Sekání,skrývaní souborů

Zpráva

frutas11 · #16 Příspěvek od **frutas11** » 26 říj 2011 19:19

Malwarebytes' Anti-Malware 1.50
http://www.malwarebytes.org

Verze databáze: 8024

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.10.2011 20:17:58
mbam-log-2011-10-26 (20-17-58).txt

Typ kontroly: Úplný test (C:\|D:\|)
Testované objekty: 204705
Uplynulý čas: 31 minut, 43 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 25
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CLASSES_ROOT\CLSID\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{1D4DB7D0-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1D4DB7D1-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\FunWebProductsInstaller.Start.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\FunWebProductsInstaller.Start (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)
-------------------------------------------------
OK,takže provedu opět scan v combofixu nebo-li nyní beruska.com

#17 Příspěvek od **vyosek** » 26 říj 2011 19:22

frutas11 píše: OK,takže provedu opět scan v combofixu nebo-li nyní beruska.com

Presne tak

frutas11 · #18 Příspěvek od **frutas11** » 26 říj 2011 19:24

Mám problémy s AVASTEM.ComboFix mi ukazuje tabulku že AVAST má zaplé rezidentní štíty přitom jsou vyplé.Tak sem vypnul celý AVAST,ve správci uloh -procesy již také není ale ono to pořád ukazuje že je zaplí

#19 Příspěvek od **vyosek** » 26 říj 2011 19:29

Hlasku odkliknete, obcas to dela...

frutas11 · #20 Příspěvek od **frutas11** » 26 říj 2011 19:29

Ok....Jakmile to bude hodím sem log.

#21 Příspěvek od **vyosek** » 26 říj 2011 19:32

Ok, kdyby neco, tak napiste...

frutas11 · #22 Příspěvek od **frutas11** » 26 říj 2011 19:49

Opět se sekl celý notebook,prostě to zamrzne a nejde stím nic dělat.

#23 Příspěvek od **vyosek** » 26 říj 2011 19:52

Stahnete OTL (viz muj podpis) a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
Zaskrtnete okenko Pro vsechny uzivatele
Zaskrtnete okenko Kontrola na havet "LOP"
Zaskrtnete okenko Kontrola na havet "Purity"
Stari souboru zmente z 30 dnu na 7 dnu
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c

type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s

Kliknete na tlacitko Prohledat
Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

frutas11 · #24 Příspěvek od **frutas11** » 26 říj 2011 20:09

OTL logfile created on: 26.10.2011 20:57:54 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

1022,92 Mb Total Physical Memory | 450,73 Mb Available Physical Memory | 44,06% Memory free
2,40 Gb Paging File | 1,98 Gb Available in Paging File | 82,55% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 1,96 Gb Free Space | 5,26% Space Free | Partition Type: NTFS

Computer Name: UZIVATEL-4C1B50 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2011.10.26 20:53:41 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory\OTL.exe
PRC - [2011.10.23 14:56:48 | 000,063,488 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\NLSSRV32.EXE
PRC - [2011.10.01 09:09:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.09.06 22:45:30 | 003,722,416 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.06.15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011.05.19 21:06:18 | 000,132,392 | ---- | M] (Synaptics Incorporated) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2010.04.01 14:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2010.03.04 23:38:02 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 12:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.10.14 09:11:10 | 001,388,544 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2004.01.20 19:15:12 | 000,507,965 | ---- | M] (WIDCOMM, Inc.) -- C:\Program Files\IBM\Bluetooth Software\BTTray.exe
PRC - [2004.01.20 19:05:08 | 000,135,168 | ---- | M] (WIDCOMM, Inc.) -- C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
PRC - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

