Problém s csrss.exe

[dantos]

Log z OTL:

OTL logfile created on: 11.8.2011 20:25:47 - Run 3
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Acer\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000405 | Country: Czech Republic | Language: CSY | Date Format: d.M.yyyy

2,99 Gb Total Physical Memory | 1,87 Gb Available Physical Memory | 62,42% Memory free
6,19 Gb Paging File | 5,14 Gb Available in Paging File | 83,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,32 Gb Total Space | 181,21 Gb Free Space | 62,85% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: Acer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.08.11 20:23:56 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.scr
PRC - [2011.08.11 18:26:04 | 000,204,800 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Users\Acer\AppData\Local\temp\RtkBtMnt.exe
PRC - [2011.06.27 09:23:56 | 000,161,336 | ---- | M] (Google) -- C:\Users\Acer\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2011.06.24 17:27:44 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.04.18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011.04.14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2009.12.08 20:26:15 | 003,616,768 | ---- | M] (Native Instruments GmbH) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.02.19 22:22:44 | 000,707,104 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
PRC - [2009.02.19 18:32:36 | 000,666,144 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
PRC - [2009.02.19 05:42:48 | 000,866,824 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe
PRC - [2008.12.18 15:51:34 | 000,075,048 | ---- | M] () -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
PRC - [2008.07.29 20:29:26 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2008.03.18 21:27:12 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe


========== Modules (SafeList) ==========

MOD - [2011.08.11 20:23:56 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.scr
MOD - [2009.04.11 08:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2009.02.19 18:32:54 | 000,215,584 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\SysHook.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (NTI IScheduleSvc)
SRV - File not found [On_Demand | Stopped] -- -- (McSysmon)
SRV - File not found [Unknown | Stopped] -- -- (McShield)
SRV - File not found [Disabled | Stopped] -- -- (gusvc)
SRV - [2011.07.26 10:16:02 | 001,025,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2009.12.08 20:26:15 | 003,616,768 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService)
SRV - [2009.02.19 18:32:36 | 000,666,144 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2008.12.18 15:51:34 | 000,075,048 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService)
SRV - [2008.03.18 21:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.02.22 08:12:38 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2009.10.08 13:59:33 | 000,035,280 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\a2djavs.sys -- (a2djavs)
DRV - [2009.10.08 13:59:29 | 000,276,304 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\a2djusb.sys -- (a2djusb)
DRV - [2008.12.26 18:31:30 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/04/08 07:50:06] [Kernel | Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2008.12.17 01:03:00 | 007,542,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.09.25 17:37:40 | 003,666,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008.09.25 15:39:48 | 000,045,600 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.09.04 06:12:56 | 000,223,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2008.06.17 18:47:28 | 000,365,568 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjifu.sys -- (RL_DJIF)
DRV - [2008.06.17 18:41:00 | 000,034,304 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjifa.sys -- (RL_DJIF_WDM)
DRV - [2008.06.17 18:41:00 | 000,020,992 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjifm.sys -- (RL_DJIFM)
DRV - [2008.03.01 01:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... spire_5738


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50465

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.cz/"
FF - prefs.js..extensions.enabledItems: {4176DFF4-4698-11DE-BEEB-45DA55D89593}:0.8.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4e43fb79 ... &lng=cs&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50465
FF - prefs.js..network.proxy.type: 4

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Acer\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Acer\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011.08.09 09:10:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011.08.11 17:55:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.07.30 12:22:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.07.30 12:22:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.07.30 12:22:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

[2011.05.11 23:23:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\Mozilla\Extensions
[2011.05.11 23:23:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.03.20 00:38:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\Mozilla\Extensions\pencil@evolus.vn
[2011.08.06 20:18:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\ldrp7j8f.default\extensions
[2010.04.28 20:16:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\ldrp7j8f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.30 00:39:43 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\ldrp7j8f.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.23 22:39:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.05.06 21:42:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011.06.23 22:39:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.06.23 22:20:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
[2011.08.09 09:10:18 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011.06.24 17:27:45 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,002,208 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\heureka-cz.xml
[2010.01.01 10:00:00 | 000,000,638 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\jyxo-cz.xml
[2010.01.01 10:00:00 | 000,001,367 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\seznam-cz.xml
[2010.01.01 10:00:00 | 000,000,654 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\slunecnice-cz.xml
[2010.01.01 10:00:00 | 000,001,179 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2011.08.11 18:16:22 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TBSB08223 Class) - {0753D5E7-BCDF-4BAE-85EC-431B17D3BE72} - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll ()
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Toolbar for eBay) - {427AB608-62F1-48D1-84D4-50C6358B7268} - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\..\Toolbar\WebBrowser: (Toolbar for eBay) - {427AB608-62F1-48D1-84D4-50C6358B7268} - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll ()
O3 - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2808683438-737575968-2950562706-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.46.172.36 213.46.172.37
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Acer\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta galerie Windows Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Acer\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta galerie Windows Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 30 Days ==========

[2011.08.11 19:48:54 | 000,000,000 | ---D | C] -- C:\Users\Acer\Desktop\QTTabBar_glb_1.1
[2011.08.11 18:21:36 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\AVG Security Toolbar
[2011.08.11 18:19:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011.08.11 18:19:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011.08.11 18:19:10 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\temp
[2011.08.11 18:06:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011.08.11 18:06:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011.08.11 18:06:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011.08.11 18:06:35 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.08.11 18:06:34 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011.08.11 18:06:28 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.08.11 17:55:37 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar
[2011.08.11 17:49:26 | 004,170,012 | R--- | C] (Swearware) -- C:\Users\Acer\Desktop\ComboFix.exe
[2011.08.07 01:07:21 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011.08.07 00:19:41 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.scr
[2011.08.07 00:00:36 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011.08.07 00:00:35 | 000,000,000 | ---D | C] -- C:\rsit
[2011.08.06 23:31:34 | 000,000,000 | ---D | C] -- C:\Users\Acer\Desktop\backups
[2011.08.05 23:32:59 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011.08.05 22:23:56 | 000,000,000 | ---D | C] -- C:\$AVG
[2011.08.05 21:50:00 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\AVG10
[2011.08.05 21:49:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011.08.05 21:48:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011.08.05 21:47:32 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10
[2011.08.05 21:47:32 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[2011.08.05 21:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011.08.05 21:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011.08.05 19:19:34 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\SPORTOVNI WEBY
[2011.07.30 20:46:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.07.30 12:22:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.07.30 12:22:17 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011.07.30 12:22:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.07.24 10:17:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2011.07.24 10:16:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2009.04.08 16:33:03 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll

========== Files - Modified Within 30 Days ==========

[2011.08.11 20:26:29 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2011.08.11 20:25:55 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.11 20:25:55 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.11 20:23:56 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.scr
[2011.08.11 20:22:12 | 000,000,000 | ---- | M] () -- C:\Users\Acer\AppData\Local\prvlcl.dat
[2011.08.11 19:48:34 | 000,646,140 | ---- | M] () -- C:\Users\Acer\Desktop\QTTabBar_glb_1.1.zip
[2011.08.11 19:33:00 | 000,000,958 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000UA.job
[2011.08.11 18:32:01 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.11 18:32:01 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.11 18:26:08 | 000,089,096 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.08.11 18:26:08 | 000,089,096 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.08.11 18:25:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.11 18:25:35 | 3215,794,176 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.11 18:16:22 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011.08.11 18:03:34 | 237,087,944 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.08.11 17:49:40 | 004,170,012 | R--- | M] (Swearware) -- C:\Users\Acer\Desktop\ComboFix.exe
[2011.08.11 17:40:54 | 000,002,697 | ---- | M] () -- C:\Users\Acer\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk
[2011.08.11 17:37:51 | 000,017,441 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\FAE2.C9D
[2011.08.11 16:58:06 | 127,668,256 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.08.09 21:36:51 | 000,436,509 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110809-214739.backup
[2011.08.09 10:33:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000Core.job
[2011.08.09 09:10:19 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.08.08 15:29:27 | 000,042,496 | ---- | M] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.07 11:01:53 | 000,002,395 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.08.07 00:00:24 | 000,781,383 | ---- | M] () -- C:\Users\Acer\Desktop\RSIT.exe
[2011.08.06 20:41:39 | 000,436,469 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110809-213651.backup
[2011.08.06 12:26:33 | 000,008,268 | ---- | M] () -- C:\Users\Acer\AppData\Local\d3d9caps.dat
[2011.08.01 19:51:22 | 000,001,699 | ---- | M] () -- C:\Users\Acer\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2011.08.01 19:51:15 | 000,001,699 | ---- | M] () -- C:\Users\Acer\Desktop\Notepad.lnk
[2011.07.30 12:22:35 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.07.23 22:45:33 | 000,002,653 | ---- | M] () -- C:\Users\Acer\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk

========== Files Created - No Company Name ==========

[2011.08.11 19:48:33 | 000,646,140 | ---- | C] () -- C:\Users\Acer\Desktop\QTTabBar_glb_1.1.zip
[2011.08.11 18:06:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011.08.11 18:06:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011.08.11 18:06:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.08.11 18:06:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.08.11 18:06:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.08.11 18:03:34 | 237,087,944 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.08.11 16:58:06 | 127,668,256 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.08.07 00:22:22 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2011.08.07 00:00:20 | 000,781,383 | ---- | C] () -- C:\Users\Acer\Desktop\RSIT.exe
[2011.08.06 20:42:31 | 000,000,000 | ---- | C] () -- C:\Users\Acer\AppData\Local\prvlcl.dat
[2011.08.06 20:33:24 | 3215,794,176 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.05 21:48:31 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.08.05 21:00:55 | 000,017,441 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\FAE2.C9D
[2011.08.01 19:51:22 | 000,001,699 | ---- | C] () -- C:\Users\Acer\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2011.08.01 19:51:15 | 000,001,699 | ---- | C] () -- C:\Users\Acer\Desktop\Notepad.lnk
[2011.07.30 12:22:35 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.07.14 23:22:58 | 000,000,958 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000UA.job
[2011.07.14 23:22:56 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000Core.job
[2011.06.30 19:19:56 | 000,000,375 | ---- | C] () -- C:\Windows\System32\CNCMFP38.INI
[2011.05.11 23:23:45 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.04.30 00:46:37 | 000,000,048 | ---- | C] () -- C:\Windows\picture2avi.ini
[2010.11.17 21:53:35 | 000,000,384 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.06.09 21:52:27 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010.05.22 01:06:55 | 000,000,668 | ---- | C] () -- C:\Windows\Mp3ACutjoin.ini
[2010.05.22 00:54:54 | 000,000,005 | ---- | C] () -- C:\Windows\System32\SySMACJ.dat
[2010.02.19 18:25:42 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.10.27 00:55:07 | 000,042,496 | ---- | C] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.26 19:25:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.26 19:25:16 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.06 22:04:02 | 000,008,268 | ---- | C] () -- C:\Users\Acer\AppData\Local\d3d9caps.dat
[2009.09.06 11:23:09 | 000,089,096 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.03 23:57:22 | 000,089,096 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.04.08 08:50:35 | 000,000,033 | ---- | C] () -- C:\Windows\LaunApp.ini
[2009.04.08 08:43:02 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009.04.08 08:43:02 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009.04.08 08:43:02 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009.04.08 08:43:02 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2009.04.08 08:42:03 | 000,090,772 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT
[2009.04.08 08:42:03 | 000,000,536 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2009.04.08 08:42:03 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009.02.18 20:48:55 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2009.02.18 13:20:22 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.02.11 22:03:58 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2009.02.11 22:03:58 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2009.02.11 22:03:57 | 000,000,057 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,400,544 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011.05.05 20:47:33 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Ableton
[2009.02.18 14:08:05 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Acer GameZone Console
[2011.08.05 21:50:00 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\AVG10
[2009.09.23 21:16:09 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\BeatportDownloader.EE670286545758FAB4A69D4439CF6054F83E0AC2.1
[2011.04.30 00:40:12 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoft
[2011.04.30 00:39:42 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.01 14:26:51 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\ESET
[2009.09.07 21:17:57 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\eSobi
[2010.10.15 19:54:34 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\GTCO CalComp
[2009.10.26 20:40:01 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\ICQ
[2011.03.11 16:09:13 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\klavaro
[2010.05.22 00:44:46 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Meda MP3 Splitter Gold 4.2
[2009.10.31 20:12:38 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\OpenOffice.org
[2010.03.20 00:38:55 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Pencil
[2009.09.22 22:34:29 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\PowerCinema
[2009.09.22 22:11:14 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\SoftDMA
[2011.05.11 23:23:44 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Thunderbird
[2009.09.27 23:49:01 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Toolbars
[2011.08.11 18:24:33 | 000,032,622 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >

< >


< MD5 for: AGP440.SYS >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] (Microsoft Corporation) MD5=10761177A6EBE45843F443E99509F5E7 -- C:\Windows\System32\autochk.exe
[2009.04.11 08:27:20 | 000,643,072 | ---- | M] (Microsoft Corporation) MD5=10761177A6EBE45843F443E99509F5E7 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6002.18005_none_e3df6655bee2ee3b\autochk.exe
[2008.01.21 04:24:45 | 000,642,560 | ---- | M] (Microsoft Corporation) MD5=2FC5BE79B51714B479809358E4908FC3 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe

< MD5 for: CDROM.SYS >
[2008.01.21 04:23:02 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=1EC25CEA0DE6AC4718BF89F9E1778B57 -- C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_a29e71c6\cdrom.sys
[2008.01.21 04:23:02 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=1EC25CEA0DE6AC4718BF89F9E1778B57 -- C:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.0.6001.18000_none_5fa95be2a3c76a4a\cdrom.sys
[2009.04.11 06:39:17 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=6B4BFFB9BECD728097024276430DB314 -- C:\Windows\System32\drivers\cdrom.sys
[2009.04.11 06:39:17 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=6B4BFFB9BECD728097024276430DB314 -- C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_c949a5b6\cdrom.sys
[2009.04.11 06:39:17 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=6B4BFFB9BECD728097024276430DB314 -- C:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.0.6002.18005_none_6194d4eea0e93596\cdrom.sys
[2006.11.02 10:51:44 | 000,067,072 | ---- | M] (Microsoft Corporation) MD5=8D1866E61AF096AE8B582454F5E4D303 -- C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_e487f727\cdrom.sys

< MD5 for: CNGAUDIT.DLL >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: CRYPTSVC.DLL >
[2008.01.21 04:24:35 | 000,128,000 | ---- | M] (Microsoft Corporation) MD5=6DE363F9F99334514C46AEC02D3E3678 -- C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6001.18000_none_75ff99649acf4de9\cryptsvc.dll
[2009.04.11 08:28:18 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=FB27772BEAF8E1D28CCD825C09DA939B -- C:\Windows\ERDNT\cache\cryptsvc.dll
[2009.04.11 08:28:18 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=FB27772BEAF8E1D28CCD825C09DA939B -- C:\Windows\System32\cryptsvc.dll
[2009.04.11 08:28:18 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=FB27772BEAF8E1D28CCD825C09DA939B -- C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6002.18005_none_77eb127097f11935\cryptsvc.dll

