Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

další Facebok vir...

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#16 Příspěvek od Sibi95 »

tak doufám, že to tam dlouho strašit nebude :D
a z vaši pomoci to dostaneme ven :thumbsup:

:arrow: zde jsou log soubory:

Extras.txt

OTL Extras logfile created on: 24. 8. 2011 10:32:13 - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Martin.MŮJ\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 70,83% Memory free
3,85 Gb Paging File | 3,43 Gb Available in Paging File | 89,06% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 111,92 Gb Free Space | 37,54% Space Free | Partition Type: NTFS

Computer Name: PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "E:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1"
Directory [Winamp.Enqueue] -- "E:\Program Files\Winamp\winamp.exe" /ADD "%1"
Directory [Winamp.Play] -- "E:\Program Files\Winamp\winamp.exe" "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1
"DisableThumbnailCache" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"86:TCP" = 86:TCP:*:Enabled:BroadCam Video Streaming Server Web Server
"1935:TCP" = 1935:TCP:*:Enabled:BroadCam Video Streaming Server Flash Video Server
"4100:UDP" = 4100:UDP:*:Enabled:uPNP Router Control Port

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Průvodce přenesením souborů a nastavení -- (Microsoft Corporation)
"C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager -- (Electronic Arts)
"C:\Program Files\Opera 10 Preview\opera.exe" = C:\Program Files\Opera 10 Preview\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()
"C:\Program Files\Valve\hl.exe" = C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\ICQ6.5\ICQ.exe" = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Program Files\Codemasters\GRID\GRID.exe" = C:\Program Files\Codemasters\GRID\GRID.exe:*:Enabled:GRID -- (Codemasters)
"C:\Program Files\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe" = C:\Program Files\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe:*:Enabled:Landwirtschafts Simulator 2011 -- (GIANTS Software GmbH)
"C:\Program Files\Landwirtschafts Simulator 2011\game.exe" = C:\Program Files\Landwirtschafts Simulator 2011\game.exe:*:Enabled:Landwirtschafts Simulator 2011 -- (GIANTS Software GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0316.1
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}" = LUMIX Simple Viewer
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{4E906533-F57F-45BD-A837-FCF24A2C243E}" = TubeSucker
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587A2120-41D3-11DB-3D6C-00E19E4D4AE1}" = MSTS Patch 1.7.0519
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D45EF03-E8EE-4355-81C3-F918CBCF1033}" = Nero 8
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{936B67BE-1EB4-4D98-815A-EA1E75FFED2F}" = Counter-Strike Source Final 07102004
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{9FFCA0EC-5035-44C0-9AA7-177D72902170}" = LS Capture
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Software Kodak EasyShare
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E8AEA11B-E60A-455E-B008-E4E763604612}" = Browser Configuration Utility
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"504244733D18C8F63FF584AEB290E3904E791693" = Balíček ovladače systému Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Balíček ovladače systému Windows - Nokia Modem (10/07/2010 4.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"E5372C32E8562C76C24DBA6525002B1031495F34" = Balíček ovladače systému Windows - Nokia Modem (06/09/2010 7.01.0.8)
"EADM" = EA Download Manager
"EXPERTool_is1" = EXPERTool 7.5
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"FMCODEC" = FM Screen Capture Codec (Remove Only)
"FormatFactory" = FormatFactory 2.70
"ICQToolbar" = ICQ Toolbar
"ie8" = Windows Internet Explorer 8
"Lexmark X1100 Series" = Lexmark X1100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Opera 11.50.1074" = Opera 11.50
"ProfiCAD_is1" = ProfiCAD
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"The KMPlayer" = The KMPlayer (remove only)
"Traktor Simulátor_is1" = Traktor Simulátor
"VLC media player" = VLC media player 1.0.5
"vReveal" = vReveal
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinFlash" = WinFlash
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"ZonerPhotoStudio12_CZ_is1" = Zoner Photo Studio 12