========== Modules (No Company Name) ==========

MOD - [2011.10.17 06:27:18 | 008,522,400 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011.10.01 09:09:47 | 001,833,944 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2011.05.19 21:05:48 | 000,066,856 | ---- | M] () -- C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
MOD - [2010.03.04 23:38:02 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
MOD - [2008.04.14 12:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2004.05.13 18:36:40 | 000,086,016 | ---- | M] () -- C:\WINDOWS\system32\ati2evxx.dll
MOD - [2004.01.20 19:16:30 | 000,053,248 | ---- | M] () -- C:\Program Files\IBM\Bluetooth Software\BTKeyInd.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011.10.23 14:56:48 | 000,063,488 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\WINDOWS\system32\NLSSRV32.EXE -- (nlsX86cc)
SRV - [2010.03.04 23:38:02 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2005.11.22 16:20:28 | 000,036,864 | ---- | M] () [On_Demand | Stopped] -- C:\WINDOWS\system32\acs.exe -- (acs)
SRV - [2004.01.20 19:05:08 | 000,135,168 | ---- | M] (WIDCOMM, Inc.) [Auto | Running] -- C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe -- (btwdins)
SRV - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))

========== Driver Services (SafeList) ==========

DRV - [2011.10.26 17:34:52 | 000,111,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TrueSight.sys -- (TrueSight)
DRV - [2011.10.25 23:12:47 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- c:\Documents and Settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{50822901-CA66-4DC3-B97B-E3255F9D5AF1}\MpKsl65f67dc7.sys -- (MpKsl65f67dc7)
DRV - [2011.09.16 09:37:30 | 000,229,208 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm)
DRV - [2011.09.06 22:36:23 | 000,110,552 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011.09.06 22:33:11 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011.08.10 22:57:53 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2011.06.27 17:54:30 | 000,022,640 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Program Files\PC-Doctor\pcdsrvc.pkms -- (PCDSRVC{3037D694-FD904ACA-06020200}_0)
DRV - [2011.05.22 22:51:26 | 000,020,216 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Program Files\HWiNFO32\HWiNFO32.SYS -- (HWiNFO32)
DRV - [2010.09.07 14:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\smiif32.sys -- (lenovo.smi)
DRV - [2009.11.12 14:48:58 | 000,005,504 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\StarOpen.sys -- (StarOpen)
DRV - [2009.04.03 11:18:06 | 001,347,168 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.02.08 09:46:36 | 000,057,408 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD)
DRV - [2007.05.02 09:54:08 | 000,472,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2005.10.18 16:53:24 | 000,998,656 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005.10.18 16:52:38 | 000,242,304 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2005.10.18 16:52:30 | 000,721,280 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004.05.13 18:38:52 | 000,672,256 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://home.sweetim.com"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1203
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.1
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..extensions.enabledItems: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: arcticglow-ff3-30@glowplug.bitasylum.net:4.0.4.01
FF - prefs.js..extensions.enabledItems: {c8f71e5b-88f8-42a7-98bb-e4c506161de9}:0.4
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsear ... searchfor="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Foxtab Web Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.as ... earchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_ss ... 112513528f"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.mywebsearch.com/mywebsear ... searchfor="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: C:\Program Files\FunWebProducts\Installr\2.bin\NPFunWeb.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011.10.24 00:17:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.01 09:09:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.10.24 00:08:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.21 17:01:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2011.10.21 17:01:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Extensions
[2011.10.21 17:01:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.10.26 14:17:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\extensions
[2011.08.11 21:24:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.10 19:34:07 | 000,000,000 | ---D | M] (Speed Dial) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2011.08.29 17:32:41 | 000,000,000 | ---D | M] (HyperCam Toolbar) -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2011.08.02 12:16:02 | 000,000,941 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\conduit.xml
[2011.08.11 21:54:36 | 000,005,425 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\Foxtab Web Search.xml
[2011.08.11 21:25:10 | 000,009,932 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\mywebsearch.xml
[2011.10.10 07:02:01 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\sweetim.xml
[2011.10.25 23:42:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.10.25 23:27:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.09.06 14:52:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.10.25 23:42:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\DATA APLIKACĂ\MOZILLA\FIREFOX\PROFILES\HSRAKRQJ.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}
[2011.10.24 00:17:31 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2011.08.06 09:45:40 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.10.01 09:09:54 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.16 16:52:28 | 000,258,560 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll
[2011.08.22 22:51:03 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011.10.01 09:09:38 | 000,002,208 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\heureka-cz.xml
[2011.10.01 09:09:38 | 000,000,638 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\jyxo-cz.xml
[2011.10.01 09:09:38 | 000,001,367 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\seznam-cz.xml
[2011.10.01 09:09:38 | 000,000,654 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\slunecnice-cz.xml
[2011.10.01 09:09:38 | 000,001,179 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-cz.xml

