další Facebok vir...

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#16 Příspěvek od Sibi95 »

tak doufám, že to tam dlouho strašit nebude :D
a z vaši pomoci to dostaneme ven :thumbsup:

:arrow: zde jsou log soubory:

Extras.txt

OTL Extras logfile created on: 24. 8. 2011 10:32:13 - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Martin.MŮJ\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 70,83% Memory free
3,85 Gb Paging File | 3,43 Gb Available in Paging File | 89,06% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 111,92 Gb Free Space | 37,54% Space Free | Partition Type: NTFS

Computer Name: PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "E:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1"
Directory [Winamp.Enqueue] -- "E:\Program Files\Winamp\winamp.exe" /ADD "%1"
Directory [Winamp.Play] -- "E:\Program Files\Winamp\winamp.exe" "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1
"DisableThumbnailCache" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"86:TCP" = 86:TCP:*:Enabled:BroadCam Video Streaming Server Web Server
"1935:TCP" = 1935:TCP:*:Enabled:BroadCam Video Streaming Server Flash Video Server
"4100:UDP" = 4100:UDP:*:Enabled:uPNP Router Control Port

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Průvodce přenesením souborů a nastavení -- (Microsoft Corporation)
"C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager -- (Electronic Arts)
"C:\Program Files\Opera 10 Preview\opera.exe" = C:\Program Files\Opera 10 Preview\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()
"C:\Program Files\Valve\hl.exe" = C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Program Files\Codemasters\GRID\GRID.exe" = C:\Program Files\Codemasters\GRID\GRID.exe:*:Enabled:GRID -- (Codemasters)
"C:\Program Files\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe" = C:\Program Files\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe:*:Enabled:Landwirtschafts Simulator 2011 -- (GIANTS Software GmbH)
"C:\Program Files\Landwirtschafts Simulator 2011\game.exe" = C:\Program Files\Landwirtschafts Simulator 2011\game.exe:*:Enabled:Landwirtschafts Simulator 2011 -- (GIANTS Software GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0316.1
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}" = LUMIX Simple Viewer
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{4E906533-F57F-45BD-A837-FCF24A2C243E}" = TubeSucker
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587A2120-41D3-11DB-3D6C-00E19E4D4AE1}" = MSTS Patch 1.7.0519
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D45EF03-E8EE-4355-81C3-F918CBCF1033}" = Nero 8
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{936B67BE-1EB4-4D98-815A-EA1E75FFED2F}" = Counter-Strike Source Final 07102004
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{9FFCA0EC-5035-44C0-9AA7-177D72902170}" = LS Capture
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Software Kodak EasyShare
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E8AEA11B-E60A-455E-B008-E4E763604612}" = Browser Configuration Utility
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"504244733D18C8F63FF584AEB290E3904E791693" = Balíček ovladače systému Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Balíček ovladače systému Windows - Nokia Modem (10/07/2010 4.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"E5372C32E8562C76C24DBA6525002B1031495F34" = Balíček ovladače systému Windows - Nokia Modem (06/09/2010 7.01.0.8)
"EADM" = EA Download Manager
"EXPERTool_is1" = EXPERTool 7.5
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"FMCODEC" = FM Screen Capture Codec (Remove Only)
"FormatFactory" = FormatFactory 2.70
"ICQToolbar" = ICQ Toolbar
"ie8" = Windows Internet Explorer 8
"Lexmark X1100 Series" = Lexmark X1100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Opera 11.50.1074" = Opera 11.50
"ProfiCAD_is1" = ProfiCAD
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"The KMPlayer" = The KMPlayer (remove only)
"Traktor Simulátor_is1" = Traktor Simulátor
"VLC media player" = VLC media player 1.0.5
"vReveal" = vReveal
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinFlash" = WinFlash
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZonerPhotoStudio12_CZ_is1" = Zoner Photo Studio 12

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 26. 7. 2011 7:47:28 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 27. 7. 2011 8:02:35 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 28. 7. 2011 7:48:38 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 2. 8. 2011 8:14:05 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 4. 8. 2011 7:54:08 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 10. 8. 2011 5:15:40 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 11. 8. 2011 7:29:56 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 12. 8. 2011 4:20:12 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 12. 8. 2011 8:03:50 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 15. 8. 2011 3:49:55 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 19. 8. 2011 12:38:42 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace CCleaner.exe, verze 2.28.0.1091, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 20. 8. 2011 4:22:45 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace eslite.exe, verze 1.0.0.1, chybující modul eslite.exe,
verze 1.0.0.1, adresa chyby 0x00007e94.

