Nelze vytvořit log z RSIT prosím pomoc

[Fugass]

Při pokusu spustit Rsit vyskočí stop a nápis nelze najít c/programFiles atd. Avast hlásí při každém pokusu něco spustit Win32 vitro prosím o pomoc. Děkuji

[Caroprd111]

Zdravím

Nemám pro Vás dobrou zprávu...

Virut je polymorfný súborový vírus. Vírus sa pripája k IRC sieti. Možno ho na diaľku ovládať.Vírus hľadá spustiteľné súbory exe,src,htm,html,.jpg, .pdf, .doc >.Spustiteľné súbory vírus infikuje pripojením svojho kódu k poslednej sekcii. Hostiteľský súbor modifikuje tak, že pred behom pôvodného kódu sa spustí vírus.Dokáže sa aktualizovať alebo spustiť ľubovoľný súbor.

Šance na vyléčení je velmi malá. Můžeme se o léčení pokusit, ale většinou to končí formátem. Rozhodněte se, jestli se chcete pokusit o léčení nebo rovnou zformátovat disk a napište. Podle rozhodnutí vám pošlu další postup.

[Fugass]

můžeme to zkusit děkuji

[Caroprd111]

Dobře, ale opakuji, že šance na vyléčení je minimální. Máte zazálohované důležité soubory?

Máte k PC připojeno nějaké paměťové zařízení? (mobilní telefon, fotoaparát, flash disk) K PC nyní nepřipojujte žádná paměťová media. Pokud jsou tato zařízení k PC připojena, tak na nich pravděpodobně budou data také infikovaná.

[Fugass]

Vše mám na discích. Jestli dobře rozumím tak tento virus neběži se systémem? A data která jsou fyzicky na jiném disku jsou také ztracená?

[Caroprd111]

Vir běží se systémem, ale šíří se i na jiné disky. Pokud jsou to spustitelné soubory, tak budou pravděpodobně infikované. Zkuste některý otestovat na www.virustotal.com a odkaz sem vložte.

[Fugass]

Jde mi hlavně o fotky JPG a kancelář. XLS a Word

Zkusil jsem fotky a zatím OK.

Mohu zformátovat disk J a přenést potřebná data JPG, XLS a Word. Poté odpojit disk J, c:format, nová instalace XP a poté připojit disk J? Asi to ale fungovat nebude že?