O1 HOSTS File: ([2011.10.26 17:34:17 | 000,000,729 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\HyperCam Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (HyperCam Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\HyperCam Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [LenovoAutoScrollUtility] C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Nabídka Start\Programy\Po spuštění\Registration Brothers In Arms EiB.LNK = File not found
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\BTTray.lnk = C:\Program Files\IBM\Bluetooth Software\BTTray.exe (WIDCOMM, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Search the Web - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/ ... ontrol.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 3011371115 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C03C8E20-B542-4462-8900-93710305A0FA}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll ()
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{67b4e6e0-c026-11e0-b24a-0020e0802901}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2011.10.26 20:31:21 | 000,000,000 | --SD | C] -- C:\Beruska.com
[2011.10.26 19:38:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
[2011.10.26 19:38:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.10.26 19:38:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Malwarebytes' Anti-Malware
[2011.10.26 19:38:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
[2011.10.26 19:38:14 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.10.26 19:38:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.10.26 18:18:28 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.10.26 18:16:47 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011.10.26 18:16:47 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011.10.26 18:16:47 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011.10.26 18:16:47 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011.10.26 18:16:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.10.26 18:15:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.10.26 17:31:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Plocha\RK_Quarantine
[2011.10.26 17:27:14 | 000,000,000 | ---D | C] -- C:\WINSSLog
[2011.10.26 14:42:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\PC Security Test 2011
[2011.10.26 14:42:45 | 000,000,000 | ---D | C] -- C:\Program Files\AxBx
[2011.10.26 14:38:31 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2011.10.26 14:08:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Metin2
[2011.10.26 13:57:39 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2011.10.26 13:55:59 | 000,000,000 | ---D | C] -- C:\Program Files\Metin2
[2011.10.26 12:54:50 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011.10.26 12:54:22 | 000,000,000 | ---D | C] -- C:\rsit
[2011.10.25 23:42:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011.10.25 23:42:02 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.10.25 23:42:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.10.25 23:42:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.10.25 23:41:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\CCleaner
[2011.10.25 23:41:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.10.25 22:57:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Nabídka Start\Programy\Hard Reset Demo
[2011.10.25 22:49:46 | 000,000,000 | ---D | C] -- C:\Program Files\Hard Reset Demo
[2011.10.24 17:26:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dokumenty\ZALOHA-OKRADČKA.EMAIL
[2011.10.24 00:08:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011.10.24 00:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011.10.23 20:32:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe(2)
[2011.10.23 20:32:51 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe(2)
[2011.10.23 20:24:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\McAfee
[2011.10.23 14:57:41 | 000,067,440 | ---- | C] (Proland Software) -- C:\WINDOWS\System32\_PPCXM_.DLL
[2011.10.23 14:56:47 | 000,063,488 | ---- | C] (Nalpeiron Ltd.) -- C:\WINDOWS\System32\NLSSRV32.EXE
[2011.10.23 14:26:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\MediaGet2
[2011.10.21 17:01:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Thunderbird
[2011.10.21 17:01:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\Thunderbird
[2011.10.21 14:50:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Fighters
[2011.10.21 14:50:32 | 000,000,000 | ---D | C] -- C:\Program Files\Fighters
[2011.10.21 07:03:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Fighters
[2011.10.21 07:02:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Thinstall
[2011.10.21 07:02:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall
[2011.10.20 22:50:14 | 000,000,000 | ---D | C] -- C:\Program Files\zaloha METIN2
[2011.10.20 22:40:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dokumenty\Any Video Converter
[2011.10.20 22:40:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Data aplikací\AnvSoft
[2011.10.20 22:40:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\AnvSoft
[2011.10.20 22:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\AnvSoft
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2011.10.26 20:59:35 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2011.10.26 20:48:02 | 000,000,450 | ---- | M] () -- C:\WINDOWS\tasks\SLOW-PCfighter.job
[2011.10.26 20:47:35 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.10.26 20:47:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.10.26 19:38:23 | 000,000,661 | ---- | M] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\BTTray.lnk
[2011.10.26 19:38:18 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2011.10.26 18:18:38 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011.10.26 17:34:52 | 000,111,872 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011.10.26 17:25:17 | 000,002,504 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011.10.26 15:28:21 | 000,000,412 | ---- | M] () -- C:\WINDOWS\tasks\SystemToolsDailyTest.job
[2011.10.26 15:16:03 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011.10.26 15:02:22 | 000,001,100 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.10.26 14:59:08 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.10.26 14:55:04 | 000,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Skype.lnk