Error - 20. 8. 2011 6:07:03 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace , verze 0.0.0.0, chybující modul unknown, verze
0.0.0.0, adresa chyby 0x00000000.

Error - 21. 8. 2011 4:20:57 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace eslite.exe, verze 1.0.0.1, chybující modul eslite.exe,
verze 1.0.0.1, adresa chyby 0x00007e94.

Error - 21. 8. 2011 10:09:48 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace SkypeSetup.exe, verze 5.5.0.113, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 21. 8. 2011 10:09:48 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace SkypeSetup.exe, verze 5.5.0.113, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 22. 8. 2011 4:22:07 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace roguekiller.exe, verze 0.0.0.0, chybující modul
, verze 0.0.0.0, adresa chyby 0x00000000.

Error - 22. 8. 2011 15:57:36 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

Error - 23. 8. 2011 9:16:39 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

Error - 23. 8. 2011 15:17:45 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

[ System Events ]
Error - 21. 8. 2011 3:34:04 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 21. 8. 2011 9:54:14 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 21. 8. 2011 9:54:16 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 22. 8. 2011 4:16:01 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 22. 8. 2011 4:16:05 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 23. 8. 2011 3:37:40 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 23. 8. 2011 3:37:44 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 23. 8. 2011 15:12:56 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 23. 8. 2011 15:34:26 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 24. 8. 2011 4:11:48 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH


< End of report >


a zde OTL.txt

OTL logfile created on: 24. 8. 2011 10:32:11 - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Martin.MŮJ\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 70,83% Memory free
3,85 Gb Paging File | 3,43 Gb Available in Paging File | 89,06% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 111,92 Gb Free Space | 37,54% Space Free | Partition Type: NTFS

Computer Name: PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.08.24 10:24:45 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.05.12 15:43:36 | 002,181,672 | ---- | M] (Gainward Co.) -- C:\Program Files\EXPERTool\TBPANEL.exe
PRC - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2008.12.22 14:48:38 | 000,108,032 | ---- | M] (Opera Software) -- C:\Documents and Settings\Martin.MŮJ\Plocha\bezedná složka\opera stará\Opera 10 Preview\opera.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.09.07 16:25:12 | 001,151,090 | ---- | M] (Ahead Software AG) -- C:\Program Files\Ahead\InCD\InCDsrv.exe
PRC - [2003.08.19 17:00:40 | 000,053,248 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
PRC - [2003.08.19 16:36:22 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe


========== Modules (No Company Name) ==========

MOD - [2011.08.24 08:59:40 | 001,288,192 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082400\algo.dll
MOD - [2011.08.23 16:54:58 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082400\aswRep.dll
MOD - [2011.08.23 11:30:11 | 001,288,704 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082300\algo.dll
MOD - [2011.08.23 01:30:21 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082300\aswRep.dll
MOD - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
MOD - [2009.03.13 11:30:44 | 000,109,096 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2003.08.03 21:58:08 | 000,065,536 | ---- | M] () -- C:\Program Files\Lexmark X1100 Series\ConvDIB.dll
MOD - [2003.07.29 15:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\System32\spool\prtprocs\w32x86\LXBKPP5C.DLL
MOD - [1998.10.31 10:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files\EXPERTool\TBMANAGE.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010.12.08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2004.09.07 16:25:12 | 001,151,090 | ---- | M] (Ahead Software AG) [Auto | Running] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrv)