0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
P1030655.JPG
Submission date:
2011-01-02 17:31:34 (UTC)
Current status:
queued queued analysing finished
Result:
0/ 43 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.01.02.00 2011.01.01 -
AntiVir 7.11.0.250 2011.01.02 -
Antiy-AVL 2.0.3.7 2011.01.02 -
Avast 4.8.1351.0 2011.01.02 -
Avast5 5.0.677.0 2011.01.02 -
AVG 9.0.0.851 2011.01.02 -
BitDefender 7.2 2011.01.02 -
CAT-QuickHeal 11.00 2011.01.02 -
ClamAV 0.96.4.0 2011.01.01 -
Command 5.2.11.5 2011.01.01 -
Comodo 7275 2011.01.02 -
DrWeb 5.0.2.03300 2011.01.02 -
Emsisoft 5.1.0.1 2011.01.02 -
eSafe 7.0.17.0 2011.01.02 -
eTrust-Vet 36.1.8074 2010.12.31 -
F-Prot 4.6.2.117 2011.01.01 -
F-Secure 9.0.16160.0 2011.01.02 -
Fortinet 4.2.254.0 2011.01.02 -
GData 21 2011.01.02 -
Ikarus T3.1.1.90.0 2011.01.02 -
Jiangmin 13.0.900 2011.01.02 -
K7AntiVirus 9.75.3406 2010.12.31 -
Kaspersky 7.0.0.125 2011.01.02 -
McAfee 5.400.0.1158 2011.01.02 -
McAfee-GW-Edition 2010.1C 2011.01.02 -
Microsoft 1.6402 2011.01.02 -
NOD32 5753 2011.01.02 -
Norman 6.06.12 2011.01.02 -
nProtect 2011-01-02.01 2011.01.02 -
Panda 10.0.2.7 2011.01.02 -
PCTools 7.0.3.5 2011.01.02 -
Prevx 3.0 2011.01.02 -
Rising 22.80.04.04 2010.12.31 -
Sophos 4.60.0 2011.01.02 -
SUPERAntiSpyware 4.40.0.1006 2011.01.02 -
Symantec 20101.3.0.103 2011.01.02 -
TheHacker 6.7.0.1.109 2010.12.30 -
TrendMicro 9.120.0.1004 2011.01.02 -
TrendMicro-HouseCall 9.120.0.1004 2011.01.02 -
VBA32 3.12.14.2 2010.12.30 -
VIPRE 7924 2011.01.02 -
ViRobot 2010.12.31.4232 2011.01.02 -
VirusBuster 13.6.123.1 2011.01.02 -
Additional information
Show all
MD5 : d67aeec86a89f9b0eac872366811a837
SHA1 : 2a6868ea1cd4a54bef6b39cb7842f8ea4e24eea8
SHA256: c86bbf8b1019b50dae05a0218f9c935a280e29b8a85d5a1c139213e80c167ff5
ssdeep: 49152:aKCL++JvlAeVJIp7rG47eIdG6dZJAe235lY0JIEMJR7A/m9tzfH47ePO57/x1DI4:povq
177xGeAe2YkkjpY7757A8
File size : 3528591 bytes
First seen: 2011-01-02 17:31:34
Last seen : 2011-01-02 17:31:34
TrID:
JFIF-EXIF JPEG Bitmap (55.5%)
JPEG Bitmap (33.3%)
MP3 audio (11.1%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
ExifTool:
file metadata
AFAreaMode: 5-area
AFAssistLamp: Disabled and Not Required
AFPointPosition: 0.5 0.5
AdvancedSceneMode: Normal
Aperture: 8.0
Audio: No
BabyAge: (not set)
BitsPerSample: 8
BlueBalance: 1.667932
BurstMode: Off
CircleOfConfusion: 0.005 mm
ColorComponents: 3
ColorEffect: Off
ColorMode: Normal
ColorSpace: sRGB
ComponentsConfiguration: Y, Cb, Cr, -
CompressedBitsPerPixel: 4
Compression: JPEG (old-style)
Contrast: Normal
ContrastMode: High
ConversionLens: Off
CreateDate: 2010:08:04 13:27:51
CustomRendered: Normal
DataDump: (Binary data 6152 bytes)
DateTimeOriginal: 2010:08:04 13:27:51
DigitalZoomRatio: 0
EncodingProcess: Baseline DCT, Huffman coding
ExifByteOrder: Little-endian (Intel, II)
ExifImageHeight: 2448
ExifImageWidth: 3264
ExifVersion: 0221
ExposureCompensation: 0
ExposureMode: Auto
ExposureProgram: Landscape
ExposureTime: 1/200
FNumber: 8.0
FOV: 57.2 deg
FileSize: 3.4 MB
FileSource: Digital Camera
FileType: JPEG
FirmwareVersion: 0.1.1.2
Flash: Off, Did not fire
FlashBias: 0
FlashFired: No
FlashpixVersion: 0100
FocalLength: 5.5 mm
FocalLength35efl: 5.5 mm (35 mm equivalent: 33.0 mm)
FocalLengthIn35mmFormat: 33 mm
FocusMode: Auto
GainControl: None
HyperfocalDistance: 0.76 m
ISO: 100
ImageHeight: 2448
ImageQuality: High
ImageSize: 3264x2448
ImageStabilization: On, Mode 2
ImageWidth: 3264
InternalSerialNumber: (X05) 2008:08:11 no. 0400
InteropIndex: R98 - DCF basic file (sRGB)
InteropVersion: 0100
LightSource: Unknown
LightValue: 13.6
MIMEType: image/jpeg
MacroMode: Off
Make: Panasonic
MakerNoteVersion: 0121
MaxApertureValue: 2.8
MeteringMode: Multi-segment
Model: DMC-LS80
ModifyDate: 2010:08:04 13:27:51
NoiseReduction: Standard
OpticalZoomMode: Standard
Orientation: Horizontal (normal)
PanasonicExifVersion: 0250
PrintIMVersion: 0250
ProgramISO: n/a
RedBalance: 1.819734
ResolutionUnit: inches
Rotation: Horizontal (normal)
Saturation: Normal
ScaleFactor35efl: 6.0
SceneCaptureType: Landscape
SceneMode: Scenery
SceneType: Directly photographed
SelfTimer: Off
SensingMethod: One-chip color area
SequenceNumber: 0
Sharpness: Normal
ShootingMode: Scenery
ShutterSpeed: 1/200
Software: Ver.1.0
TextStamp: Off
ThumbnailImage: (Binary data 3862 bytes)
ThumbnailLength: 3862
ThumbnailOffset: 8096
TimeSincePowerOn: 00:00:26.32
TravelDay: n/a
WBBlueLevel: 1758
WBGreenLevel: 1054
WBRedLevel: 1918
WhiteBalance: Auto
WorldTimeLocation: Home
XResolution: 180
YCbCrPositioning: Co-sited
YCbCrSubSampling: YCbCr4:2:2 (2 1)
YResolution: 180

VT Community

[Caroprd111]

Obrázky a dokumenty budou v pořádku, ty Virut obvykle nenapadá. Pokud zformátujete disk J:, na ten uložíte potřebná data (ne spustitelné soubory, na ty se musí trochu jinak) a poté zformátujete systémový disk a nainstalujete systém, tak to bude to nejlepší řešení.

[Fugass]

Zkusím a potom se ozvu. Děkuji

[Caroprd111]

Určitě se ozvěte, zatím nemáte zač.

[Fugass]

Už jsem zpět.

Nejdříve jsem zformátoval disk J, poté jsem na něj nainstaloval XP Sp3,
Restart a pak formát přímo z XP původní C disk. Avast zatím nic. Zasílám výpis z Rsit.


info.txt logfile of random's system information tool 1.08 2011-01-02 20:28:43

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil Software\Avast5\Setup\setiface.dll" RunSetup
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
PC Tools Firewall Plus 7.0-->C:\Program Files\PC Tools Firewall Plus\unins000.exe /LOG

======Security center information======

AV: avast! Antivirus
FW: PC Tools Firewall Plus

======System event log======

Computer Name: MACHINENAME
Event Code: 18
Message: Klíče připojení Bluetooth nelze do místního vysílače uložit, protože se nepodařilo zjistit, zda je povoleno správné zabezpečení zařízení.