[2011.10.26 14:08:09 | 000,000,660 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Metin2.lnk
[2011.10.25 23:41:48 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2011.10.25 23:33:12 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.24 00:19:00 | 000,001,695 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\avast! Free Antivirus.lnk
[2011.10.23 16:05:21 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\videopadShakeIcon.job
[2011.10.23 14:56:48 | 000,063,488 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\System32\NLSSRV32.EXE
[2011.10.23 14:56:44 | 000,067,440 | ---- | M] (Proland Software) -- C:\WINDOWS\System32\_PPCXM_.DLL
[2011.10.23 14:56:42 | 000,042,864 | ---- | M] () -- C:\WINDOWS\_SETUPD_.EXE
[2011.10.22 10:38:55 | 000,000,528 | ---- | M] () -- C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
[2011.10.21 23:09:48 | 002,359,350 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Bez názvu.bmp
[2011.10.21 22:39:24 | 000,169,847 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\hack.JPG
[2011.10.21 14:55:43 | 000,001,503 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Malování.lnk
[2011.10.21 14:50:43 | 000,001,879 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\SLOW-PCfighter.lnk
[2011.10.21 07:07:07 | 000,001,507 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Poznámkový blok.lnk
[2011.10.20 22:40:42 | 000,000,895 | ---- | M] () -- C:\Documents and Settings\Administrator\Plocha\Any Video Converter.lnk
[2011.10.20 15:30:13 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\photostageShakeIcon.job
[2011.10.20 15:30:13 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\wavepadShakeIcon.job
[2011.10.20 15:30:13 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\prismShakeIcon.job
[2011.10.20 15:30:12 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\mixpadShakeIcon.job
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.10.26 20:59:35 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2011.10.26 19:38:18 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Malwarebytes' Anti-Malware.lnk
[2011.10.26 18:18:37 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011.10.26 18:18:34 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2011.10.26 18:16:47 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.10.26 18:16:47 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.10.26 18:16:47 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.10.26 18:16:47 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.10.26 18:16:47 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011.10.26 17:31:50 | 000,111,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011.10.26 14:08:09 | 000,000,660 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Metin2.lnk
[2011.10.25 23:41:48 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2011.10.23 14:56:42 | 000,042,864 | ---- | C] () -- C:\WINDOWS\_SETUPD_.EXE
[2011.10.21 23:09:47 | 002,359,350 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Bez názvu.bmp
[2011.10.21 22:39:23 | 000,169,847 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\hack.JPG
[2011.10.21 14:51:26 | 000,000,450 | ---- | C] () -- C:\WINDOWS\tasks\SLOW-PCfighter.job
[2011.10.21 14:50:43 | 000,001,879 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\SLOW-PCfighter.lnk
[2011.10.20 22:40:42 | 000,000,895 | ---- | C] () -- C:\Documents and Settings\Administrator\Plocha\Any Video Converter.lnk
[2011.09.28 20:31:33 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\{9D572799-2AFA-4BA8-9A40-A06527A63EAE}
[2011.09.13 17:16:00 | 001,073,152 | ---- | C] () -- C:\WINDOWS\System32\libmysql_c.dll
[2011.09.06 23:02:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2011.08.23 20:33:03 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.23 20:19:43 | 000,407,047 | ---- | C] () -- C:\WINDOWS\System32\mioengine.exe
[2011.08.22 22:52:26 | 000,272,987 | ---- | C] () -- C:\WINDOWS\GIF to Flash Converter Uninstaller.exe
[2011.08.16 12:26:44 | 000,000,880 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\SRDownloader.nast
[2011.08.11 23:41:45 | 000,132,442 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\WPFFontCache_v0400-System.dat
[2011.08.11 23:31:15 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Data aplikací\fusioncache.dat
[2011.08.11 14:16:23 | 000,182,275 | ---- | C] () -- C:\WINDOWS\System32\d3d10core.dll
[2011.08.11 14:16:20 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\M2000Twn.dll
[2011.08.11 14:16:17 | 000,728,858 | ---- | C] () -- C:\Program Files\Common Files\unins000.exe
[2011.08.11 14:16:17 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\CompressATI2.dll
[2011.08.11 14:16:17 | 000,003,015 | ---- | C] () -- C:\Program Files\Common Files\unins000.dat
[2011.08.11 13:00:52 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.08.11 10:29:30 | 000,315,392 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe
[2011.08.10 19:46:10 | 000,001,100 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.08.10 18:26:57 | 000,003,216 | ---- | C] () -- C:\WINDOWS\System32\encobject.dat
[2011.08.06 14:07:39 | 000,000,271 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\tvt_userinfo.ini
[2011.08.06 14:04:25 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\psasrv.exe
[2011.08.06 12:11:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011.08.06 12:10:10 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2011.08.06 12:09:39 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011.08.06 12:09:38 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011.08.06 12:09:37 | 000,189,051 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.08.06 12:09:36 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2011.08.06 12:09:36 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2011.08.06 12:02:32 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2011.08.06 12:02:32 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll
[2011.08.06 12:02:32 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2011.08.06 12:02:32 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\acs.exe