========== Driver Services (SafeList) ==========

DRV - [2011.08.24 10:11:40 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.07.04 13:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.07.04 13:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.07.30 14:16:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.07.30 14:16:44 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.07.30 14:16:42 | 000,023,040 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.07.30 14:16:38 | 000,018,048 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.11.28 21:40:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.10.12 21:24:56 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009.10.12 21:24:54 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009.10.12 21:24:52 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009.01.20 12:53:06 | 005,027,840 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.10.30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.07.30 07:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\acedrv11.sys -- (acedrv11)
DRV - [2007.03.16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TBPanel.sys -- (TBPanel)
DRV - [2007.03.16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\TBPanel.sys -- (Cardex)
DRV - [2004.09.07 16:27:38 | 000,028,544 | ---- | M] (Ahead Software AG) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\InCDpass.sys -- (InCDPass)
DRV - [2004.09.07 16:27:22 | 000,091,136 | ---- | M] (Ahead Software AG) [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\InCDfs.sys -- (InCDfs)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========




IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\System32\dvmurl.dll (DeviceVM Inc.)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

[2011.08.12 10:22:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com

O1 HOSTS File: ([2011.08.23 21:34:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\System32\Drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Lexmark X1100 Series] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKU\S-1-5-21-2000478354-515967899-682003330-1004..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Hlavní panel ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk = C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O7 - HKU\##aswSnx private storage\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.25 13:38:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.08.24 10:24:45 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
[2011.08.23 16:11:25 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Martin.MŮJ\Recent
[2011.08.22 21:53:14 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.08.22 21:48:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011.08.22 21:48:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011.08.22 21:48:07 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011.08.22 21:48:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011.08.22 21:47:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.08.22 21:47:46 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.08.22 21:44:39 | 004,180,785 | R--- | C] (Swearware) -- C:\Documents and Settings\Martin.MŮJ\Plocha\ComboFix.exe
[2011.08.22 10:23:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Malwarebytes
[2011.08.22 10:23:13 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.22 10:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Malwarebytes' Anti-Malware
[2011.08.22 10:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2011.08.22 10:23:10 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.08.22 10:23:10 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.08.22 10:22:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Plocha\viry
[2011.08.22 10:21:44 | 000,000,000 | ---D | C] -- C:\RK_Quarantine
[2011.08.21 16:09:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Skype
[2011.08.20 13:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011.08.20 13:42:42 | 000,000,000 | ---D | C] -- C:\rsit
[2011.08.19 20:10:39 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011.08.19 20:10:25 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011.08.19 19:07:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\avast! Free Antivirus
[2011.08.19 19:07:00 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011.08.19 19:06:44 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011.08.19 19:06:37 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011.08.19 19:06:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 18:09:48 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.08.24 10:24:45 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
[2011.08.24 10:12:12 | 000,230,486 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2011.08.24 10:12:07 | 000,000,936 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.24 10:11:40 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys
[2011.08.24 10:11:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.24 10:11:18 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.23 21:34:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011.08.23 16:01:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.08.23 15:57:00 | 000,000,940 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.23 13:11:29 | 000,000,743 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\Multi-4.lnk
[2011.08.23 13:06:01 | 000,002,499 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\LS Capture 2.0.lnk
[2011.08.23 11:35:14 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.08.23 10:16:24 | 000,000,774 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101621.reg
[2011.08.23 10:16:03 | 000,012,832 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101554.reg
[2011.08.22 21:53:19 | 000,000,331 | RHS- | M] () -- C:\boot.ini
[2011.08.22 21:45:07 | 004,180,785 | R--- | M] (Swearware) -- C:\Documents and Settings\Martin.MŮJ\Plocha\ComboFix.exe
[2011.08.22 18:24:01 | 016,535,552 | R--- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Dokumenty\ESBK.mbb
[2011.08.22 18:24:01 | 007,727,104 | R--- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Dokumenty\ESBK.mb
[2011.08.22 10:17:42 | 000,569,856 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RogueKiller.exe
[2011.08.20 15:26:38 | 000,435,814 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.20 15:26:38 | 000,432,696 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2011.08.20 15:26:38 | 000,079,660 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2011.08.20 15:26:38 | 000,068,710 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.20 13:42:31 | 000,781,383 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RSIT.exe
