plocha zmodrela a nejde sustat vacsinu exe suborov pretoze "su infikovane", typ havede co chce odomna prachy na to aby bolo vsetko v poriadku, radsej som sa do toho nepustal sam lebo s tymto nemam moc skusenosti, verim ze mi s tym pomozete
prikladam log:info.txt logfile of random's system information tool 1.08 2011-02-12 13:51:10
======Uninstall list======
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A93000000001}
Ask Toolbar-->MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}
AVG Free 9.0-->C:\Program Files\AVG\AVG9\setup.exe /UNINSTALL
Babylon toolbar-->"C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.15.10\uninstall.exe"
Babylon-->C:\Program Files\Babylon\Babylon-Pro\Utils\uninstbb.exe
Conduit Engine-->C:\PROGRA~1\CONDUI~1\ConduitEngineUninstall.exe
Counter-Strike: Source-->C:\Program Files\Counter-Strike Source\Uninst.exe
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
DivX Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
EAX4 Unified Redist-->MsiExec.exe /X{89661B04-C646-4412-B6D3-5E19F02F1F37}
Express Gate-->MsiExec.exe /X{99AD9D6D-A456-49EE-8360-F22EE7AA1272}
Google Earth-->MsiExec.exe /X{4286E640-B5FB-11DF-AC4B-005056C00008}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_4079369A224CB572.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
GTA San Andreas-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly
Kobra 11 Nitro-->"C:\Program Files\Kobra 11 Nitro\unins000.exe"
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Corporation-->MsiExec.exe /I{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}
Microsoft LifeCam-->MsiExec.exe /X{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011041B-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
MIKULÁŠ-->"C:\Program Files\Play\MIKULÁŠ\unins000.exe"
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Need for Speed Underground 2-->C:\Program Files\EA GAMES\Need for Speed Underground 2\EAUninstall.exe
Neighbours From Hell Compilation-->C:\Program Files\InstallShield Installation Information\{5C81E5B5-15C0-4196-8FEC-BE56FFAB9437}\setup.exe -runfromtemp -l0x0405
Nero BurnLite 10-->MsiExec.exe /I{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}
Nero BurnLite 10-->MsiExec.exe /X{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}
Nero Control Center 10-->MsiExec.exe /X{6DFB899F-17A2-48F0-A533-ED8D6866CF38}
Nero ControlCenter 10 Help (CHM)-->MsiExec.exe /X{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}
Nero Core Components 10-->MsiExec.exe /X{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}
Nero Update-->MsiExec.exe /X{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}
Norton Security Scan-->C:\Program Files\Norton Security Scan\Engine\3.0.1.8\InstWrap.exe
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
PhotoScape-->"C:\Users\Rasto\Desktop\photoscape\uninstall.exe"
PVSonyDll-->MsiExec.exe /I{3D3E663D-4E7E-4577-A560-7ECDDD45548A}
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SmileyCentral-->rundll32 C:\PROGRA~1\SMILEY~2\bar\1.bin\1wBar.dll,O
Softonic-Eng7 Toolbar-->C:\PROGRA~1\SOFTON~1\UNWISE.EXE /U C:\PROGRA~1\SOFTON~1\INSTALL.LOG
TeamViewer 5-->C:\Program Files\TeamViewer\Version5\uninstall.exe
Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Včielka Ula-->"C:\Program Files\Včielka Ula\Uninstall.exe" "C:\Program Files\Včielka Ula\install.log"
VIA Platform Device Manager-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
WinRAR 4.00 beta 3 (32-bit)-->D:\Program Files\WinRAR\uninstall.exe
======System event log======
Computer Name: Rasto-PC
Event Code: 11
Message: Načítavajú sa vlastné knižnice dynamických prepojení pre všetky aplikácie. Správca systému by mal skontrolovať zoznam knižníc a zistiť, či patria dôveryhodným aplikáciám.
Record Number: 125580
Source Name: Microsoft-Windows-Wininit
Time Written: 20100820051618.599644-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Rasto-PC
Event Code: 875
Message: Driver sfdrv01.sys has been blocked from loading.
Record Number: 125527
Source Name: Application Popup
Time Written: 20100820051558.148808-000
Event Type: Error
User:
Computer Name: Rasto-PC
Event Code: 875
Message: Driver sfvfs02.sys has been blocked from loading.