[2011.08.06 11:18:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011.08.06 11:02:24 | 000,004,249 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.08.06 11:00:58 | 000,130,888 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.06 10:46:34 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.08.06 09:56:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.08.06 09:16:14 | 000,536,176 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\FontCache3.0.0.0.dat
[2011.08.06 09:09:14 | 000,021,812 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011.07.07 23:37:28 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2009.11.12 14:48:58 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\StarOpen.sys
[2008.04.14 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 12:00:00 | 000,503,340 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 12:00:00 | 000,499,254 | ---- | C] () -- C:\WINDOWS\System32\perfh005.dat
[2008.04.14 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 12:00:00 | 000,269,162 | ---- | C] () -- C:\WINDOWS\System32\perfi005.dat
[2008.04.14 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 12:00:00 | 000,104,010 | ---- | C] () -- C:\WINDOWS\System32\perfc005.dat
[2008.04.14 12:00:00 | 000,089,246 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 12:00:00 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\perfd005.dat
[2008.04.14 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 12:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005.10.14 11:56:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005.10.14 11:56:50 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2005.10.14 11:56:50 | 000,778,240 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe
[2005.10.14 11:56:50 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2005.10.14 11:56:50 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2005.10.14 11:56:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2005.10.14 11:56:50 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2005.10.14 11:56:50 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2005.10.14 11:56:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2004.01.20 19:16:56 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\btbip.dll
[2004.01.20 19:03:24 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\btsendto_ie.dll
[2004.01.20 19:02:40 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\btsendto_wab.dll
[2004.01.20 18:57:32 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004.01.20 18:44:36 | 000,022,183 | ---- | C] () -- C:\WINDOWS\System32\drivers\btserial.sys
[2001.11.14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2011.10.20 22:40:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\AnvSoft
[2011.08.22 22:50:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Babylon
[2011.08.24 14:34:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\BabylonToolbar
[2011.09.29 20:23:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\COWON
[2011.09.07 19:15:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Dev-Cpp
[2011.09.06 23:06:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\EDrawings
[2011.08.29 18:55:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Gearbox Software
[2011.09.24 00:44:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\GetRightToGo
[2011.08.13 15:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Lenovo
[2011.08.23 20:19:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\mioObjects
[2011.08.11 14:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\OpenOffice.org
[2011.08.10 20:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\PCDr
[2011.08.11 20:48:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Radmin
[2011.08.16 11:43:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\SFBot
[2011.09.28 18:57:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Sony
[2011.08.06 14:07:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\ThinkVantage
[2011.10.21 07:02:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall
[2011.10.21 17:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Thunderbird
[2011.08.29 17:32:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Toolbar4
[2011.08.12 16:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Tremulous
[2011.08.10 20:32:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Update
[2011.08.10 19:00:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
[2011.08.22 22:50:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Babylon
[2011.08.06 09:44:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Canneverbe Limited
[2011.08.11 13:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Easy Driver Pro
[2011.10.21 07:03:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Fighters
[2011.08.11 21:50:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Innovative Solutions
[2011.10.10 14:32:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\InstallMate
[2011.08.13 15:20:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Lenovo
[2011.08.12 00:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Drivers HeadQuarters
[2011.08.10 20:31:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PCDr
[2011.10.10 07:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Premium
[2011.09.25 00:47:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Sony
[2011.10.11 13:05:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2011.08.11 00:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\UIB
[2011.10.20 15:30:12 | 000,000,288 | ---- | M] () -- C:\WINDOWS\Tasks\mixpadShakeIcon.job
[2011.10.26 15:16:03 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011.10.22 10:38:55 | 000,000,528 | ---- | M] () -- C:\WINDOWS\Tasks\PCDoctorBackgroundMonitorTask.job
[2011.10.20 15:30:13 | 000,000,304 | ---- | M] () -- C:\WINDOWS\Tasks\photostageShakeIcon.job
[2011.10.20 15:30:13 | 000,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\prismShakeIcon.job
[2011.10.26 20:48:02 | 000,000,450 | ---- | M] () -- C:\WINDOWS\Tasks\SLOW-PCfighter.job
[2011.10.26 15:28:21 | 000,000,412 | ---- | M] () -- C:\WINDOWS\Tasks\SystemToolsDailyTest.job
[2011.10.23 16:05:21 | 000,000,296 | ---- | M] () -- C:\WINDOWS\Tasks\videopadShakeIcon.job
[2011.10.20 15:30:13 | 000,000,292 | ---- | M] () -- C:\WINDOWS\Tasks\wavepadShakeIcon.job