[2011.08.20 13:38:41 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.20 13:22:43 | 000,002,557 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011.08.19 20:16:45 | 003,567,832 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.19 19:07:02 | 000,001,706 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\avast! Free Antivirus.lnk
[2011.08.19 18:48:39 | 000,000,215 | ---- | M] () -- C:\Boot.bak
[2011.08.18 18:12:16 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
[2011.08.18 09:32:31 | 000,000,082 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\default.pls
[2011.08.15 12:25:32 | 000,067,584 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.08 15:09:18 | 000,000,328 | ---- | M] () -- C:\WINDOWS\lexstat.ini
[2011.07.25 17:08:54 | 005,969,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.08.23 10:16:23 | 000,000,774 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101621.reg
[2011.08.23 10:16:00 | 000,012,832 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101554.reg
[2011.08.22 21:53:19 | 000,000,215 | ---- | C] () -- C:\Boot.bak
[2011.08.22 21:53:17 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2011.08.22 21:48:07 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.08.22 21:48:07 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.08.22 21:48:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.08.22 21:48:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.08.22 21:48:07 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011.08.22 10:17:42 | 000,569,856 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RogueKiller.exe
[2011.08.20 13:42:24 | 000,781,383 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RSIT.exe
[2011.08.20 09:24:52 | 000,001,515 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Opera.lnk
[2011.08.19 19:07:02 | 000,001,706 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\avast! Free Antivirus.lnk
[2011.08.18 18:00:44 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011.08.18 17:52:23 | 2145,898,496 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.12 10:22:18 | 000,000,236 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.05.06 19:45:42 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.07.30 12:54:43 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\PnkBstrK.sys
[2010.07.30 12:54:22 | 002,337,865 | ---- | C] () -- C:\WINDOWS\System32\pbsvc.exe
[2010.07.10 09:32:15 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2010.07.10 09:32:15 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2010.07.10 09:32:15 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2010.07.10 09:32:15 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2010.06.19 10:04:06 | 000,000,009 | ---- | C] () -- C:\WINDOWS\nfsc_patch.ini
[2010.05.02 11:02:27 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009.12.27 12:20:43 | 000,001,763 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\QTSBandwidthCache
[2009.10.29 16:05:59 | 000,000,082 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\default.pls
[2009.10.17 12:30:14 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.10.08 17:29:28 | 000,066,872 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2009.10.08 17:29:27 | 000,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.10.08 17:29:22 | 000,183,112 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2009.09.11 18:15:12 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.08.19 11:19:15 | 000,000,328 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2009.08.19 10:52:27 | 000,067,584 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.19 10:46:48 | 000,000,007 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\bin.dll
[2009.08.18 19:44:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009.08.18 18:19:26 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2009.08.18 17:44:17 | 000,004,249 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.08.18 17:42:31 | 003,567,832 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.08.18 16:34:30 | 000,003,538 | ---- | C] () -- C:\WINDOWS\System32\drivers\WinFlash.sys
[2009.08.18 16:18:11 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\FASTWiz.html
[2009.08.18 15:58:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.08.18 15:53:46 | 000,021,812 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.06.07 13:27:20 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\vbzlib1.dll
[2009.05.21 06:12:56 | 001,579,630 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2009.05.21 06:12:56 | 000,007,274 | ---- | C] () -- C:\WINDOWS\cadx2.ini
[2009.05.01 00:31:10 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.05.01 00:31:08 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.05.01 00:31:08 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2009.05.01 00:31:06 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.05.01 00:31:06 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.05.01 00:31:06 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.05.01 00:31:06 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2005.09.20 18:43:22 | 000,000,502 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004.08.18 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.18 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.18 14:00:00 | 000,435,814 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.18 14:00:00 | 000,432,696 | ---- | C] () -- C:\WINDOWS\System32\perfh005.dat
[2004.08.18 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.18 14:00:00 | 000,269,162 | ---- | C] () -- C:\WINDOWS\System32\perfi005.dat
[2004.08.18 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.18 14:00:00 | 000,079,660 | ---- | C] () -- C:\WINDOWS\System32\perfc005.dat
[2004.08.18 14:00:00 | 000,068,710 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.18 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.18 14:00:00 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\perfd005.dat
[2004.08.18 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.18 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.18 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.18 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.18 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003.08.18 16:55:48 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBKIH.EXE
[2003.08.18 16:46:38 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL
[2003.04.09 16:38:04 | 000,005,664 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.11.13 21:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll
[2002.09.13 17:40:06 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini
[2001.01.19 21:50:20 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE
[2001.01.12 11:49:38 | 000,021,504 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2000.09.08 18:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll

========== LOP Check ==========

[2009.09.20 09:04:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ArcticLine
[2010.08.05 14:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009.08.24 10:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\DAEMON Tools Lite
[2009.11.27 18:35:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\DAEMON Tools Pro
[2009.08.18 16:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ESET
[2011.03.12 12:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\FreeScreenToVideo
[2010.10.03 09:11:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ICQ
[2009.10.08 17:24:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Leadertech
[2009.08.19 10:47:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\My Games
[2010.06.19 13:13:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Nokia
[2011.05.24 16:56:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Opera
[2009.08.19 10:46:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Panasonic
[2010.06.19 13:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\PC Suite
[2011.04.09 15:02:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ProfiCAD
[2010.04.24 15:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ProtectDisc
[2011.05.06 19:22:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\QIP
[2009.08.19 10:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Sachy
[2009.08.19 10:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Search Settings
[2009.08.31 10:47:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Transcend
[2009.12.13 12:14:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\uTorrent
[2010.08.28 09:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Zoner
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\BVRP Software
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Grisoft
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\NFS Underground
[2009.08.16 16:53:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\The Learning Company
[2011.08.19 19:06:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
[2009.08.19 11:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\BVRP Software
[2011.07.03 09:41:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Codemasters
[2009.11.28 21:40:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\DAEMON Tools Lite
[2011.01.14 19:41:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\EA Core
[2011.01.14 19:41:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Electronic Arts
[2009.12.06 11:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Grisoft
[2011.06.10 18:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2011.05.13 16:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Installations
[2009.08.19 12:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\MotionDSP
[2010.06.19 13:07:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\PC Suite
[2010.08.04 16:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
[2010.03.13 17:38:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.07.30 12:55:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Ubisoft
[2011.06.04 13:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\DAEMON Tools Lite
[2009.08.18 18:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\ESET
[2010.07.02 09:23:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\Grisoft
[2011.02.14 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\Opera
[2010.12.18 12:51:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\PC Suite
[2009.08.16 16:53:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Data aplikací\MEGAUPLOADTOOLBAR
[2009.08.20 09:45:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin\Data aplikací\Opera
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Dealio
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ESET
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Grisoft
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ICQ
[2009.08.16 16:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ICQ Toolbar
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\MEGAUPLOADTOOLBAR
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Opera
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Search Settings
[2011.06.07 15:07:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\DAEMON Tools Lite
[2009.08.19 10:19:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\ESET
[2010.04.12 10:47:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Grisoft
[2010.12.23 18:08:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Opera
[2009.08.23 09:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Panasonic
[2010.12.12 16:10:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\PC Suite
[2011.08.23 16:01:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< dfiles
%systemroot%\*.* /U /s
%systemroot%\*. /mp /s
%ALLUSERSPROFILE%\Data Aplikací\*.*
%ALLUSERSPROFILE%\Data Aplikací\*.exe /s
%ALLUSERSPROFILE%\Dáta aplikácií\*.*
%ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s
%APPDATA%\*.
%APPDATA%\*.*
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe


HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager" /v BootExecute /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations" /c

type >

< c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5 >
Invalid Switch: c
%SystemDrive%\PhysicalMBR.bin


========== Alternate Data Streams ==========

@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

< End of report >
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#17 Příspěvek od motji »

Omlouvám se za zpoždění.