Record Number: 125526
Source Name: Application Popup
Time Written: 20100820051558.148808-000
Event Type: Error
User:
Computer Name: Rasto-PC
Event Code: 875
Message: Driver sfsync02.sys has been blocked from loading.
Record Number: 125524
Source Name: Application Popup
Time Written: 20100820051555.590403-000
Event Type: Error
User:
Computer Name: Rasto-PC
Event Code: 7016
Message: Služba NVIDIA Display Driver Service oznámila neplatný aktuálny stav 32.
Record Number: 125499
Source Name: Service Control Manager
Time Written: 20100819210431.341108-000
Event Type: Error
User:
=====Application event log=====
Computer Name: Rasto-PC
Event Code: 3006
Message: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.
Record Number: 10797
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100228171736.280345-000
Event Type: Error
User: NT AUTHORITY\SYSTEM
Computer Name: Rasto-PC
Event Code: 1
Message: The application (StarForce Protection, from vendor StarForce) has the following problem: The installed StarForce Protection driver is not compatible with this version of Windows and will be disabled. Applications that require this driver will not function properly without a patch.
Record Number: 10783
Source Name: Microsoft-Windows-ApplicationExperienceInfrastructure
Time Written: 20100228171141.320026-000
Event Type: Warning
User: Rasto-PC\Rasto
Computer Name: Rasto-PC
Event Code: 1
Message: The application (StarForce Protection, from vendor StarForce) has the following problem: The installed StarForce Protection driver is not compatible with this version of Windows and will be disabled. Applications that require this driver will not function properly without a patch.
Record Number: 10782
Source Name: Microsoft-Windows-ApplicationExperienceInfrastructure
Time Written: 20100228171141.320026-000
Event Type: Warning
User: Rasto-PC\Rasto
Computer Name: Rasto-PC
Event Code: 1
Message: The application (StarForce Protection, from vendor StarForce) has the following problem: The installed StarForce Protection driver is not compatible with this version of Windows and will be disabled. Applications that require this driver will not function properly without a patch.
Record Number: 10781
Source Name: Microsoft-Windows-ApplicationExperienceInfrastructure
Time Written: 20100228171141.320026-000
Event Type: Warning
User: Rasto-PC\Rasto
Computer Name: Rasto-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
15 user registry handles leaked from \Registry\User\S-1-5-21-4054158674-678169352-3695139878-1000:
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\Disallowed
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\TrustedPeople
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\trust
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\Root
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\My
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\CA
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Policies\Microsoft\SystemCertificates
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Policies\Microsoft\SystemCertificates
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Policies\Microsoft\SystemCertificates
Process 1252 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4054158674-678169352-3695139878-1000\Software\Policies\Microsoft\SystemCertificates
Record Number: 10770
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20100228164633.855993-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
=====Security event log=====
Computer Name: Rasto-PC
Event Code: 4672
Message: Special privileges assigned to new logon.
Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 8073
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100217080453.034430-000
Event Type: Audit Success
User:
Computer Name: Rasto-PC
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: RASTO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon Type: 5
New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x21c
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 8072
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100217080453.034430-000
Event Type: Audit Success
User:
Computer Name: Rasto-PC
Event Code: 4672
Message: Special privileges assigned to new logon.
Subject:
Security ID: S-1-5-21-4054158674-678169352-3695139878-1000
Account Name: Rasto
Account Domain: Rasto-PC
Logon ID: 0x17287
Privileges: SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 8071
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100217080452.675630-000
Event Type: Audit Success
User:
Computer Name: Rasto-PC
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: RASTO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon Type: 2
New Logon:
Security ID: S-1-5-21-4054158674-678169352-3695139878-1000
Account Name: Rasto
Account Domain: Rasto-PC
Logon ID: 0x172b0
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x2bc
Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Workstation Name: RASTO-PC
Source Network Address: 127.0.0.1
Source Port: 0
Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 8070
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100217080452.675630-000
Event Type: Audit Success
User:
Computer Name: Rasto-PC
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: RASTO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon Type: 2
New Logon:
Security ID: S-1-5-21-4054158674-678169352-3695139878-1000
Account Name: Rasto
Account Domain: Rasto-PC
Logon ID: 0x17287
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x2bc
Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Workstation Name: RASTO-PC
Source Network Address: 127.0.0.1
Source Port: 0
Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 8069
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100217080452.675630-000
Event Type: Audit Success
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=4
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"SAFEBOOT_OPTION"=NETWORK
-----------------EOF-----------------
dakujem
Přispějete na provoz fóra?