Record Number: 5
Source Name: BTHUSB
Time Written: 20110102204812.000000+060
Event Type: Upozornění
User:

Computer Name: MACHINENAME
Event Code: 7
Message: Došlo k chybě hardwaru. Událost obsahuje dodavatelem určený kód chyby.

Record Number: 4
Source Name: BTHUSB
Time Written: 20110102204812.000000+060
Event Type: Upozornění
User:

Computer Name: MACHINENAME
Event Code: 2
Message: Během prověřování, zda \Device\Serial0 je skutečně sériový port, byl zjištěn zásobník typu FIFO. Bude použit tento zásobník.

Record Number: 3
Source Name: Serial
Time Written: 20110102204234.000000+060
Event Type: Informace
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Služba Event Log byla spuštěna.

Record Number: 2
Source Name: EventLog
Time Written: 20110102204217.000000+060
Event Type: Informace
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20110102204217.000000+060
Event Type: Informace
User:

=====Application event log=====

Computer Name: FUGHINO
Event Code: 1000
Message: Čítače výkonu pro službu MSDTC (MSDTC) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 5
Source Name: LoadPerf
Time Written: 20110102195508.000000+060
Event Type: Informace
User:

Computer Name: FUGHINO
Event Code: 1000
Message: Čítače výkonu pro službu TermService (Terminálová služba) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 4
Source Name: LoadPerf
Time Written: 20110102195505.000000+060
Event Type: Informace
User:

Computer Name: FUGHINO
Event Code: 1000
Message: Čítače výkonu pro službu RemoteAccess (Směrování a vzdálený přístup) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 3
Source Name: LoadPerf
Time Written: 20110102195229.000000+060
Event Type: Informace
User:

Computer Name: FUGHINO
Event Code: 1000
Message: Čítače výkonu pro službu PSched (PSched) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 2
Source Name: LoadPerf
Time Written: 20110102195213.000000+060
Event Type: Informace
User:

Computer Name: FUGHINO
Event Code: 1000
Message: Čítače výkonu pro službu RSVP (QoS RSVP) byly úspěšně načteny.
Data záznamu obsahují nové indexové hodnoty přiřazené
této službě.

Record Number: 1
Source Name: LoadPerf
Time Written: 20110102195202.000000+060
Event Type: Informace
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

[Caroprd111]

Potřeboval bych spíše druhý log z RSIT (log.txt).

[Fugass]

moje chyba

Logfile of random's system information tool 1.08 (written by random/random)
Run by Fugass at 2011-01-02 20:28:28
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 17 GB (86%) free of 20 GB
Total RAM: 510 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:28:41, on 2.1.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Documents and Settings\Fugass\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Fugass.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