:arrow: Spustte OTL
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]

-klikněte na tlačítko opravit.
-Následně se pc restartuje.
- Log vložte zde :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#18 Příspěvek od Sibi95 »

néééé nic se něděje.. hned jdu na to
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#19 Příspěvek od Sibi95 »

a zase mám to OLT nastavit jako minule???? ty uživatele a tu havět....
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#20 Příspěvek od motji »

uživatele ano, jinak ne
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#21 Příspěvek od Sibi95 »

tak zde je log

All processes killed
Error: Unable to interpret <:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.d> in the current context!
Error: Unable to interpret <ll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://s> in the current context!
Error: Unable to interpret <earch.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microso> in the current context!
Error: Unable to interpret <ft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTL by OldTimer - Version 3.2.26.5 log created on 08242011_224100

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


a PC se samo nerestartovalo došlo po napis vypinání.. a tak jsem zmáčkl tlačitko na skřini.. doufám, že jsem tim neudělal chybu :cry:
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#22 Příspěvek od motji »

Dal jste tlačítko opravit?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#23 Příspěvek od Sibi95 »

ano dal.. je to napsané červěně pod tlačitkem Prohledat... Je tedy někde chyba???
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#24 Příspěvek od motji »

Ano, skript se neprovedl. Zkuste to prosím znovu. Zkopírujte pouze ten zelený text.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#25 Příspěvek od Sibi95 »

kopiroval jsem tedy jen zelený text.. A pořád beze změny.. naběhne jed to ,,vypinání" a dále nic... :( Napadlo mě jestli nědělám chybu třeba v tom, že vypinám Avasta, protože mi OLT háže do sandboxu a proto ho vypinám aby mě neotravoval... Neni třeba chyba v tom???? :roll:

budu to zkoušet.. jestli to náhodou jednou nenazkoči.....
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#26 Příspěvek od motji »

Zkuste to ještě v nouzovém režimu.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#27 Příspěvek od Sibi95 »

táák do nouzového režimu jsem se dostal sice mě to chvíli trvalo, páč mám klávesnici na USB a mačkání F8 neregovalo, tak jsem to dělal dle návodu co jsem našel tady na webu http://www.viry.cz/forum/viewtopic.php?t=7554, a PC se už konečně samo resetovalo Takže doufám, že těd už se to povedlo správně :wub:

:arrow: zde tedy přikládám Log soubor

All processes killed
Error: Unable to interpret <:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.d> in the current context!
Error: Unable to interpret <ll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://s> in the current context!
Error: Unable to interpret <earch.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microso> in the current context!
Error: Unable to interpret <ft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192614

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#28 Příspěvek od Sibi95 »

a dneska spěchat nemusíte.. ukážu se tady až ráno :wink:
Nahoru
Avatar uživatele
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 Říj 2008 08:02

Re: další Facebok vir...

#29 Příspěvek od motji »

Není. Tak ještě jeden pokus :) .

:arrow:Stáhněte OTM http://oldtimer.geekstogo.com/OTM.exe
Stáhněte na plochu Otm, 2krát klikněte na Otm,spustí se program,
Do levého okna "Paste Instructions for Items to be Moved" pod žlutou čáru zkopírujete skript

Kód: Vybrat vše

:processes
explorer.exe
 
:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe
C:\Program Files\Ask.com
C:\WINDOWS\ufa
C:\WINDOWS\av_ico
 C:\WINDOWS\update.tray-7-0-lnk
C:\WINDOWS\update.tray-7-0
C:\WINDOWS\update.tray-3-0-lnk
C:\WINDOWS\update.tray-3-0
C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
@C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]
-klikněte na červené tlačítko Moveit!
-sem vložte obsah zeleného okénka
-Pokud se bude chtít restartovat pc, dejte YES,log pak najdete C:\_OTM\MovedFiles. Log vložte sem
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Avatar uživatele
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 Srp 2011 12:48
Místo/Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#30 Příspěvek od Sibi95 »

tak OTM mi vyhodilo v zeleném okénku tohle:

All processes killed
Error: Unable to interpret <:processes
explorer.exe

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe
C:\Program Files\Ask.com
C:\WINDOWS\ufa
C:\WINDOWS\av_ico
C:\WINDOWS\update.tray-7-0-lnk
C:\WINDOWS\update.tray-7-0
C:\WINDOWS\update.tray-3-0-lnk
C:\WINDOWS\update.tray-3-0
C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
@C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-85> in the current context!
Error: Unable to interpret <38-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTM by OldTimer - Version 3.1.18.0 log created on 08262011_091844

PC nemělo potřebu se restartovat a log se neukázal a ani složka OTM...
je to správně?? já to chápu tak, že by se vše ukázalo pokud by se PC restartovolo :?:
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“