< MD5 for: CSRSS.EXE >
[2008.01.21 04:24:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=ABCA209EBA02CB59233614DB83B4F50D -- C:\Windows\System32\csrss.exe
[2008.01.21 04:24:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=ABCA209EBA02CB59233614DB83B4F50D -- C:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6001.18000_none_58e3e3d7e415ae4c\csrss.exe

< MD5 for: EXPLORER.EXE >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: FASTFAT.SYS >
[2009.04.11 06:13:52 | 000,142,848 | ---- | M] (Microsoft Corporation) MD5=1E9B9A70D332103C52995E957DC09EF8 -- C:\Windows\System32\drivers\fastfat.sys
[2009.04.11 06:13:52 | 000,142,848 | ---- | M] (Microsoft Corporation) MD5=1E9B9A70D332103C52995E957DC09EF8 -- C:\Windows\winsxs\x86_microsoft-windows-fat_31bf3856ad364e35_6.0.6002.18005_none_b09ea48c5485f42b\fastfat.sys
[2008.01.21 04:24:13 | 000,143,360 | ---- | M] (Microsoft Corporation) MD5=3C489390C2E2064563727752AF8EAB9E -- C:\Windows\winsxs\x86_microsoft-windows-fat_31bf3856ad364e35_6.0.6001.18000_none_aeb32b80576428df\fastfat.sys

< MD5 for: HAL.DLL >
[2009.04.11 08:32:46 | 000,177,128 | ---- | M] (Microsoft Corporation) MD5=B8D52005181A15D7D1470CBF2AF214DD -- C:\Windows\System32\hal.dll

< MD5 for: IASTORV.SYS >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: ISAPNP.SYS >
[2006.11.02 11:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) MD5=350FCA7E73CF65BCEF43FAE1E4E91293 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\isapnp.sys
[2008.01.21 04:23:01 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\Windows\System32\drivers\isapnp.sys
[2008.01.21 04:23:01 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\isapnp.sys
[2008.01.21 04:23:01 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\isapnp.sys
[2008.01.21 04:23:01 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\isapnp.sys
[2008.01.21 04:23:01 | 000,049,720 | ---- | M] (Microsoft Corporation) MD5=6C70698A3E5C4376C6AB5C7C17FB0614 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\isapnp.sys

< MD5 for: LSASS.EXE >
[2009.06.15 14:51:56 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=203D86EBD6D8E4C8501B222421E81506 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22152_none_a886901f7335e2fc\lsass.exe
[2009.09.10 16:44:14 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2D3AC5E7AC01E905F3ABD2D745FE3A9B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22223_none_a8a80213731ca5a7\lsass.exe
[2009.06.15 14:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\ERDNT\cache\lsass.exe
[2009.06.15 14:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\System32\lsass.exe
[2009.06.15 14:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18051_none_a7fbf30a5a1929db\lsass.exe
[2009.02.13 09:26:04 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=59DE082968FDD257FFF0D209B9A5B460 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16820_none_a44eb0105fb4d975\lsass.exe
[2009.06.15 15:03:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=6F1F23D3599EAE17734451936B7F17C6 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22450_none_a69e1da376115b2a\lsass.exe
[2009.06.15 14:57:59 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A911ECAC81F94ADEAFBE8E3F7873EDB0 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18272_none_a600dfae5d0228c9\lsass.exe
[2009.02.13 06:58:37 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=AFF8A58280863629CA4FFA9E0B259F1E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21010_none_a4e2f4e978ca9090\lsass.exe
[2009.06.15 14:59:08 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=BA9A67672E025078C77967731BCFC560 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21067_none_a4b3e75378eccda6\lsass.exe
[2009.06.15 15:10:12 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16870_none_a418a0745fdd652a\lsass.exe
[2009.09.09 13:09:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=CB7E838C140B4087B2DA323F2D4523C5 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22518_none_a6d1618975e9b345\lsass.exe
[2009.09.10 16:47:51 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=D09A5DA84B7C9CA9B02EBCD7FAE41C8D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21125_none_a4dd285578ce285b\lsass.exe
[2008.01.21 04:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe
[2008.01.21 04:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18215_none_a644c0145ccecd28\lsass.exe
[2008.01.21 04:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18005_none_a83603ce59ed0382\lsass.exe
[2009.02.13 10:20:29 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=F4C62B07E5BF96F1FDCA9DB393ECED22 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22376_none_a68e7da1761c2def\lsass.exe

< MD5 for: NDIS.SYS >
[2009.04.11 08:32:49 | 000,527,848 | ---- | M] (Microsoft Corporation) MD5=1357274D1883F68300AEADD15D7BBB42 -- C:\Windows\ERDNT\cache\ndis.sys
[2009.04.11 08:32:49 | 000,527,848 | ---- | M] (Microsoft Corporation) MD5=1357274D1883F68300AEADD15D7BBB42 -- C:\Windows\System32\drivers\ndis.sys
[2009.04.11 08:32:49 | 000,527,848 | ---- | M] (Microsoft Corporation) MD5=1357274D1883F68300AEADD15D7BBB42 -- C:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6002.18005_none_a9b2a4d31930d864\ndis.sys
[2008.01.21 04:23:50 | 000,529,464 | ---- | M] (Microsoft Corporation) MD5=9BDC71790FA08F0A0B5F10462B1BD0B1 -- C:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.0.6001.18000_none_a7c72bc71c0f0d18\ndis.sys

< MD5 for: NETLOGON.DLL >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NTFS.SYS >
[2009.04.11 08:32:49 | 001,083,880 | ---- | M] (Microsoft Corporation) MD5=6A4A98CEE84CF9E99564510DDA4BAA47 -- C:\Windows\ERDNT\cache\ntfs.sys
[2009.04.11 08:32:49 | 001,083,880 | ---- | M] (Společnost Microsoft) MD5=6A4A98CEE84CF9E99564510DDA4BAA47 -- C:\Windows\System32\drivers\ntfs.sys
[2009.04.11 08:32:49 | 001,083,880 | ---- | M] (Microsoft Corporation) MD5=6A4A98CEE84CF9E99564510DDA4BAA47 -- C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6002.18005_none_a85ca2c91a0d64df\ntfs.sys
[2008.01.21 04:23:51 | 001,081,912 | ---- | M] (Microsoft Corporation) MD5=B4EFFE29EB4F15538FD8A9681108492D -- C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6001.18000_none_a67129bd1ceb9993\ntfs.sys

< MD5 for: NVRAID.SYS >
[2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\drivers\nvraid.sys
[2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvraid.sys
[2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) MD5=2EDF9E7751554B42CBB60116DE727101 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvraid.sys
[2006.11.02 11:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) MD5=E69E946F80C1C31C53003BFBF50CBB7C -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvraid.sys

< MD5 for: NVSTOR.SYS >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< MD5 for: SERVICES.EXE >
[2008.01.21 04:24:48 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009.04.11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\ERDNT\cache\services.exe
[2009.04.11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
[2009.04.11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SMSS.EXE >
[2008.01.21 04:23:50 | 000,064,000 | ---- | M] (Microsoft Corporation) MD5=6701DDAF68BEDE6BBEEA9D514D73A35B -- C:\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6001.18000_none_ac3aa7fd19319fba\smss.exe
[2009.04.11 08:28:04 | 000,064,000 | ---- | M] (Microsoft Corporation) MD5=98AF15A94CD6AC37248E72E5FE789B35 -- C:\Windows\System32\smss.exe
[2009.04.11 08:28:04 | 000,064,000 | ---- | M] (Microsoft Corporation) MD5=98AF15A94CD6AC37248E72E5FE789B35 -- C:\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6002.18005_none_ae26210916536b06\smss.exe