--
End of file - 2847 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-12-31 3395600]
"00PCTFW"=C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe [2010-11-29 2676696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-01-02 20:51:50 ----A---- C:\WINDOWS\system32\h323log.txt
2011-01-02 20:48:40 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2011-01-02 20:48:23 ----A---- C:\WINDOWS\system32\drivers\bthpan.sys
2011-01-02 20:48:20 ----A---- C:\WINDOWS\system32\irmon.dll
2011-01-02 20:48:20 ----A---- C:\WINDOWS\system32\irftp.exe
2011-01-02 20:48:20 ----A---- C:\WINDOWS\system32\drivers\rfcomm.sys
2011-01-02 20:48:20 ----A---- C:\WINDOWS\system32\drivers\BthEnum.sys
2011-01-02 20:48:19 ----A---- C:\WINDOWS\system32\wshirda.dll
2011-01-02 20:48:10 ----A---- C:\WINDOWS\system32\drivers\bthport.sys
2011-01-02 20:48:09 ----A---- C:\WINDOWS\system32\drivers\BTHUSB.SYS
2011-01-02 20:47:18 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2011-01-02 20:47:02 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2011-01-02 20:47:02 ----A---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-01-02 20:47:00 ----A---- C:\WINDOWS\system32\drivers\enum1394.sys
2011-01-02 20:46:34 ----A---- C:\WINDOWS\system32\drivers\AGP440.SYS
2011-01-02 20:46:17 ----A---- C:\WINDOWS\system32\usbui.dll
2011-01-02 20:46:14 ----A---- C:\WINDOWS\system32\drivers\intelide.sys
2011-01-02 20:45:01 ----SHD---- C:\WINDOWS\Installer
2011-01-02 20:45:01 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-01-02 20:45:00 ----D---- C:\Program Files\Common Files\ODBC
2011-01-02 20:45:00 ----A---- C:\WINDOWS\ODBCINST.INI
2011-01-02 20:44:57 ----RD---- C:\Program Files
2011-01-02 20:44:57 ----D---- C:\Program Files\Common Files\SpeechEngines
2011-01-02 20:44:57 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-01-02 20:44:57 ----D---- C:\Program Files\Common Files
2011-01-02 20:44:53 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2011-01-02 20:44:53 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2011-01-02 20:44:53 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdur.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdru.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2011-01-02 20:44:52 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2011-01-02 20:44:51 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2011-01-02 20:44:51 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2011-01-02 20:44:50 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2011-01-02 20:44:49 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2011-01-02 20:44:49 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2011-01-02 20:44:49 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2011-01-02 20:44:49 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2011-01-02 20:44:48 ----RA---- C:\WINDOWS\system32\kbdest.dll
2011-01-02 20:44:46 ----D---- C:\WINDOWS\LastGood.Tmp
2011-01-02 20:44:43 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2011-01-02 20:44:43 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2011-01-02 20:44:43 ----RA---- C:\WINDOWS\system32\kbdro.dll
2011-01-02 20:44:43 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2011-01-02 20:44:42 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2011-01-02 20:44:41 ----A---- C:\WINDOWS\system32\irclass.dll
2011-01-02 20:44:41 ----A---- C:\WINDOWS\system32\dgsetup.dll
2011-01-02 20:44:41 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2011-01-02 20:44:40 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-01-02 20:44:40 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2011-01-02 20:44:38 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2011-01-02 20:44:38 ----A---- C:\WINDOWS\TASKMAN.EXE
2011-01-02 20:44:38 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2011-01-02 20:44:38 ----A---- C:\WINDOWS\system32\batt.dll
2011-01-02 20:44:37 ----A---- C:\WINDOWS\NOTEPAD.EXE
2011-01-02 20:44:35 ----A---- C:\WINDOWS\system32\storprop.dll
2011-01-02 20:44:28 ----ASH---- C:\Documents and Settings\All Users\Data aplikací\desktop.ini
2011-01-02 20:42:44 ----RA---- C:\WINDOWS\SET8.tmp
2011-01-02 20:42:42 ----RA---- C:\WINDOWS\SET4.tmp
2011-01-02 20:42:40 ----RA---- C:\WINDOWS\SET3.tmp
2011-01-02 20:42:36 ----D---- C:\WINDOWS\system32\CatRoot2
2011-01-02 20:42:36 ----D---- C:\WINDOWS\system32\CatRoot
2011-01-02 20:42:30 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-01-02 20:42:14 ----A---- C:\WINDOWS\setuplog.txt
2011-01-02 20:42:11 ----D---- C:\Documents and Settings
2011-01-02 20:42:10 ----SHD---- C:\System Volume Information
2011-01-02 20:41:30 ----SH---- C:\boot.ini
2011-01-02 20:38:50 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-01-02 20:38:50 ----RSD---- C:\WINDOWS\Fonts
2011-01-02 20:38:50 ----RD---- C:\WINDOWS\Web
2011-01-02 20:38:50 ----HD---- C:\WINDOWS\inf
2011-01-02 20:38:50 ----D---- C:\WINDOWS\WinSxS
2011-01-02 20:38:50 ----D---- C:\WINDOWS\twain_32
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Temp
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\wins
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\wbem
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\usmt
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\spool
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\ShellExt
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\Setup
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\ras
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\oobe
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\npp
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\mui
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\inetsrv
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\IME
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\icsxml
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\ias
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\export
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\drivers\etc
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\drivers\disdn
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\drivers
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\dhcp
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\cs-cz
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\cs
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\config
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\3com_dmi
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\3076
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\2052
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1054
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1042
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1041
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1037
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1033
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1031
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1029
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1028