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 26. 7. 2011 7:47:28 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 27. 7. 2011 8:02:35 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 28. 7. 2011 7:48:38 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 2. 8. 2011 8:14:05 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 4. 8. 2011 7:54:08 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 10. 8. 2011 5:15:40 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 11. 8. 2011 7:29:56 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 12. 8. 2011 4:20:12 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 12. 8. 2011 8:03:50 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

Error - 15. 8. 2011 3:49:55 | Computer Name = PC | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 19. 8. 2011 12:38:42 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace CCleaner.exe, verze 2.28.0.1091, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 20. 8. 2011 4:22:45 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace eslite.exe, verze 1.0.0.1, chybující modul eslite.exe,
verze 1.0.0.1, adresa chyby 0x00007e94.

Error - 20. 8. 2011 6:07:03 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace , verze 0.0.0.0, chybující modul unknown, verze
0.0.0.0, adresa chyby 0x00000000.

Error - 21. 8. 2011 4:20:57 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace eslite.exe, verze 1.0.0.1, chybující modul eslite.exe,
verze 1.0.0.1, adresa chyby 0x00007e94.

Error - 21. 8. 2011 10:09:48 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace SkypeSetup.exe, verze 5.5.0.113, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 21. 8. 2011 10:09:48 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Zablokovaná aplikace SkypeSetup.exe, verze 5.5.0.113, zablokovaný
modul hungapp, verze 0.0.0.0, adresa bloku 0x00000000.

Error - 22. 8. 2011 4:22:07 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Chybující aplikace roguekiller.exe, verze 0.0.0.0, chybující modul
, verze 0.0.0.0, adresa chyby 0x00000000.

Error - 22. 8. 2011 15:57:36 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

Error - 23. 8. 2011 9:16:39 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

Error - 23. 8. 2011 15:17:45 | Computer Name = PC | Source = crypt32 | ID = 131080
Description = Načtení automatické aktualizace pořadového čísla kořenového seznamu
jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt>
se nezdařilo. Chyba: A connection with the server could not be established

[ System Events ]
Error - 21. 8. 2011 3:34:04 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 21. 8. 2011 9:54:14 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 21. 8. 2011 9:54:16 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 22. 8. 2011 4:16:01 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 22. 8. 2011 4:16:05 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 23. 8. 2011 3:37:40 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 23. 8. 2011 3:37:44 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Služba Cardex neuspěla při spuštění v důsledku následující chyby:
%%183

Error - 23. 8. 2011 15:12:56 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 23. 8. 2011 15:34:26 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH

Error - 24. 8. 2011 4:11:48 | Computer Name = PC | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: WINFLASH


< End of report >


a zde OTL.txt

OTL logfile created on: 24. 8. 2011 10:32:11 - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Martin.MŮJ\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d. M. yyyy

2,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 70,83% Memory free
3,85 Gb Paging File | 3,43 Gb Available in Paging File | 89,06% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 111,92 Gb Free Space | 37,54% Space Free | Partition Type: NTFS

Computer Name: PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.08.24 10:24:45 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.05.12 15:43:36 | 002,181,672 | ---- | M] (Gainward Co.) -- C:\Program Files\EXPERTool\TBPANEL.exe
PRC - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2008.12.22 14:48:38 | 000,108,032 | ---- | M] (Opera Software) -- C:\Documents and Settings\Martin.MŮJ\Plocha\bezedná složka\opera stará\Opera 10 Preview\opera.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.09.07 16:25:12 | 001,151,090 | ---- | M] (Ahead Software AG) -- C:\Program Files\Ahead\InCD\InCDsrv.exe
PRC - [2003.08.19 17:00:40 | 000,053,248 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
PRC - [2003.08.19 16:36:22 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe


========== Modules (No Company Name) ==========

MOD - [2011.08.24 08:59:40 | 001,288,192 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082400\algo.dll
MOD - [2011.08.23 16:54:58 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082400\aswRep.dll
MOD - [2011.08.23 11:30:11 | 001,288,704 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082300\algo.dll
MOD - [2011.08.23 01:30:21 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082300\aswRep.dll
MOD - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
MOD - [2009.03.13 11:30:44 | 000,109,096 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2003.08.03 21:58:08 | 000,065,536 | ---- | M] () -- C:\Program Files\Lexmark X1100 Series\ConvDIB.dll
MOD - [2003.07.29 15:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\System32\spool\prtprocs\w32x86\LXBKPP5C.DLL
MOD - [1998.10.31 10:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files\EXPERTool\TBMANAGE.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010.12.08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.08.16 14:01:16 | 000,222,968 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.03.02 14:06:16 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2004.09.07 16:25:12 | 001,151,090 | ---- | M] (Ahead Software AG) [Auto | Running] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrv)


========== Driver Services (SafeList) ==========

DRV - [2011.08.24 10:11:40 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.07.04 13:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.07.04 13:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.07.30 14:16:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.07.30 14:16:44 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.07.30 14:16:42 | 000,023,040 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.07.30 14:16:38 | 000,018,048 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.11.28 21:40:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.10.12 21:24:56 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009.10.12 21:24:54 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009.10.12 21:24:52 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009.01.20 12:53:06 | 005,027,840 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.10.30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.07.30 07:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\acedrv11.sys -- (acedrv11)
DRV - [2007.03.16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TBPanel.sys -- (TBPanel)
DRV - [2007.03.16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\TBPanel.sys -- (Cardex)
DRV - [2004.09.07 16:27:38 | 000,028,544 | ---- | M] (Ahead Software AG) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\InCDpass.sys -- (InCDPass)
DRV - [2004.09.07 16:27:22 | 000,091,136 | ---- | M] (Ahead Software AG) [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\InCDfs.sys -- (InCDfs)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========




IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\System32\dvmurl.dll (DeviceVM Inc.)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