< MD5 for: SPOOLSV.EXE >
[2009.04.11 08:28:05 | 000,127,488 | ---- | M] (Microsoft Corporation) MD5=524BFBEA40E6E404737CCBC754647A2E -- C:\Windows\ERDNT\cache\spoolsv.exe
[2009.04.11 08:28:05 | 000,127,488 | ---- | M] (Microsoft Corporation) MD5=524BFBEA40E6E404737CCBC754647A2E -- C:\Windows\System32\spoolsv.exe
[2009.04.11 08:28:05 | 000,127,488 | ---- | M] (Microsoft Corporation) MD5=524BFBEA40E6E404737CCBC754647A2E -- C:\Windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.0.6002.18005_none_d8371c2dbeaa9062\spoolsv.exe
[2008.01.21 04:24:45 | 000,125,952 | ---- | M] (Microsoft Corporation) MD5=846CDF9A3CF4DA9B306ADFB7D55EE4C2 -- C:\Windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.0.6001.18000_none_d64ba321c188c516\spoolsv.exe

< MD5 for: SVCHOST.EXE >
[2008.01.21 04:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\ERDNT\cache\svchost.exe
[2008.01.21 04:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008.01.21 04:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.26 10:08:16 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=01EC1E92595F839BEE70D439C46796E3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys
[2009.04.11 08:33:02 | 000,897,000 | ---- | M] (Microsoft Corporation) MD5=0E6B0885C3D5E4643ED2D043DE3433D8 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42\tcpip.sys
[2009.08.15 23:30:53 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=2512B4D1353370D6688B1AF1F5AFA1CF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys
[2009.08.14 19:01:55 | 000,900,168 | ---- | M] (Microsoft Corporation) MD5=2608E71AAD54564647D4BB984E1925AA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys
[2009.08.14 16:24:47 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=300208927321066EA53761FDC98747C6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys
[2009.08.14 18:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\ERDNT\cache\tcpip.sys
[2009.08.14 18:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\System32\drivers\tcpip.sys
[2009.08.14 18:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys
[2008.04.26 10:26:49 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=82E266BEE5F0167E41C6ECFDD2A79C02 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys
[2009.08.14 19:07:56 | 000,897,608 | ---- | M] (Microsoft Corporation) MD5=8A7AD2A214233F684242F289ED83EBC3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys
[2008.01.21 04:25:03 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=FC6E2835D667774D409C7C7021EAF9C4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
[2009.08.14 18:33:50 | 000,905,784 | ---- | M] (Microsoft Corporation) MD5=FF71856BD4CD6D4367F9FD84BE79A874 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B -- C:\Windows\ERDNT\cache\ws2_32.dll
[2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B -- C:\Windows\System32\ws2_32.dll
[2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.0.6001.18000_none_f2b7b0c2ce5605c4\ws2_32.dll

< >

< C:\windows\system32\spool\prtprocs|dll;true;true;true /FP >
[2008.01.21 04:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2004.03.22 16:17:08 | 000,025,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006.10.26 21:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009.09.03 23:54:34 | 000,003,584 | ---- | M] (Lexmark International Inc.) -- C:\Windows\System32\spool\prtprocs\w32x86\cs-CZ\LMPRTPRC.DLL.mui
[2006.11.02 14:40:56 | 000,003,584 | ---- | M] (Lexmark International Inc.) -- C:\Windows\System32\spool\prtprocs\w32x86\en-US\LMPRTPRC.DLL.mui

< %systemroot%\system32\drivers\*.sys /5 >

< %systemroot%\system32\drivers\*.sys /X >
[2006.10.19 23:27:24 | 000,000,000 | ---- | M] () -- C:\Windows\system32\drivers\1025_ACER_Aspire 5738.mrk
[2006.09.18 23:26:46 | 003,440,660 | ---- | M] () -- C:\Windows\system32\drivers\gm.dls
[2006.09.18 23:26:46 | 000,000,646 | ---- | M] () -- C:\Windows\system32\drivers\gmreadme.txt
[2008.01.21 04:23:51 | 000,000,003 | ---- | M] () -- C:\Windows\system32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
[2009.04.08 08:43:50 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
[2009.09.03 23:53:13 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2009.10.29 12:09:13 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009.02.10 21:21:58 | 000,090,772 | ---- | M] () -- C:\Windows\system32\drivers\RtConvEQ.DAT
[2009.02.10 21:21:58 | 000,000,536 | ---- | M] () -- C:\Windows\system32\drivers\RtHdatEx.dat
[2007.07.14 00:11:56 | 000,000,008 | ---- | M] () -- C:\Windows\system32\drivers\rtkhdaud.dat

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\*.* /5 >
[2011.08.11 20:25:55 | 000,003,216 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.11 20:25:55 | 000,003,216 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.11 18:32:01 | 000,101,250 | ---- | M] () -- C:\Windows\system32\perfc009.dat
[2011.08.11 18:32:01 | 000,587,178 | ---- | M] () -- C:\Windows\system32\perfh009.dat
[2011.08.11 18:32:01 | 000,690,960 | ---- | M] () -- C:\Windows\system32\PerfStringBackup.INI

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\system32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\system32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\system32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\system32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\system32\config\SYSTEM.SAV

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\*.* /U /s >
[7 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]

< %systemroot%\*. /mp /s >

< %ALLUSERSPROFILE%\Data Aplikací\*.* >

< %ALLUSERSPROFILE%\Data Aplikací\*.exe /s >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.* >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s >

< %APPDATA%\*. >
[2011.05.05 20:47:33 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Ableton
[2009.02.18 14:08:05 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Acer GameZone Console
[2009.09.23 21:14:51 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Adobe
[2010.06.09 21:45:10 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Apple Computer
[2011.08.05 21:50:00 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\AVG10
[2009.09.23 21:16:09 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\BeatportDownloader.EE670286545758FAB4A69D4439CF6054F83E0AC2.1
[2009.09.22 22:11:03 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\CyberLink
[2011.04.30 00:40:12 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoft
[2011.04.30 00:39:42 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.01 14:26:51 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\ESET
[2009.09.07 21:17:57 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\eSobi
[2009.09.07 21:06:31 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Google
[2010.10.15 19:54:34 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\GTCO CalComp
[2009.10.26 20:40:01 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\ICQ
[2009.09.03 23:51:27 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Identities
[2011.03.11 16:09:13 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\klavaro
[2009.09.03 23:52:03 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Macromedia
[2010.05.22 00:44:46 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Meda MP3 Splitter Gold 4.2
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Media Center Programs
[2011.08.11 18:15:57 | 000,000,000 | --SD | M] -- C:\Users\Acer\AppData\Roaming\Microsoft
[2011.07.14 23:23:15 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Mozilla
[2009.10.31 20:12:38 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\OpenOffice.org
[2010.03.20 00:38:55 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Pencil
[2009.09.22 22:34:29 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\PowerCinema
[2011.08.07 15:09:58 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Skype
[2011.07.30 20:43:30 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\skypePM
[2009.09.22 22:11:14 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\SoftDMA
[2011.05.11 23:23:44 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Thunderbird
[2009.09.27 23:49:01 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Toolbars
[2009.12.26 17:18:16 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\WinRAR

< %APPDATA%\*.* >
[2011.08.11 17:37:51 | 000,017,441 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\FAE2.C9D