========== Purity Check ==========

========== Custom Scans ==========

< >

< >

< MD5 for: AGP440.SYS >
[2008.04.13 22:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008.04.13 22:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\AGP440.SYS
[2008.04.13 22:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\AGP440.SYS

< MD5 for: AHCIX86.SYS >
[2009.05.20 22:02:23 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\WINDOWS\system32\drivers\UMDF\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2008.04.13 22:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.13 22:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008.04.14 12:00:00 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\cmdcons\autochk.exe
[2008.04.14 12:00:00 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\system32\autochk.exe
[2008.04.14 12:00:00 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\system32\dllcache\autochk.exe

< MD5 for: CDROM.SYS >
[2008.04.14 12:00:00 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2011.02.08 03:16:22 | 000,062,592 | ---- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D -- C:\WINDOWS\system32\dllcache\cdrom.sys

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 12:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\cryptsvc.dll
[2008.04.14 12:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=F3AB0933CBD166D271992F411C27CCAF -- C:\WINDOWS\system32\dllcache\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 12:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 12:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=2EE99F67C930931EB404DADCE57E976E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 12:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemRoot%\explorer.exe
[2008.04.14 12:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 12:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: HAL.DLL >
[2008.04.14 12:00:00 | 000,081,152 | ---- | M] (Microsoft Corporation) MD5=C4BA879B581BE34536FE01F79AC28631 -- C:\WINDOWS\system32\hal.dll

< MD5 for: IASTOR.SYS >
[2009.03.26 09:18:24 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\NLDRV\001\iaStor.sys

< MD5 for: ISAPNP.SYS >
[2008.04.14 05:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\dllcache\isapnp.sys
[2008.04.14 05:57:54 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\drivers\isapnp.sys
[2008.04.14 12:00:00 | 000,037,248 | ---- | M] (Microsoft Corporation) MD5=CC9F8A2D60AED1A51A3AC34C59B987AE -- C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\isapnp.sys