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32\1025
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system32
2011-01-02 20:38:50 ----D---- C:\WINDOWS\system
2011-01-02 20:38:50 ----D---- C:\WINDOWS\security
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Resources
2011-01-02 20:38:50 ----D---- C:\WINDOWS\repair
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Provisioning
2011-01-02 20:38:50 ----D---- C:\WINDOWS\pchealth
2011-01-02 20:38:50 ----D---- C:\WINDOWS\PeerNet
2011-01-02 20:38:50 ----D---- C:\WINDOWS\NLDRV
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Network Diagnostic
2011-01-02 20:38:50 ----D---- C:\WINDOWS\mui
2011-01-02 20:38:50 ----D---- C:\WINDOWS\msapps
2011-01-02 20:38:50 ----D---- C:\WINDOWS\msagent
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Media
2011-01-02 20:38:50 ----D---- C:\WINDOWS\L2Schemas
2011-01-02 20:38:50 ----D---- C:\WINDOWS\java
2011-01-02 20:38:50 ----D---- C:\WINDOWS\ime
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Help
2011-01-02 20:38:50 ----D---- C:\WINDOWS\ehome
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Driver Cache
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Debug
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Cursors
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Connection Wizard
2011-01-02 20:38:50 ----D---- C:\WINDOWS\Config
2011-01-02 20:38:50 ----D---- C:\WINDOWS\AppPatch
2011-01-02 20:38:50 ----D---- C:\WINDOWS\addins
2011-01-02 20:38:50 ----D---- C:\WINDOWS
2011-01-02 20:38:49 ----ASH---- C:\pagefile.sys
2011-01-02 20:28:34 ----D---- C:\Program Files\trend micro
2011-01-02 20:28:28 ----D---- C:\rsit
2011-01-02 20:26:33 ----D---- C:\Documents and Settings\Fugass\Data aplikací\PCToolsFirewallPlus
2011-01-02 20:26:11 ----A---- C:\WINDOWS\system32\drivers\PCTCore.sys
2011-01-02 20:26:11 ----A---- C:\WINDOWS\system32\drivers\PCTAppEvent.sys
2011-01-02 20:26:09 ----A---- C:\WINDOWS\system32\drivers\pctgntdi.sys
2011-01-02 20:25:50 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-01-02 20:25:46 ----D---- C:\Program Files\Common Files\PC Tools
2011-01-02 20:25:46 ----A---- C:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys
2011-01-02 20:25:46 ----A---- C:\WINDOWS\system32\drivers\pctNdis-DNS.sys
2011-01-02 20:25:46 ----A---- C:\WINDOWS\system32\drivers\pctNdis.sys
2011-01-02 20:25:44 ----A---- C:\WINDOWS\system32\drivers\pctplfw.sys
2011-01-02 20:25:42 ----D---- C:\Program Files\PC Tools Firewall Plus
2011-01-02 20:20:09 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-01-02 20:20:09 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-01-02 20:20:08 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-01-02 20:20:08 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-01-02 20:20:07 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-01-02 20:20:07 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-01-02 20:20:07 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-01-02 20:19:57 ----SHD---- C:\RECYCLER
2011-01-02 20:19:57 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-01-02 20:19:53 ----D---- C:\Program Files\Alwil Software
2011-01-02 20:19:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2011-01-02 20:19:14 ----D---- C:\Documents and Settings\Fugass\Data aplikací\Mozilla
2011-01-02 20:19:06 ----D---- C:\Program Files\Mozilla Firefox
2011-01-02 20:10:00 ----RA---- C:\WINDOWS\system32\Prounstl.exe
2011-01-02 20:10:00 ----RA---- C:\WINDOWS\system32\IntelNic.dll
2011-01-02 20:10:00 ----RA---- C:\WINDOWS\system32\e100bmsg.dll
2011-01-02 20:10:00 ----RA---- C:\WINDOWS\system32\drivers\e100b325.sys
2011-01-02 20:05:55 ----D---- C:\WINDOWS\LastGood
2011-01-02 20:05:54 ----A---- C:\WINDOWS\system32\drivers\SMBios.sys
2011-01-02 20:05:46 ----D---- C:\TempEI4
2011-01-02 20:02:53 ----D---- C:\Documents and Settings\Fugass\Data aplikací\Identities
2011-01-02 20:02:51 ----HD---- C:\Program Files\Uninstall Information
2011-01-02 20:02:39 ----SD---- C:\Documents and Settings\Fugass\Data aplikací\Microsoft
2011-01-02 20:02:39 ----ASH---- C:\Documents and Settings\Fugass\Data aplikací\desktop.ini
2011-01-02 20:02:38 ----ASH---- C:\hiberfil.sys
2011-01-02 20:02:00 ----D---- C:\WINDOWS\SoftwareDistribution
2011-01-02 20:01:58 ----D---- C:\WINDOWS\Prefetch
2011-01-02 20:01:57 ----SD---- C:\WINDOWS\system32\Microsoft
2011-01-02 20:01:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-01-02 19:58:54 ----D---- C:\WINDOWS\system32\xircom
2011-01-02 19:58:54 ----D---- C:\Program Files\xerox
2011-01-02 19:58:54 ----D---- C:\Program Files\microsoft frontpage
2011-01-02 19:58:28 ----RASH---- C:\MSDOS.SYS
2011-01-02 19:58:28 ----RASH---- C:\IO.SYS
2011-01-02 19:58:28 ----A---- C:\WINDOWS\control.ini
2011-01-02 19:58:28 ----A---- C:\CONFIG.SYS
2011-01-02 19:58:28 ----A---- C:\AUTOEXEC.BAT
2011-01-02 19:58:17 ----A---- C:\WINDOWS\OEWABLog.txt
2011-01-02 19:58:14 ----A---- C:\WINDOWS\system32\mapi32.dll
2011-01-02 19:57:21 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-01-02 19:57:21 ----RD---- C:\WINDOWS\Offline Web Pages
2011-01-02 19:57:21 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2011-01-02 19:57:15 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-01-02 19:57:10 ----HD---- C:\Program Files\WindowsUpdate
2011-01-02 19:57:07 ----D---- C:\Program Files\Online Services
2011-01-02 19:56:53 ----D---- C:\WINDOWS\system32\DirectX
2011-01-02 19:56:49 ----A---- C:\WINDOWS\system32\atrace.dll
2011-01-02 19:56:47 ----A---- C:\WINDOWS\system32\desktop.ini
2011-01-02 19:56:47 ----A---- C:\WINDOWS\desktop.ini
2011-01-02 19:56:41 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2011-01-02 19:56:40 ----D---- C:\Program Files\Common Files\Services
2011-01-02 19:56:40 ----A---- C:\WINDOWS\system32\acctres.dll
2011-01-02 19:56:37 ----SD---- C:\WINDOWS\Tasks
2011-01-02 19:56:37 ----D---- C:\Program Files\Common Files\MSSoap
2011-01-02 19:56:37 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2011-01-02 19:56:34 ----D---- C:\WINDOWS\srchasst
2011-01-02 19:56:33 ----D---- C:\WINDOWS\system32\Macromed
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuweb.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wups.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wucltui.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuauserv.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuaueng.dll
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2011-01-02 19:56:31 ----A---- C:\WINDOWS\system32\wuauclt.exe
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\wuapi.dll
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\qmgr.dll
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2011-01-02 19:56:30 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2011-01-02 19:56:27 ----D---- C:\Program Files\Movie Maker
2011-01-02 19:56:13 ----A---- C:\WINDOWS\system32\safrslv.dll
2011-01-02 19:56:13 ----A---- C:\WINDOWS\system32\safrdm.dll
2011-01-02 19:56:13 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2011-01-02 19:56:13 ----A---- C:\WINDOWS\system32\racpldlg.dll