< %APPDATA%\*.exe /s >
[2010.04.26 18:03:22 | 000,038,784 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2008.04.24 10:37:24 | 000,049,152 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\Toolbars\eBay\uninstall.exe
[2008.04.24 10:37:26 | 000,065,536 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\Toolbars\eBay\update.exe

< %SYSTEMDRIVE%\*.exe >

< >

< >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2009-10-29 10:36:02

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS /s >
"JobInactivityTimeout" = 7776000
"JobMinimumRetryDelay" = 600
"JobNoProgressTimeout" = 1209600
"LogFileFlags" = 0
"LogFileMinMemory" = 120
"LogFileSize" = 1
"TimeQuantaLength" = 300
"UseLmCompat" = 2
"IGDSearcherDLL" = bitsigd.dll -- [2009.04.11 08:28:18 | 000,031,744 | ---- | M] (Microsoft Corporation)
"StateIndex" = 0

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager" /v BootExecute /c >
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER
BOOTEXECUTE REG_MULTI_SZ autocheck autochk *\0sdnclean.exe

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations" /c >

< >

< type c:\boot.ini >> test.txt /c >

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2011.08.11 20:26:29 | 000,000,512 | ---- | M] () MD5=767304ECFE4BC260554649D7630070A0 -- C:\PhysicalMBR.bin

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\Temp:7B2D4DC5
@Alternate Data Stream - 229 bytes -> C:\ProgramData\Temp:8FF81EB0

< End of report >

[Caroprd111]

Doporučuji odinstalovat toolbary.


Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter



Stáhněte T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
• Po použití program vymažte. Pozor, antiviry ho mohou falešně označit za vir.

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

• Spusťte.
• Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

• Spusťte.
• Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478
Záložka Čistič

• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.

OK Zavřít

[dantos]

Díky moc kasičku tady nemáte ?? snad to celé pomohlo, ale popravdě, už tu proceduru nechci opakovat ... snad mě nějaký antivir alespoň pomůže s ochranou.

[Caroprd111]

Nemáte zač. Pokud chcete, tak můžete podpořit provoz našeho fóra, více zde: http://viry.cz/forum/viewtopic.php?f=7&t=78175

[dantos]

Díky, mrknu na možnosti poslání. Poslední dotaz: co doporučujete jako prevenci (teď myslím sw) chránící před aktuální havětí ??

[Caroprd111]

Jménem celého teamu děkuji za příspěvek.

Myslím, že v prevenci vám poradí článek http://viry.cz/forum/viewtopic.php?f=29&t=6152

[dantos]

No jo, to mi drahá polovička říkala pořád, ať si nainstaluju aspoň Avast ... Díky a přeji hezký zbytek večera

[Caroprd111]

Není zač, vám také.

[dantos]

Zdravím - opět jsem zpátky , je mi to docela trapné, ale poté, co jsem si dle referencí nainstaloval Avast, tak mi bohužel našel další svinstvo, jak to vypadá, šmejd odstraněn nebyl a rád střídá masky pod jinými soubory ... ?? viz screenshot v příloze. Mezitím, mi ještě klekl laptop při nastavování zvuku, naštěstí fungovala Storage konzole - tak jsem vrátil bod obnovy; ovšem před kleknutím Avast našel šmejda přímo v Avast souborech (tuším appdata/...), teď zase jinde. Tak už nevím, co dál.

Log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Acer at 2011-08-13 21:38:15
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 193 GB (72%) free of 267 GB
Total RAM: 3066 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:38:30, on 13.8.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Acer\Desktop\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\trend micro\Acer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... spire_5738
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... spire_5738
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... spire_5738
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: TBSB08223 - {0753D5E7-BCDF-4BAE-85EC-431B17D3BE72} - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Toolbar for eBay - {427AB608-62F1-48D1-84D4-50C6358B7268} - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
O4 - HKLM\..\Run: [SeePassword] C:\Program Files\SeePassword\SeePassword.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
O23 - Service: NTI IScheduleSvc - Unknown owner - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (file missing)
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 8472 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2808683438-737575968-2950562706-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\ldrp7j8f.default

prefs.js - "browser.startup.homepage" - "http://www.google.cz/"
prefs.js - "extensions.enabledItems" - "{4176DFF4-4698-11DE-BEEB-45DA55D89593}:0.8.1, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
NPOFFICE.DLL
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
avg_igeared.xml
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\ldrp7j8f.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b}
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0753D5E7-BCDF-4BAE-85EC-431B17D3BE72}]
TBSB08223 Class - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll [2008-08-14 2484224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-12 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{427AB608-62F1-48D1-84D4-50C6358B7268} - Toolbar for eBay - C:\Users\Acer\AppData\Roaming\Toolbars\eBay\ebay.dll [2008-08-14 2484224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-17 13605408]
"PLFSetI"=C:\Windows\PLFSetI.exe [2008-07-29 200704]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-12-05 1410344]
"LManager"=C:\Program Files\Launch Manager\LManager.exe [2009-02-19 866824]
"Acer ePower Management"=C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe [2009-02-19 707104]
"SeePassword"=C:\Program Files\SeePassword\SeePassword.exe []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-11-29 421888]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-03-09 2769336]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2011-07-07 10754664]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"Google Update"=C:\Users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-14 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-09-11 2054360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-12-13 1198592]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WDDMStatus.lnk - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
WDSmartWare.lnk - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe

C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet32]
C:\Windows\system32\cryptnet32.dll [2011-04-20 49152]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"msacm.siren"=sirenacm.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"midi3"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux3"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux4"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"aux5"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"aux6"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux2"=wdmaud.drv
"vidc.tscc"=tsccvid.dll
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux7"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-13 21:38:15 ----D---- C:\rsit
2011-08-13 21:38:15 ----D---- C:\Program Files\trend micro
2011-08-13 19:36:46 ----D---- C:\Windows\system32\RTCOM
2011-08-13 19:34:54 ----A---- C:\Windows\system32\WavesLib.dll
2011-08-13 19:34:53 ----A---- C:\Windows\system32\WavesGUILib.dll
2011-08-13 19:34:49 ----A---- C:\Windows\system32\SRSWOW.dll
2011-08-13 19:34:49 ----A---- C:\Windows\system32\SRSTSXT.dll
2011-08-13 19:34:49 ----A---- C:\Windows\system32\SRSTSHD.dll
2011-08-13 19:34:49 ----A---- C:\Windows\system32\SRSHP360.dll
2011-08-13 19:34:45 ----A---- C:\Windows\system32\SFNHK.dll
2011-08-13 19:34:43 ----A---- C:\Windows\system32\SFCOM.dll
2011-08-13 19:34:42 ----A---- C:\Windows\system32\SFAPO.dll
2011-08-13 19:34:40 ----A---- C:\Windows\system32\RtkPgExt.dll
2011-08-13 19:34:40 ----A---- C:\Windows\system32\drivers\RTKVHDA.sys
2011-08-13 19:34:37 ----A---- C:\Windows\system32\RtkCoInst.dll
2011-08-13 19:34:36 ----A---- C:\Windows\system32\RtkApoApi.dll
2011-08-13 19:34:36 ----A---- C:\Windows\system32\RtkAPO.dll
2011-08-13 19:34:33 ----A---- C:\Windows\system32\RTEEP32A.dll
2011-08-13 19:34:33 ----A---- C:\Windows\system32\RTEEL32A.dll
2011-08-13 19:34:32 ----A---- C:\Windows\system32\RTEEG32A.dll
2011-08-13 19:34:32 ----A---- C:\Windows\system32\RTEED32A.dll
2011-08-13 19:34:31 ----A---- C:\Windows\system32\RP3DHT32.dll
2011-08-13 19:34:31 ----A---- C:\Windows\system32\RP3DAA32.dll
2011-08-13 19:34:30 ----A---- C:\Windows\system32\RCoRes.dat
2011-08-13 19:34:30 ----A---- C:\Windows\system32\R4EEP32A.dll
2011-08-13 19:34:30 ----A---- C:\Windows\system32\R4EEL32A.dll
2011-08-13 19:34:30 ----A---- C:\Windows\system32\R4EEG32A.dll
2011-08-13 19:34:30 ----A---- C:\Windows\system32\R4EED32A.dll
2011-08-13 19:34:30 ----A---- C:\Windows\system32\R4EEA32A.dll
2011-08-13 19:34:28 ----A---- C:\Windows\system32\MaxxVolumeSDAPO.dll
2011-08-13 19:34:25 ----A---- C:\Windows\system32\MaxxAudioRealtek.dll
2011-08-13 19:34:25 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2011-08-13 19:34:25 ----A---- C:\Windows\system32\MaxxAudioAPO30.dll
2011-08-13 19:34:25 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2011-08-13 19:34:24 ----A---- C:\Windows\system32\MaxxAudioAPO.dll
2011-08-13 19:34:24 ----A---- C:\Windows\system32\KAAPORT.dll
2011-08-13 19:34:12 ----A---- C:\Windows\system32\FMAPO.dll
2011-08-13 19:34:11 ----A---- C:\Windows\system32\DTSVoiceClarityDLL.dll
2011-08-13 19:34:11 ----A---- C:\Windows\system32\DTSSymmetryDLL.dll
2011-08-13 19:34:11 ----A---- C:\Windows\system32\DTSS2SpeakerDLL.dll
2011-08-13 19:34:10 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL.dll
2011-08-13 19:34:10 ----A---- C:\Windows\system32\DTSNeoPCDLL.dll
2011-08-13 19:34:10 ----A---- C:\Windows\system32\DTSLimiterDLL.dll
2011-08-13 19:34:10 ----A---- C:\Windows\system32\DTSLFXAPO.dll
2011-08-13 19:34:09 ----A---- C:\Windows\system32\DTSGFXAPONS.dll
2011-08-13 19:34:09 ----A---- C:\Windows\system32\DTSGFXAPO.dll
2011-08-13 19:34:09 ----A---- C:\Windows\system32\DTSGainCompensatorDLL.dll
2011-08-13 19:34:08 ----A---- C:\Windows\system32\DTSBoostDLL.dll
2011-08-13 19:34:07 ----A---- C:\Windows\system32\DTSBassEnhancementDLL.dll
2011-08-13 19:34:05 ----A---- C:\Windows\system32\AERTARen.dll
2011-08-13 19:34:04 ----A---- C:\Windows\system32\AERTACap.dll
2011-08-13 19:01:15 ----D---- C:\Program Files\TeamViewer
2011-08-13 18:20:14 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2011-08-13 18:20:13 ----A---- C:\Windows\system32\drivers\aswSP.sys
2011-08-13 18:20:09 ----A---- C:\Windows\system32\drivers\aswRdr.sys
2011-08-13 18:20:07 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2011-08-13 18:20:03 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2011-08-13 18:19:44 ----A---- C:\Windows\system32\avastSS.scr
2011-08-13 18:19:44 ----A---- C:\Windows\system32\aswBoot.exe
2011-08-13 17:06:34 ----A---- C:\Windows\system32\wups2.dll
2011-08-13 17:06:34 ----A---- C:\Windows\system32\wuauclt.exe
2011-08-13 17:06:33 ----A---- C:\Windows\system32\wucltux.dll
2011-08-13 17:06:33 ----A---- C:\Windows\system32\wuaueng.dll
2011-08-13 17:06:09 ----A---- C:\Windows\system32\wups.dll
2011-08-13 17:06:08 ----A---- C:\Windows\system32\wudriver.dll
2011-08-13 17:06:08 ----A---- C:\Windows\system32\wuapi.dll
2011-08-13 17:05:54 ----A---- C:\Windows\system32\wuwebv.dll
2011-08-13 17:05:54 ----A---- C:\Windows\system32\wuapp.exe
2011-08-13 13:45:52 ----D---- C:\ProgramData\WD_SmartWareCommon
2011-08-13 13:43:43 ----D---- C:\Users\Acer\AppData\Roaming\Western Digital
2011-08-13 13:43:36 ----D---- C:\ProgramData\Western Digital
2011-08-13 13:42:39 ----D---- C:\Program Files\Western Digital
2011-08-11 22:30:18 ----D---- C:\Program Files\Crawler
2011-08-11 22:28:43 ----D---- C:\Users\Acer\AppData\Roaming\Spyware Terminator
2011-08-11 22:28:43 ----D---- C:\ProgramData\Spyware Terminator
2011-08-11 22:28:40 ----D---- C:\Program Files\Spyware Terminator
2011-08-11 21:47:49 ----D---- C:\ProgramData\AVAST Software
2011-08-11 21:47:49 ----D---- C:\Program Files\AVAST Software
2011-08-11 18:19:10 ----D---- C:\Windows\temp
2011-08-07 01:07:21 ----D---- C:\Windows\Minidump
2011-08-06 20:33:24 ----ASH---- C:\hiberfil.sys
2011-08-05 21:49:01 ----HD---- C:\ProgramData\Common Files
2011-08-05 21:47:32 ----D---- C:\ProgramData\AVG10
2011-08-05 21:43:33 ----D---- C:\ProgramData\MFAData
2011-07-30 12:22:17 ----D---- C:\ProgramData\Apple Computer
2011-07-30 12:22:17 ----D---- C:\Program Files\QuickTime
2011-07-24 10:16:58 ----D---- C:\Program Files\Microsoft Silverlight