< MD5 for: LSASS.EXE >
[2008.04.14 12:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\dllcache\lsass.exe
[2008.04.14 12:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=ED0A176354487CEED65B80A7148AB739 -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.14 12:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\dllcache\ndis.sys
[2008.04.14 12:00:00 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008.04.14 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=C2ED0E3408F50BBC149D4F0936E67832 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008.04.14 12:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 12:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2004.08.17 15:49:28 | 000,164,864 | ---- | M] (Microsoft Corporation) MD5=3C100B7FDB179B63829103DF6541337F -- C:\cmdcons\SYSTEM32\SMSS.EXE
[2008.04.14 12:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\dllcache\smss.exe
[2008.04.14 12:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=9B08A8C6331C2DA9C30377BCB4262721 -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 12:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008.04.14 12:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: TCPIP.SYS >
[2009.05.20 22:00:35 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2009.05.20 22:00:35 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\system32\drivers\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 12:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 12:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: VIAMRAID.SYS >
[2010.11.24 07:28:46 | 000,117,248 | ---- | M] (VIA Technologies inc,.ltd) MD5=00046AA2E396EDC2238556E740A8E5AF -- C:\WINDOWS\NLDRV\005\viamraid.sys
[2010.11.24 07:28:46 | 000,117,872 | ---- | M] (VIA Technologies inc,.ltd) MD5=923C74DE7CB0B4E060B8748968F9A620 -- C:\WINDOWS\NLDRV\004\viamraid.sys

< MD5 for: WINLOGON.EXE >
[2008.04.14 12:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 12:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 12:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\dllcache\ws2_32.dll
[2008.04.14 12:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=951D473917C51F21496D914CF6E5DDD1 -- C:\WINDOWS\system32\ws2_32.dll

< >

< %systemroot%*.* /U /s >
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[1 C:\WINDOWS\CSC\*.tmp files -> C:\WINDOWS\CSC\*.tmp -> ]
[42 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[194 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2011.08.10 22:54:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Adobe
[2011.10.20 22:40:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\AnvSoft
[2011.08.22 22:50:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Babylon
[2011.08.24 14:34:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\BabylonToolbar
[2011.09.29 20:23:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\COWON
[2011.09.07 19:15:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Dev-Cpp
[2011.09.06 23:06:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\EDrawings
[2011.08.29 18:55:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Gearbox Software
[2011.09.24 00:44:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\GetRightToGo
[2011.10.08 23:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\GRETECH
[2011.08.06 10:02:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Identities
[2011.08.13 15:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Lenovo
[2011.08.10 18:47:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
[2011.10.26 19:38:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
[2011.10.23 14:57:09 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
[2011.08.23 20:19:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\mioObjects
[2011.10.24 21:27:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\mIRC
[2011.08.06 11:18:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla
[2011.10.17 15:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\NCH Software
[2011.08.11 14:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\OpenOffice.org
[2011.08.10 20:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\PCDr
[2011.08.11 20:48:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Radmin
[2011.08.16 11:43:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\SFBot
[2011.10.26 20:47:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Skype
[2011.09.28 18:57:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Sony
[2011.08.06 09:44:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Sun
[2011.08.06 14:07:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\ThinkVantage
[2011.10.21 07:02:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall
[2011.10.21 17:01:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Thunderbird
[2011.08.29 17:32:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Toolbar4
[2011.08.12 16:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Tremulous
[2011.08.10 20:32:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\Update
[2011.08.06 11:19:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\vlc
[2011.08.11 13:33:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2011.08.06 10:58:50 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\Administrator\Data aplikací\Microsoft\Installer\{55C98239-914A-46C1-B19D-83E90F7E00CC}\ARPPRODUCTICON.exe
[2011.09.07 20:53:54 | 000,231,424 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\mioObjects\[objects]\80NDFE8485DSVH72\ex_builder.exe
[2011.09.07 20:53:59 | 000,359,424 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\mioObjects\[objects]\80NDFE8485DSVH72\ex_mioreader.exe
[2008.04.14 12:00:00 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemRoot%\explorer.exe
[2008.04.14 12:00:00 | 000,390,144 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\cmd.exe
[2008.04.14 12:00:00 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\magnify.exe
[2008.04.14 12:00:00 | 000,143,872 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\mobsync.exe
[2010.10.10 09:26:15 | 000,343,552 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\mspaint.exe
[2008.04.14 12:00:00 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\notepad.exe
[2008.04.14 12:00:00 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\osk.exe
[2008.04.14 12:00:00 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\rcimlby.exe
[2008.04.14 12:00:00 | 000,347,136 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\tourstart.exe
[2008.04.14 12:00:00 | 000,050,176 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\%SystemSystem%\utilman.exe
[2011.10.21 07:06:59 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\1000000b00002i\verclsid.exe
[2011.10.21 07:02:57 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Thinstall\SLOW-PCfighter\4000008000002i\Splash Screen.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2011.08.06 11:00:10 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2011.08.06 11:00:10 | 001,093,632 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2011.08.06 11:00:09 | 000,483,328 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.sys /3 >
[2011.10.26 17:34:52 | 000,111,872 | ---- | M] () -- C:\WINDOWS\system32\drivers\TrueSight.sys