2011-01-02 19:56:10 ----D---- C:\WINDOWS\system32\Restore
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\srsvc.dll
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\srrstr.dll
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\srclient.dll
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\fltMc.exe
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\fltlib.dll
2011-01-02 19:56:10 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\mnmdd.dll
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\ils.dll
2011-01-02 19:56:09 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2011-01-02 19:56:08 ----A---- C:\WINDOWS\system32\msconf.dll
2011-01-02 19:56:07 ----D---- C:\Program Files\NetMeeting
2011-01-02 19:56:06 ----A---- C:\WINDOWS\system32\msoert2.dll
2011-01-02 19:56:06 ----A---- C:\WINDOWS\system32\msoeacct.dll
2011-01-02 19:56:06 ----A---- C:\WINDOWS\system32\inetres.dll
2011-01-02 19:56:06 ----A---- C:\WINDOWS\system32\inetcomm.dll
2011-01-02 19:56:04 ----D---- C:\Program Files\Outlook Express
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\schedsvc.dll
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\mstinit.exe
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\mstask.dll
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\isign32.dll
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\icwphbk.dll
2011-01-02 19:56:04 ----A---- C:\WINDOWS\system32\icwdial.dll
2011-01-02 19:56:03 ----A---- C:\WINDOWS\system32\inetcfg.dll
2011-01-02 19:55:59 ----D---- C:\Program Files\Common Files\System
2011-01-02 19:55:57 ----D---- C:\Program Files\Internet Explorer
2011-01-02 19:55:18 ----D---- C:\Program Files\ComPlus Applications
2011-01-02 19:55:16 ----A---- C:\WINDOWS\vbaddin.ini
2011-01-02 19:55:16 ----A---- C:\WINDOWS\vb.ini
2011-01-02 19:55:12 ----D---- C:\WINDOWS\Registration
2011-01-02 19:55:05 ----D---- C:\Program Files\Windows Media Player
2011-01-02 19:54:58 ----D---- C:\Program Files\Messenger
2011-01-02 19:54:56 ----D---- C:\Program Files\MSN Gaming Zone
2011-01-02 19:54:56 ----A---- C:\WINDOWS\system32\write.exe
2011-01-02 19:54:48 ----A---- C:\WINDOWS\system32\sndvol32.exe
2011-01-02 19:54:48 ----A---- C:\WINDOWS\system32\hticons.dll
2011-01-02 19:54:48 ----A---- C:\WINDOWS\system32\avwav.dll
2011-01-02 19:54:48 ----A---- C:\WINDOWS\system32\avtapi.dll
2011-01-02 19:54:48 ----A---- C:\WINDOWS\system32\avmeter.dll
2011-01-02 19:54:47 ----A---- C:\WINDOWS\system32\winchat.exe
2011-01-02 19:54:42 ----A---- C:\WINDOWS\system32\charmap.exe
2011-01-02 19:54:42 ----A---- C:\WINDOWS\system32\getuname.dll
2011-01-02 19:54:42 ----A---- C:\WINDOWS\system32\calc.exe
2011-01-02 19:54:41 ----A---- C:\WINDOWS\system32\winmine.exe
2011-01-02 19:54:41 ----A---- C:\WINDOWS\system32\sol.exe
2011-01-02 19:54:41 ----A---- C:\WINDOWS\system32\reset.exe
2011-01-02 19:54:41 ----A---- C:\WINDOWS\system32\mshearts.exe
2011-01-02 19:54:41 ----A---- C:\WINDOWS\system32\freecell.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\tslabels.ini
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\tskill.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\tscon.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\shadow.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\rwinsta.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\regini.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\qwinsta.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\qappsrv.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\msg.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\logoff.exe
2011-01-02 19:54:40 ----A---- C:\WINDOWS\system32\cdmodem.dll
2011-01-02 19:54:39 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2011-01-02 19:54:35 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2011-01-02 19:54:34 ----A---- C:\WINDOWS\system32\sndrec32.exe
2011-01-02 19:54:34 ----A---- C:\WINDOWS\system32\mplay32.exe
2011-01-02 19:54:34 ----A---- C:\WINDOWS\system32\hypertrm.dll
2011-01-02 19:54:34 ----A---- C:\WINDOWS\system32\accwiz.exe
2011-01-02 19:54:33 ----D---- C:\Program Files\Windows NT
2011-01-02 19:54:33 ----A---- C:\WINDOWS\system32\spider.exe
2011-01-02 19:54:33 ----A---- C:\WINDOWS\system32\mspaint.exe
2011-01-02 19:54:33 ----A---- C:\WINDOWS\system32\clipbrd.exe
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\tsgqec.dll
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2011-01-02 19:54:32 ----A---- C:\WINDOWS\system32\aaclient.dll
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\sessmgr.exe
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\remotepg.dll
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\rdshost.exe
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\rdchost.dll
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\mstscax.dll
2011-01-02 19:54:31 ----A---- C:\WINDOWS\system32\mstsc.exe
2011-01-02 19:54:30 ----D---- C:\WINDOWS\system32\MsDtc
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\termsrv.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\rdpclip.exe
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\qprocess.exe
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\mtxoci.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\icaapi.dll
2011-01-02 19:54:30 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2011-01-02 19:54:29 ----A---- C:\WINDOWS\system32\xolehlp.dll
2011-01-02 19:54:29 ----A---- C:\WINDOWS\system32\msdtctm.dll
2011-01-02 19:54:29 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2011-01-02 19:54:29 ----A---- C:\WINDOWS\system32\msdtclog.dll
2011-01-02 19:54:29 ----A---- C:\WINDOWS\system32\msdtc.exe
2011-01-02 19:54:28 ----D---- C:\WINDOWS\system32\Com
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\stclient.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\mtxex.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\mtxdm.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\comrepl.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\comaddin.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\colbact.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\clbcatex.dll
2011-01-02 19:54:28 ----A---- C:\WINDOWS\system32\catsrvps.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\comuid.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\comsvcs.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\comsnap.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\clbcatq.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\catsrvut.dll
2011-01-02 19:54:27 ----A---- C:\WINDOWS\system32\catsrv.dll
2011-01-02 19:54:22 ----A---- C:\WINDOWS\system32\servdeps.dll
2011-01-02 19:54:22 ----A---- C:\WINDOWS\system32\mmfutil.dll
2011-01-02 19:54:22 ----A---- C:\WINDOWS\system32\licwmi.dll
2011-01-02 19:54:22 ----A---- C:\WINDOWS\system32\cmprops.dll
2011-01-02 19:54:18 ----A---- C:\WINDOWS\system32\drivers\termdd.sys
2011-01-02 19:54:18 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys

======List of files/folders modified in the last 1 months======

2011-01-02 20:44:56 ----A---- C:\WINDOWS\system.ini
2011-01-02 19:58:28 ----A---- C:\WINDOWS\win.ini
2011-01-02 19:58:00 ----ASH---- C:\WINDOWS\fonts\desktop.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI VIA; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-12-31 29264]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-12-31 23632]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-12-31 293968]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-12-31 47440]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 pctgntdi;pctgntdi; \??\C:\WINDOWS\system32\drivers\pctgntdi.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-12-31 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-12-31 100176]
R2 PCTAppEvent;PCTAppEvent Driver; \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys []
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2003-03-04 145408]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-04-13 1897408]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver; \??\C:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys []
R3 pctNdisMP;PC Tools Driver; C:\WINDOWS\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]
R3 pctplfw;pctplfw; \??\C:\WINDOWS\system32\drivers\pctplfw.sys []
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]
R3 SMBios;Intel (R) System Managment BIOS Service; C:\WINDOWS\system32\DRIVERS\SMBios.sys [2003-06-17 35012]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-04-14 272896]
S3 pctNdis;PC Tools Firewall Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-12-31 40384]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 PCToolsFirewallPlus;PC Tools Firewall Plus; C:\Program Files\PC Tools Firewall Plus\FWService.exe [2010-11-17 287024]

-----------------EOF-----------------

[Caroprd111]

Připojte do PC všechna vyměnitelná zařízení a pokračujte podle návodu: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

[Fugass]