[2011.08.12 10:22:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com

O1 HOSTS File: ([2011.08.23 21:34:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\System32\Drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Lexmark X1100 Series] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKU\S-1-5-21-2000478354-515967899-682003330-1004..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Hlavní panel ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk = C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O7 - HKU\##aswSnx private storage\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.25 13:38:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.08.24 10:24:45 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
[2011.08.23 16:11:25 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Martin.MŮJ\Recent
[2011.08.22 21:53:14 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.08.22 21:48:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011.08.22 21:48:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011.08.22 21:48:07 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011.08.22 21:48:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011.08.22 21:47:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.08.22 21:47:46 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.08.22 21:44:39 | 004,180,785 | R--- | C] (Swearware) -- C:\Documents and Settings\Martin.MŮJ\Plocha\ComboFix.exe
[2011.08.22 10:23:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Malwarebytes
[2011.08.22 10:23:13 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.22 10:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Malwarebytes' Anti-Malware
[2011.08.22 10:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Malwarebytes
[2011.08.22 10:23:10 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.08.22 10:23:10 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.08.22 10:22:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Plocha\viry
[2011.08.22 10:21:44 | 000,000,000 | ---D | C] -- C:\RK_Quarantine
[2011.08.21 16:09:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Skype
[2011.08.20 13:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011.08.20 13:42:42 | 000,000,000 | ---D | C] -- C:\rsit
[2011.08.19 20:10:39 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011.08.19 20:10:25 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011.08.19 19:07:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\avast! Free Antivirus
[2011.08.19 19:07:00 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011.08.19 19:06:44 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011.08.19 19:06:37 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011.08.19 19:06:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 18:09:48 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.08.24 10:24:45 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Martin.MŮJ\Plocha\OTL.exe
[2011.08.24 10:12:12 | 000,230,486 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2011.08.24 10:12:07 | 000,000,936 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.24 10:11:40 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys
[2011.08.24 10:11:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.24 10:11:18 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.23 21:34:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011.08.23 16:01:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.08.23 15:57:00 | 000,000,940 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.23 13:11:29 | 000,000,743 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\Multi-4.lnk
[2011.08.23 13:06:01 | 000,002,499 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\LS Capture 2.0.lnk
[2011.08.23 11:35:14 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.08.23 10:16:24 | 000,000,774 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101621.reg
[2011.08.23 10:16:03 | 000,012,832 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101554.reg
[2011.08.22 21:53:19 | 000,000,331 | RHS- | M] () -- C:\boot.ini
[2011.08.22 21:45:07 | 004,180,785 | R--- | M] (Swearware) -- C:\Documents and Settings\Martin.MŮJ\Plocha\ComboFix.exe
[2011.08.22 18:24:01 | 016,535,552 | R--- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Dokumenty\ESBK.mbb
[2011.08.22 18:24:01 | 007,727,104 | R--- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Dokumenty\ESBK.mb
[2011.08.22 10:17:42 | 000,569,856 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RogueKiller.exe
[2011.08.20 15:26:38 | 000,435,814 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.20 15:26:38 | 000,432,696 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2011.08.20 15:26:38 | 000,079,660 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2011.08.20 15:26:38 | 000,068,710 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.20 13:42:31 | 000,781,383 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RSIT.exe
[2011.08.20 13:38:41 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.20 13:22:43 | 000,002,557 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011.08.19 20:16:45 | 003,567,832 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.19 19:07:02 | 000,001,706 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\avast! Free Antivirus.lnk
[2011.08.19 18:48:39 | 000,000,215 | ---- | M] () -- C:\Boot.bak
[2011.08.18 18:12:16 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
[2011.08.18 09:32:31 | 000,000,082 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\default.pls
[2011.08.15 12:25:32 | 000,067,584 | ---- | M] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.08 15:09:18 | 000,000,328 | ---- | M] () -- C:\WINDOWS\lexstat.ini
[2011.07.25 17:08:54 | 005,969,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.08.23 10:16:23 | 000,000,774 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101621.reg
[2011.08.23 10:16:00 | 000,012,832 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Dokumenty\cc_20110823_101554.reg
[2011.08.22 21:53:19 | 000,000,215 | ---- | C] () -- C:\Boot.bak
[2011.08.22 21:53:17 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2011.08.22 21:48:07 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.08.22 21:48:07 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.08.22 21:48:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.08.22 21:48:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.08.22 21:48:07 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011.08.22 10:17:42 | 000,569,856 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RogueKiller.exe
[2011.08.20 13:42:24 | 000,781,383 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Plocha\RSIT.exe
[2011.08.20 09:24:52 | 000,001,515 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Opera.lnk
[2011.08.19 19:07:02 | 000,001,706 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Plocha\avast! Free Antivirus.lnk
[2011.08.18 18:00:44 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011.08.18 17:52:23 | 2145,898,496 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.12 10:22:18 | 000,000,236 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011.05.06 19:45:42 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.07.30 12:54:43 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\PnkBstrK.sys
[2010.07.30 12:54:22 | 002,337,865 | ---- | C] () -- C:\WINDOWS\System32\pbsvc.exe
[2010.07.10 09:32:15 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2010.07.10 09:32:15 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2010.07.10 09:32:15 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2010.07.10 09:32:15 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2010.06.19 10:04:06 | 000,000,009 | ---- | C] () -- C:\WINDOWS\nfsc_patch.ini
[2010.05.02 11:02:27 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009.12.27 12:20:43 | 000,001,763 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\QTSBandwidthCache
[2009.10.29 16:05:59 | 000,000,082 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\default.pls
[2009.10.17 12:30:14 | 000,000,390 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.10.08 17:29:28 | 000,066,872 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2009.10.08 17:29:27 | 000,138,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.10.08 17:29:22 | 000,183,112 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2009.09.11 18:15:12 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.08.19 11:19:15 | 000,000,328 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2009.08.19 10:52:27 | 000,067,584 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.19 10:46:48 | 000,000,007 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\bin.dll
[2009.08.18 19:44:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009.08.18 18:19:26 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2009.08.18 17:44:17 | 000,004,249 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.08.18 17:42:31 | 003,567,832 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.08.18 16:34:30 | 000,003,538 | ---- | C] () -- C:\WINDOWS\System32\drivers\WinFlash.sys
[2009.08.18 16:18:11 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\FASTWiz.html
[2009.08.18 15:58:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.08.18 15:53:46 | 000,021,812 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.06.07 13:27:20 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\vbzlib1.dll
[2009.05.21 06:12:56 | 001,579,630 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2009.05.21 06:12:56 | 000,007,274 | ---- | C] () -- C:\WINDOWS\cadx2.ini
[2009.05.01 00:31:10 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009.05.01 00:31:08 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009.05.01 00:31:08 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2009.05.01 00:31:06 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.05.01 00:31:06 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.05.01 00:31:06 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.05.01 00:31:06 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2005.09.20 18:43:22 | 000,000,502 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004.08.18 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.18 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.18 14:00:00 | 000,435,814 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.18 14:00:00 | 000,432,696 | ---- | C] () -- C:\WINDOWS\System32\perfh005.dat
[2004.08.18 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.18 14:00:00 | 000,269,162 | ---- | C] () -- C:\WINDOWS\System32\perfi005.dat
[2004.08.18 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.18 14:00:00 | 000,079,660 | ---- | C] () -- C:\WINDOWS\System32\perfc005.dat
[2004.08.18 14:00:00 | 000,068,710 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.18 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.18 14:00:00 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\perfd005.dat
[2004.08.18 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.18 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.18 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.18 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.18 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003.08.18 16:55:48 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBKIH.EXE
[2003.08.18 16:46:38 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL
[2003.04.09 16:38:04 | 000,005,664 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.11.13 21:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll
[2002.09.13 17:40:06 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini
[2001.01.19 21:50:20 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE
[2001.01.12 11:49:38 | 000,021,504 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2000.09.08 18:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll

========== LOP Check ==========

[2009.09.20 09:04:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ArcticLine
[2010.08.05 14:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009.08.24 10:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\DAEMON Tools Lite
[2009.11.27 18:35:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\DAEMON Tools Pro
[2009.08.18 16:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ESET
[2011.03.12 12:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\FreeScreenToVideo
[2010.10.03 09:11:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ICQ
[2009.10.08 17:24:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Leadertech
[2009.08.19 10:47:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\My Games
[2010.06.19 13:13:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Nokia
[2011.05.24 16:56:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Opera
[2009.08.19 10:46:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Panasonic
[2010.06.19 13:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\PC Suite
[2011.04.09 15:02:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ProfiCAD
[2010.04.24 15:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\ProtectDisc
[2011.05.06 19:22:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\QIP
[2009.08.19 10:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Sachy
[2009.08.19 10:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Search Settings
[2009.08.31 10:47:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Transcend
[2009.12.13 12:14:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\uTorrent
[2010.08.28 09:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Zoner
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\BVRP Software
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ESET
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Grisoft
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\NFS Underground
[2009.08.16 16:53:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2009.08.16 16:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\The Learning Company
[2011.08.19 19:06:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
[2009.08.19 11:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\BVRP Software
[2011.07.03 09:41:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Codemasters
[2009.11.28 21:40:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\DAEMON Tools Lite
[2011.01.14 19:41:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\EA Core
[2011.01.14 19:41:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Electronic Arts
[2009.12.06 11:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Grisoft
[2011.06.10 18:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\ICQ
[2011.05.13 16:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Installations
[2009.08.19 12:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\MotionDSP
[2010.06.19 13:07:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\PC Suite
[2010.08.04 16:30:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
[2010.03.13 17:38:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
[2010.07.30 12:55:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Ubisoft
[2011.06.04 13:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\DAEMON Tools Lite
[2009.08.18 18:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\ESET
[2010.07.02 09:23:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\Grisoft
[2011.02.14 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\Opera
[2010.12.18 12:51:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jája.MŮJ\Data aplikací\PC Suite
[2009.08.16 16:53:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Data aplikací\MEGAUPLOADTOOLBAR
[2009.08.20 09:45:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Martin\Data aplikací\Opera
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Dealio
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ESET
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Grisoft
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ICQ
[2009.08.16 16:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\ICQ Toolbar
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\MEGAUPLOADTOOLBAR
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Opera
[2009.08.16 16:55:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\oem\Data aplikací\Search Settings
[2011.06.07 15:07:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\DAEMON Tools Lite
[2009.08.19 10:19:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\ESET
[2010.04.12 10:47:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Grisoft
[2010.12.23 18:08:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Opera
[2009.08.23 09:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\Panasonic
[2010.12.12 16:10:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Táta\Data aplikací\PC Suite
[2011.08.23 16:01:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< dfiles
%systemroot%\*.* /U /s
%systemroot%\*. /mp /s
%ALLUSERSPROFILE%\Data Aplikací\*.*
%ALLUSERSPROFILE%\Data Aplikací\*.exe /s
%ALLUSERSPROFILE%\Dáta aplikácií\*.*
%ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s
%APPDATA%\*.
%APPDATA%\*.*
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe


HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager" /v BootExecute /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations" /c

type >

< c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5 >
Invalid Switch: c
%SystemDrive%\PhysicalMBR.bin


========== Alternate Data Streams ==========

@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

< End of report >
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#17 Příspěvek od motji »

Omlouvám se za zpoždění.

:arrow: Spustte OTL
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]

-klikněte na tlačítko opravit.
-Následně se pc restartuje.
- Log vložte zde :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#18 Příspěvek od Sibi95 »

néééé nic se něděje.. hned jdu na to
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#19 Příspěvek od Sibi95 »

a zase mám to OLT nastavit jako minule???? ty uživatele a tu havět....
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#20 Příspěvek od motji »

uživatele ano, jinak ne
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#21 Příspěvek od Sibi95 »

tak zde je log

All processes killed
Error: Unable to interpret <:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.d> in the current context!
Error: Unable to interpret <ll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://s> in the current context!
Error: Unable to interpret <earch.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microso> in the current context!
Error: Unable to interpret <ft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTL by OldTimer - Version 3.2.26.5 log created on 08242011_224100

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


a PC se samo nerestartovalo došlo po napis vypinání.. a tak jsem zmáčkl tlačitko na skřini.. doufám, že jsem tim neudělal chybu :cry:
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#22 Příspěvek od motji »

Dal jste tlačítko opravit?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#23 Příspěvek od Sibi95 »

ano dal.. je to napsané červěně pod tlačitkem Prohledat... Je tedy někde chyba???
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#24 Příspěvek od motji »

Ano, skript se neprovedl. Zkuste to prosím znovu. Zkopírujte pouze ten zelený text.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#25 Příspěvek od Sibi95 »

kopiroval jsem tedy jen zelený text.. A pořád beze změny.. naběhne jed to ,,vypinání" a dále nic... :( Napadlo mě jestli nědělám chybu třeba v tom, že vypinám Avasta, protože mi OLT háže do sandboxu a proto ho vypinám aby mě neotravoval... Neni třeba chyba v tom???? :roll:

budu to zkoušet.. jestli to náhodou jednou nenazkoči.....
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#26 Příspěvek od motji »

Zkuste to ještě v nouzovém režimu.
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#27 Příspěvek od Sibi95 »

táák do nouzového režimu jsem se dostal sice mě to chvíli trvalo, páč mám klávesnici na USB a mačkání F8 neregovalo, tak jsem to dělal dle návodu co jsem našel tady na webu http://www.viry.cz/forum/viewtopic.php?t=7554, a PC se už konečně samo resetovalo Takže doufám, že těd už se to povedlo správně :wub:

:arrow: zde tedy přikládám Log soubor

All processes killed
Error: Unable to interpret <:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 974 bytes -> C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C
[2011.08.18 18:12:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011.08.18 17:52:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0-lnk
[2011.08.18 17:50:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-3-0
[2011.08.12 10:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
[2011.08.12 10:22:15 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.d> in the current context!
Error: Unable to interpret <ll (Ask)
O3 - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
[2011.08.12 10:22:20 | 000,000,000 | ---D | M] (Ask Toolbar Toolbar) -- C:\Documents and Settings\Martin.MŮJ\Data aplikací\Mozilla\Firefox\Profiles\rerampr4.default\extensions\toolbar@ask.com
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Martin.MŮJ\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://s> in the current context!
Error: Unable to interpret <earch.qip.ru
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2000478354-515967899-682003330-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe

:reg
[HKEY_CURRENT_USER\Software\Microso> in the current context!
Error: Unable to interpret <ft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192614

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#28 Příspěvek od Sibi95 »

a dneska spěchat nemusíte.. ukážu se tady až ráno :wink:
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: další Facebok vir...

#29 Příspěvek od motji »

Není. Tak ještě jeden pokus :) .

:arrow:Stáhněte OTM http://oldtimer.geekstogo.com/OTM.exe
Stáhněte na plochu Otm, 2krát klikněte na Otm,spustí se program,
Do levého okna "Paste Instructions for Items to be Moved" pod žlutou čáru zkopírujete skript

Kód: Vybrat vše

:processes
explorer.exe
 
:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe
C:\Program Files\Ask.com
C:\WINDOWS\ufa
C:\WINDOWS\av_ico
 C:\WINDOWS\update.tray-7-0-lnk
C:\WINDOWS\update.tray-7-0
C:\WINDOWS\update.tray-3-0-lnk
C:\WINDOWS\update.tray-3-0
C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
@C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]
-klikněte na červené tlačítko Moveit!
-sem vložte obsah zeleného okénka
-Pokud se bude chtít restartovat pc, dejte YES,log pak najdete C:\_OTM\MovedFiles. Log vložte sem
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
Sibi95
Návštěvník
Návštěvník
Příspěvky: 41
Registrován: 20 srp 2011 12:48
Bydliště: Haná ( Litovel)
Kontaktovat uživatele:
Kontaktovat uživatele Sibi95

Re: další Facebok vir...

#30 Příspěvek od Sibi95 »

tak OTM mi vyhodilo v zeleném okénku tohle:

All processes killed
Error: Unable to interpret <:processes
explorer.exe

:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\oem\Data aplikací\Search Settings
C:\Documents and Settings\oem\Data aplikací\Dealio
C:\Documents and Settings\All Users.WINDOWS\Data aplikací\regid.1986-12.com.adobe
C:\WINDOWS\unrar.exe
C:\WINDOWS\System32\ezsidmv.dat
c:\windows\Temp\rtdrvmon.exe
C:\Program Files\Ask.com
C:\WINDOWS\ufa
C:\WINDOWS\av_ico
C:\WINDOWS\update.tray-7-0-lnk
C:\WINDOWS\update.tray-7-0
C:\WINDOWS\update.tray-3-0-lnk
C:\WINDOWS\update.tray-3-0
C:\Documents and Settings\Martin.MŮJ\Local Settings\Data aplikací\AskToolbar
@C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP:24721E3C

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-85> in the current context!
Error: Unable to interpret <38-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]> in the current context!

OTM by OldTimer - Version 3.1.18.0 log created on 08262011_091844

PC nemělo potřebu se restartovat a log se neukázal a ani složka OTM...
je to správně?? já to chápu tak, že by se vše ukázalo pokud by se PC restartovolo :?:
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“