.exe
c:\windows\system32\wuaucldt.exe
C:\WINDOWS\system32\regedit.exe
C:\Documents and Settings\Marek\Local Settings\temp\617.exe
C:\Documents and Settings\MAREK\wrvxcs.exe
C:\Documents and Settings\Marek\Local Settings\Temp\0696.exe
C:\WINDOWS\system32\r_server.exe
C:\WINDOWS\system32\lakiloohev.exe
C:\Documents and Settings\MAREK\Application Data\nK6Nk.txt
C:\Documents and Settings\MAREK\Application Data\hDlkH.txt
C:\Documents and Settings\MAREK\Application Data\eMI80.txt
C:\Documents and Settings\MAREK\Application Data\k6jLC.txt
C:\Documents and Settings\MAREK\Application Data\BG0Ai.txt
C:\nlw.exe
C:\psp.exe
C:\WINDOWS\system32\gigam.exe
C:\Documents and Settings\MAREK\Application Data\juzjf.exe
C:\winn27.exe
C:\t6.exe
C:\ng.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\0lhccyt.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\0vrmm6i.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\0w3iy6k.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\0ww5x0t.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\15itp5v.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\1sn0eua.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\3ef0llc.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\3rw5you.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\3tzpf3m.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\3xyt26q.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\5mc3oo3.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\5x0t860.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\6alwhxi.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\6oo3aa3.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\6wrmcd7.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\8fqrhc1.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\9eql21s.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\9lm0c3o.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\a1wm6ozz.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\a5b0xxot.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\albbc38u.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\alrxsoe0.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\avvbmc3oo.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\bc38upgb05i.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\bw60iepkll.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\di3uu3gg.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\dz02bmhndyu.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\e1awwriitu.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\flwhxi57a0.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\h9itp5v0.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\hcyjjppglhx.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\hs3ef0llcx.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\hyi6uu3gw1.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\it10fflr26y.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\jjfk3ww6ndj.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\jppvrmm3yy.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\jzpklgmm.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\kfq3cc3oe6.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\mxxyouz9.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\o3vvgchdttp.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\ojaavmm5.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\ouflgmm70j.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\oufqamridye.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\pqw71sooja.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\q1miiduu.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\rh8ozp7200.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\s0uupggbss.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\tkpqww1sttp.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\tozaavmmhyy.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\ttzaavmmhyy.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\uflgmm70jp.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\up9rw3yy.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\uvlrw6yi6u.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\vmhcd720.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\vmm5n5jpkqq.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\vrw3iy6kff.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\w60iepkllrn.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\w88ozp7200.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\wrm9ttkffw.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\xiyzuu3gw1.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\xttzaavm.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\xxtjuffq70s.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\y6kqww1s.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\yopvqlr0nne.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\zpklgmm70jp.exe
C:\Documents and Settings\MAREK\Start Menu\Programs\Startup\zpvvgchd.exe

:Services
ersbhbgx
idrnpdxc
ogo57ad
dksaae5
fvecbsbw
vefroopa
wcscd
vvwovgcd
cdfss
diioio17uby
r_server

:Commands
[PURITY]
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[REBOOT]

po restartu logy z C:\_OTM\MovedFiles + nový RSIT