Automatická kontrola: dokončeno před 12 min. (události: 49, objekty: 212192, čas: 01:27:54)
2.1.2011 21:26:03 Úloha byla spuštěna
2.1.2011 21:35:19 Zjištěno: Virus.Win32.Virut.ce E:\ScantoolMode22.exe
2.1.2011 21:35:19 Zjištěno: Virus.Win32.Virut.ce E:\wOBD.exe
2.1.2011 21:35:25 Dezinfikováno: Virus.Win32.Virut.ce E:\ScantoolMode22.exe
2.1.2011 21:35:25 Dezinfikováno: Virus.Win32.Virut.ce E:\wOBD.exe
2.1.2011 21:35:25 Dezinfikováno: Virus.Win32.Virut.ce E:\wOBD.exe
2.1.2011 21:35:25 Dezinfikováno: Virus.Win32.Virut.ce E:\ScantoolMode22.exe
2.1.2011 21:36:37 Zjištěno: Backdoor.Win32.Banito.plugin.aq E:\Disk_G\Auto\AUTO2\FIAT STILO by VISTEON.exe
2.1.2011 21:37:11 Odstraněno: Backdoor.Win32.Banito.plugin.aq E:\Disk_G\Auto\AUTO2\FIAT STILO by VISTEON.exe
2.1.2011 21:42:33 Zjištěno: not-a-virus:AdWare.Win32.Dm.be E:\Disk_G\Auto\Autodata\cd2\2.17 cd2.iso/autorun.exe;1
2.1.2011 21:42:33 Neošetřeno: not-a-virus:AdWare.Win32.Dm.be E:\Disk_G\Auto\Autodata\cd2\2.17 cd2.iso/autorun.exe;1 Zápis není podporován
2.1.2011 21:47:03 Zjištěno: not-a-virus:AdWare.Win32.Dm.be E:\Disk_G\Auto\Autodata\cd2\2.17 cd2.part1.rar/2.17 cd2.iso/autorun.exe;1
2.1.2011 21:47:03 Neošetřeno: not-a-virus:AdWare.Win32.Dm.be E:\Disk_G\Auto\Autodata\cd2\2.17 cd2.part1.rar/2.17 cd2.iso/autorun.exe;1 Zápis není podporován
2.1.2011 21:51:47 Zjištěno: Virus.Win32.Virut.ce E:\Disk_G\Autoradia\Programy\icprog101work\icprog.exe
2.1.2011 21:51:57 Zjištěno: Backdoor.Win32.Banito.plugin.aq E:\Disk_G\Autoradia\Rádia\fiat.zip/FIAT_serial_number.exe
2.1.2011 21:51:59 Odstraněno: Backdoor.Win32.Banito.plugin.aq E:\Disk_G\Autoradia\Rádia\fiat.zip/FIAT_serial_number.exe
2.1.2011 21:51:59 Dezinfikováno: Virus.Win32.Virut.ce E:\Disk_G\Autoradia\Programy\icprog101work\icprog.exe
2.1.2011 21:52:00 Dezinfikováno: Virus.Win32.Virut.ce E:\Disk_G\Autoradia\Programy\icprog101work\icprog.exe
2.1.2011 21:54:43 Zjištěno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++.exe/UPX
2.1.2011 21:54:53 Zjištěno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++2.0.rar/XS++.exe/UPX
2.1.2011 21:54:53 Neošetřeno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++2.0.rar/XS++.exe/UPX Zápis není podporován
2.1.2011 21:55:05 Zjištěno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++2.0.rar/XS++.exe
2.1.2011 21:55:05 Neošetřeno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++2.0.rar/XS++.exe Zápis není podporován
2.1.2011 21:55:47 Zjištěno: HEUR:Trojan.Win32.Generic E:\Disk_G\Content 2\SEW580i\XS++.exe
2.1.2011 22:07:22 Zjištěno: MultiPacked.Multi.Generic E:\Kia\OBDtester.rar/OBDTester.exe
2.1.2011 22:07:22 Neošetřeno: MultiPacked.Multi.Generic E:\Kia\OBDtester.rar/OBDTester.exe Zápis není podporován
2.1.2011 22:07:28 Zjištěno: MultiPacked.Multi.Generic E:\Kia\AutoDiag\OBDtester.rar/OBDTester.exe
2.1.2011 22:07:28 Neošetřeno: MultiPacked.Multi.Generic E:\Kia\AutoDiag\OBDtester.rar/OBDTester.exe Zápis není podporován
2.1.2011 22:14:47 Zjištěno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022808.exe/WISE0021.BIN/dapiebar.dll
2.1.2011 22:15:15 Odstraněno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022808.exe
2.1.2011 22:15:30 Zjištěno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022809.exe/WISE0021.BIN/dapiebar.dll
2.1.2011 22:15:33 Zjištěno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022810.exe/WISE0021.BIN/dapiebar.dll
2.1.2011 22:15:49 Odstraněno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022810.exe
2.1.2011 22:15:59 Odstraněno: not-a-virus:AdWare.Win32.Dap.c E:\System Volume Information\_restore{497720A7-38F2-4306-B41D-98904A41D49D}\RP83\A0022809.exe
2.1.2011 22:25:49 Zjištěno: Backdoor.Win32.Bifrose.aca E:\System Volume Information\_restore{E029E141-8727-409B-9755-678E74FAEADB}\RP221\A0046971.EXE/data0000.cab/cr-n6601.exe
2.1.2011 22:26:16 Odstraněno: Backdoor.Win32.Bifrose.aca E:\System Volume Information\_restore{E029E141-8727-409B-9755-678E74FAEADB}\RP221\A0046971.EXE
2.1.2011 22:31:57 Zjištěno: Trojan.Win32.Agent.blfs J:\Torrent download\ALL Car Radio CalculatorS\Daewoo Serials Calculator 1.0.exe
2.1.2011 22:31:57 Zjištěno: Trojan.Win32.Agent.blfs J:\Torrent download\ALL Car Radio CalculatorS\Daewoo Serials Calculator 1.00.exe
2.1.2011 22:32:13 Zjištěno: Trojan-Spy.Win32.Webmoner.ako J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe/Dump Calcs\GRUNDIG\GRUNDIG WKC Series Code Calculator 2.00 DEALZ4WHEELZ.exe
2.1.2011 22:32:16 Odstraněno: Trojan.Win32.Agent.blfs J:\Torrent download\ALL Car Radio CalculatorS\Daewoo Serials Calculator 1.0.exe
2.1.2011 22:32:17 Odstraněno: Trojan.Win32.Agent.blfs J:\Torrent download\ALL Car Radio CalculatorS\Daewoo Serials Calculator 1.00.exe
2.1.2011 22:32:22 Zjištěno: Trojan.Win32.Agent.djpe J:\Torrent download\ALL Car Radio CalculatorS\More Becker\Becker9preset.exe
2.1.2011 22:32:24 Zjištěno: Trojan-Spy.Win32.Webmoner.asc J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe/Dump Calcs\GRUNDIG\GRUNDIG WKC Series Code Calculator 3.10 DEALZ4WHEELZ.exe
2.1.2011 22:32:24 Odstraněno: Trojan.Win32.Agent.djpe J:\Torrent download\ALL Car Radio CalculatorS\More Becker\Becker9preset.exe
2.1.2011 22:32:30 Zjištěno: Trojan.Win32.Agent.djpe J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe/Serial Calcs\BECKER\Becker5digit.exe
2.1.2011 22:33:14 Zjištěno: Trojan.Win32.Agent.blfs J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe/Serial Calcs\Daewoo\DAEWOO Serials Calculator 1.00 DEALZ4WHEELZ.exe
2.1.2011 22:33:17 Zjištěno: Backdoor.Win32.Delf.nuu J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe/Serial Calcs\FORD\FORD SOUND 2000 Series Code Decrypter 1.01 DEALZ4WHEELZ.exe
2.1.2011 22:33:42 Odstraněno: Backdoor.Win32.Delf.nuu J:\Torrent download\ALL Car Radio CalculatorS\Decoder Pro 2.exe
2.1.2011 22:53:58 Úloha byla dokončena