======List of files/folders modified in the last 1 month======

2011-08-13 23:30:48 ----D---- C:\Windows\system32\config
2011-08-13 23:29:06 ----D---- C:\Windows\Tasks
2011-08-13 23:29:06 ----D---- C:\Windows\system32\spool
2011-08-13 23:29:06 ----D---- C:\Windows\system32\Msdtc
2011-08-13 23:29:06 ----D---- C:\Windows\system32\drivers\etc
2011-08-13 23:29:06 ----D---- C:\Windows\system32\cs-CZ
2011-08-13 23:29:06 ----D---- C:\Windows\system32\CodeIntegrity
2011-08-13 23:29:05 ----D---- C:\Users\Acer\AppData\Roaming\Desktopicon
2011-08-13 23:29:05 ----D---- C:\Program Files\WinRAR
2011-08-13 23:29:05 ----D---- C:\Program Files\Stop Motion Animator
2011-08-13 23:29:05 ----D---- C:\Program Files\Picture2avi
2011-08-13 23:29:04 ----D---- C:\Program Files\PhotoFilmStrip
2011-08-13 23:29:04 ----D---- C:\Program Files\Mozilla Firefox
2011-08-13 23:29:04 ----D---- C:\Program Files\Meda MP3 Splitter Gold
2011-08-13 23:29:04 ----D---- C:\Program Files\Launch Manager
2011-08-13 23:29:04 ----D---- C:\Program Files\Fx Audio Editor
2011-08-13 23:28:56 ----D---- C:\Windows\registration
2011-08-13 23:28:51 ----HD---- C:\Windows\system32\CanonMF Uninstaller Information
2011-08-13 23:28:51 ----D---- C:\Windows\twain_32
2011-08-13 23:28:51 ----D---- C:\Users\Acer\AppData\Roaming\Thunderbird
2011-08-13 23:28:51 ----D---- C:\Users\Acer\AppData\Roaming\Ableton
2011-08-13 23:28:51 ----D---- C:\ProgramData\Skype
2011-08-13 23:28:51 ----D---- C:\Program Files\Mozilla Thunderbird
2011-08-13 23:28:51 ----D---- C:\Program Files\Common Files\DVDVideoSoft
2011-08-13 23:28:51 ----D---- C:\Program Files\Common Files
2011-08-13 23:28:51 ----D---- C:\Program Files\Canon
2011-08-13 23:28:51 ----D---- C:\Program Files\Ableton
2011-08-13 23:28:50 ----D---- C:\Windows\system32\Tasks
2011-08-13 23:28:50 ----D---- C:\Users\Acer\AppData\Roaming\Skype
2011-08-13 23:28:50 ----D---- C:\Users\Acer\AppData\Roaming\GTCO CalComp
2011-08-13 23:28:50 ----D---- C:\Program Files\Native Instruments
2011-08-13 23:28:50 ----D---- C:\Program Files\K-Lite Codec Pack
2011-08-13 23:28:50 ----D---- C:\Program Files\Klavaro-1.7.4
2011-08-13 23:28:50 ----D---- C:\Program Files\Java
2011-08-13 23:28:50 ----D---- C:\Program Files\Internet Explorer
2011-08-13 23:28:50 ----D---- C:\Program Files\eInstruction
2011-08-13 23:28:50 ----D---- C:\Program Files\DVDVideoSoft
2011-08-13 23:28:50 ----D---- C:\Program Files\Common Files\Apple
2011-08-13 23:28:50 ----D---- C:\Program Files\Apple Software Update
2011-08-13 23:28:48 ----SHD---- C:\Windows\system32\%APPDATA%
2011-08-13 23:28:48 ----RD---- C:\Program Files\Skype
2011-08-13 23:28:48 ----D---- C:\Windows\WindowsMobile
2011-08-13 23:28:48 ----D---- C:\Windows\usb-audio.deRLDJIF
2011-08-13 23:28:48 ----D---- C:\Windows\system32\XPSViewer
2011-08-13 23:28:48 ----D---- C:\Windows\system32\winrm
2011-08-13 23:28:48 ----D---- C:\Windows\system32\WCN
2011-08-13 23:28:48 ----D---- C:\Windows\system32\wbem
2011-08-13 23:28:48 ----D---- C:\Windows\system32\sysprep
2011-08-13 23:28:48 ----D---- C:\Windows\system32\slmgr
2011-08-13 23:28:48 ----D---- C:\Windows\system32\Printing_Admin_Scripts
2011-08-13 23:28:48 ----D---- C:\Windows\system32\oobe
2011-08-13 23:28:48 ----D---- C:\Windows\system32\MUI
2011-08-13 23:28:48 ----D---- C:\Windows\system32\migwiz
2011-08-13 23:28:48 ----D---- C:\Windows\system32\migration
2011-08-13 23:28:48 ----D---- C:\Windows\system32\inetsrv
2011-08-13 23:28:48 ----D---- C:\Windows\system32\DriverStore
2011-08-13 23:28:48 ----D---- C:\Windows\system32\drivers\UMDF
2011-08-13 23:28:48 ----D---- C:\Windows\system32\com
2011-08-13 23:28:48 ----D---- C:\Windows\system32\Boot
2011-08-13 23:28:48 ----D---- C:\Windows\servicing
2011-08-13 23:28:48 ----D---- C:\Windows\PolicyDefinitions
2011-08-13 23:28:48 ----D---- C:\Windows\MSAgent
2011-08-13 23:28:48 ----D---- C:\Windows\IME
2011-08-13 23:28:48 ----D---- C:\Windows\Help
2011-08-13 23:28:48 ----D---- C:\Windows\ehome
2011-08-13 23:28:48 ----D---- C:\Windows\DigitalLocker
2011-08-13 23:28:48 ----D---- C:\Windows\AppPatch
2011-08-13 23:28:48 ----D---- C:\Users\Acer\AppData\Roaming\Adobe
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Sidebar
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Photo Gallery
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Media Player
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Mail
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Journal
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Defender
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Collaboration
2011-08-13 23:28:48 ----D---- C:\Program Files\Windows Calendar
2011-08-13 23:28:48 ----D---- C:\Program Files\Movie Maker
2011-08-13 23:28:48 ----D---- C:\Program Files\Common Files\System
2011-08-13 23:28:48 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-08-13 23:28:47 ----D---- C:\Windows\system32\EventProviders
2011-08-13 23:28:47 ----D---- C:\Windows\Screensavers
2011-08-13 23:28:47 ----D---- C:\Program Files\CCleaner
2011-08-13 23:28:47 ----D---- C:\Program Files\Acer
2011-08-13 23:28:46 ----D---- C:\Program Files\OpenOffice.org 3
2011-08-13 23:28:46 ----D---- C:\Program Files\Microsoft Office
2011-08-13 23:28:46 ----D---- C:\Program Files\Google
2011-08-13 23:28:46 ----D---- C:\Program Files\Evolus
2011-08-13 23:28:46 ----D---- C:\Program Files\Acer Inc
2011-08-13 23:28:46 ----D---- C:\Program Files\Acer Arcade Deluxe
2011-08-13 23:28:46 ----AD---- C:\ProgramData\Temp
2011-08-13 23:28:44 ----SD---- C:\ProgramData\Microsoft
2011-08-13 23:28:44 ----D---- C:\Windows\system32\OEM
2011-08-13 23:28:44 ----D---- C:\ProgramData\McAfee
2011-08-13 23:28:44 ----D---- C:\ProgramData\CyberLink
2011-08-13 23:28:44 ----D---- C:\Program Files\Windows Live
2011-08-13 23:28:44 ----D---- C:\Program Files\NewTech Infosystems
2011-08-13 23:28:44 ----D---- C:\Program Files\Microsoft.NET
2011-08-13 23:28:44 ----D---- C:\Program Files\Microsoft Works
2011-08-13 23:28:44 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2011-08-13 23:28:44 ----D---- C:\Program Files\Microsoft Office Suite Activation Assistant
2011-08-13 23:28:44 ----D---- C:\Program Files\Microsoft
2011-08-13 23:28:44 ----D---- C:\Program Files\Cyberlink
2011-08-13 23:28:44 ----D---- C:\Program Files\Common Files\Windows Live
2011-08-13 23:28:44 ----D---- C:\Program Files\Common Files\Oberon Media
2011-08-13 23:28:44 ----D---- C:\Program Files\Common Files\InstallShield
2011-08-13 23:28:44 ----D---- C:\Program Files\Common Files\Adobe
2011-08-13 23:28:44 ----D---- C:\Program Files\Adobe
2011-08-13 23:28:43 ----D---- C:\Programs
2011-08-13 23:28:31 ----SD---- C:\Windows\system32\Microsoft
2011-08-13 23:28:31 ----D---- C:\Windows\Web
2011-08-13 23:28:31 ----D---- C:\Windows\system32\Speech
2011-08-13 23:28:31 ----D---- C:\Windows\system32\SMI
2011-08-13 23:28:31 ----D---- C:\Windows\system32\RemInst
2011-08-13 23:28:31 ----D---- C:\Windows\system32\networklist
2011-08-13 23:28:31 ----D---- C:\Windows\system32\Macromed
2011-08-13 23:28:31 ----D---- C:\Windows\system32\licensing
2011-08-13 23:28:31 ----D---- C:\Windows\system32\IME
2011-08-13 23:28:30 ----RSD---- C:\Windows\assembly
2011-08-13 23:28:30 ----D---- C:\Windows\Speech
2011-08-13 23:28:30 ----D---- C:\Windows\schemas
2011-08-13 23:28:30 ----D---- C:\Windows\Setup
2011-08-13 23:28:30 ----D---- C:\Windows\ServiceProfiles
2011-08-13 23:28:30 ----D---- C:\Windows\security
2011-08-13 23:28:30 ----D---- C:\Windows\Resources
2011-08-13 23:28:30 ----D---- C:\Windows\Provisioning
2011-08-13 23:28:30 ----D---- C:\Windows\PLA
2011-08-13 23:28:30 ----D---- C:\Windows\Performance
2011-08-13 23:28:30 ----D---- C:\Windows\Microsoft.NET
2011-08-13 23:28:30 ----D---- C:\Windows\Branding
2011-08-13 23:28:30 ----D---- C:\Windows\Boot
2011-08-13 23:28:30 ----D---- C:\Program Files\Windows NT
2011-08-13 23:28:30 ----D---- C:\Program Files\Reference Assemblies
2011-08-13 23:28:30 ----D---- C:\Program Files\MSBuild
2011-08-13 23:28:30 ----D---- C:\Program Files\Microsoft Games
2011-08-13 23:28:30 ----D---- C:\Elements
2011-08-13 23:28:29 ----D---- C:\Program Files\Common Files\SpeechEngines
2011-08-13 23:28:29 ----D---- C:\Program Files\Broadcom
2011-08-13 23:28:29 ----D---- C:\Acer
2011-08-13 23:27:30 ----D---- C:\Program Files\HiFisoftware
2011-08-13 23:27:23 ----SHD---- C:\$RECYCLE.BIN
2011-08-13 23:27:23 ----D---- C:\Program Files\ESET
2011-08-13 21:38:15 ----RD---- C:\Program Files
2011-08-13 21:32:23 ----D---- C:\Windows\system32\catroot2
2011-08-13 21:32:23 ----D---- C:\Windows\system32\catroot
2011-08-13 21:32:13 ----D---- C:\Windows\winsxs
2011-08-13 21:31:28 ----D---- C:\Windows
2011-08-13 19:53:46 ----D---- C:\Windows\System32
2011-08-13 19:53:46 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-13 19:53:45 ----D---- C:\Windows\inf
2011-08-13 19:48:18 ----D---- C:\Windows\Prefetch
2011-08-13 19:38:40 ----HD---- C:\Program Files\Temp
2011-08-13 19:36:46 ----D---- C:\Windows\system32\drivers
2011-08-13 19:36:34 ----SHD---- C:\System Volume Information
2011-08-13 19:35:14 ----A---- C:\Windows\DIFxAPI.dll
2011-08-13 19:34:03 ----HD---- C:\Program Files\InstallShield Installation Information
2011-08-13 19:32:12 ----D---- C:\Windows\system32\en-US
2011-08-13 18:33:18 ----SD---- C:\Users\Acer\AppData\Roaming\Microsoft
2011-08-13 18:19:58 ----SHD---- C:\Windows\Installer
2011-08-13 18:19:57 ----D---- C:\Program Files\Common Files\microsoft shared
2011-08-13 18:19:38 ----D---- C:\ProgramData\Alwil Software
2011-08-13 18:19:38 ----D---- C:\Program Files\Alwil Software
2011-08-13 13:45:52 ----HD---- C:\ProgramData
2011-08-12 09:54:28 ----D---- C:\Windows\system32\LogFiles
2011-08-06 20:36:15 ----D---- C:\Windows\system32\WDI
2011-07-30 20:43:30 ----D---- C:\Users\Acer\AppData\Roaming\skypePM
2011-07-14 23:23:15 ----D---- C:\Users\Acer\AppData\Roaming\Mozilla

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 UBHelper;UBHelper; C:\Windows\system32\drivers\UBHelper.sys [2008-01-31 13824]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-03-09 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-03-09 162640]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-03-09 46672]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/04/08 07:50:06]; \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-12-26 87536]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-03-09 19024]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-03-09 51792]
R2 eamon;eamon; C:\Windows\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-09-11 135048]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2009-09-11 38240]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2008-01-21 95744]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2008-03-01 1202560]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-03 21264]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-06-19 33096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-07-07 3531176]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60x.sys [2008-09-04 223232]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-09-25 3666432]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\Drivers\NTIDrvr.sys [2008-01-31 14848]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-09-25 45600]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-17 7542656]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-12-05 204976]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 a2djavs;a2djavs; C:\Windows\System32\Drivers\a2djavs.sys [2009-10-08 35280]
S3 a2djusb;a2djusb; C:\Windows\System32\Drivers\a2djusb.sys [2009-10-08 276304]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 NSCIRDA;NSC Infrared Device Driver; C:\Windows\system32\DRIVERS\nscirda.sys [2008-01-21 30720]
S3 RL_DJIF;usb-audio.de driver for Reloop Digital Jockey Interface; C:\Windows\System32\Drivers\rldjifu.sys [2008-06-17 365568]
S3 RL_DJIF_WDM;Digital Jockey Interface WDM Audio; C:\Windows\system32\drivers\rldjifa.sys [2008-06-17 34304]
S3 RL_DJIFM;Digital Jockey Interface WDM Midi Device; C:\Windows\system32\drivers\rldjifm.sys [2008-06-17 20992]
S3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-12-02 62976]
S3 usbaudio;Ovladač zvuků USB (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2008-03-18 13312]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R2 CLHNService;CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-12-18 75048]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-09-11 735960]
R2 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-02-19 666144]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 NIHardwareService;NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2009-12-08 3616768]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-17 203296]
R2 TeamViewer6;TeamViewer 6; C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe [2011-06-01 2337144]
R2 WDDMService;WD SmartWare Drive Manager; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-10-14 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe []
S2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe []
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-09-11 20680]
S3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe []
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe []

-----------------EOF-----------------

[Caroprd111]

Zdravím

Stáhněte OTL http://oldtimer.geekstogo.com/OTL.scr na plochu a spusťte, do spodního okna vložte následující skript a klikněte na Opravit. Log vložte sem.

Kód: Vybrat vše

:commands
[EMPTYTEMP]

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet32]

:files
C:\Windows\system32\cryptnet32.dll
C:\Windows\system32\dll.dll
C:\Users\Acer\AppData\Roaming\Desktopicon

[dantos]

Díky - zde je log:

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: Acer
->Temp folder emptied: 144110809 bytes
->Temporary Internet Files folder emptied: 1396766 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 116985150 bytes
->Flash cache emptied: 41508 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->Flash cache emptied: 38784 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 29734179 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 48434935 bytes

Total Files Cleaned = 325,00 mb

========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet32\ not found.
========== FILES ==========
File\Folder C:\Windows\system32\cryptnet32.dll not found.
File\Folder C:\Windows\system32\dll.dll not found.
C:\Users\Acer\AppData\Roaming\Desktopicon folder moved successfully.

OTL by OldTimer - Version 3.2.26.1 log created on 08142011_003631

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...

[Caroprd111]

Jak to vypadá s PC?

[dantos]

PC jsem projížděl znovu Avastem a vypadá to, že nic nenašel, tudíž doufám, že je to na dobré cestě taky jsem zjistil, že jsem neměl zapnuté aktualizace Wins, ani Avastu, snad už je to tedy definitivně v pořádku.

[Caroprd111]

Ok, v tom případě je to ode mne vše.

[dantos]

ok opět díky chtěl by Vám popřét den bez viru, ale aby to nebylo vzato jako špatný ftip