< %systemroot%\system32\*.* /3 >
[2011.10.26 17:25:17 | 000,002,504 | ---- | M] () -- C:\WINDOWS\system32\CONFIG.NT
[2011.10.26 15:02:22 | 000,001,100 | ---- | M] () -- C:\WINDOWS\system32\d3d8caps.dat
[2011.10.26 14:59:08 | 000,001,324 | ---- | M] () -- C:\WINDOWS\system32\d3d9caps.dat
[2011.10.25 23:41:55 | 000,002,932 | ---- | M] () -- C:\WINDOWS\system32\jupdate-1.6.0_29-b11.log
[2011.10.26 20:47:35 | 000,013,646 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"Skype" = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized -- [2011.10.13 09:27:14 | 017,351,304 | R--- | M] (Skype Technologies S.A.)
"ctfmon.exe" = C:\WINDOWS\system32\ctfmon.exe -- [2008.04.14 12:00:00 | 000,015,360 | ---- | M] (Microsoft Corporation)

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
IMAGEPATH REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

< >

< type c:\boot.ini >> test.txt /c >
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2011.10.26 20:59:35 | 000,000,512 | ---- | M] () MD5=49EE23A0033426B5DC10E7BDBA4B410B -- C:\PhysicalMBR.bin

< >

< *crack* /s >

< *keygen* /s >
[2010.07.21 15:07:42 | 000,017,927 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\examples\DevelopersGuide\Forms\KeyGenerator.java

< *loader* /s >
[2011.08.11 16:04:40 | 000,000,000 | ---- | M] () -- \Documents and Settings\Administrator\Data aplikací\GetRightToGo\Brothersoftdownloader_for_Direct3D_Frame_Sample.d000
[2011.08.11 16:04:40 | 000,000,000 | ---- | M] () -- \Documents and Settings\Administrator\Data aplikací\GetRightToGo\Brothersoftdownloader_for_Direct3D_Frame_Sample.data
[2011.08.16 12:26:44 | 000,000,880 | ---- | M] () -- \Documents and Settings\Administrator\Local Settings\Data aplikací\SRDownloader.nast
[1 \Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp files -> \Documents and Settings\Administrator\Local Settings\Data aplikací\*.tmp -> ]
[1 \Documents and Settings\Administrator\Local Settings\Temp\is-6RK03.tmp\*.tmp files -> \Documents and Settings\Administrator\Local Settings\Temp\is-6RK03.tmp\*.tmp -> ]
[2010.07.21 11:59:18 | 000,006,262 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.py
[2011.08.06 09:48:44 | 000,020,992 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.uno.dll
[2010.07.21 12:00:44 | 000,000,171 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.uno.ini
[2010.07.21 15:06:16 | 000,124,416 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\bin\unoapploader.exe
[2010.07.21 15:06:16 | 000,000,978 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\classes\com\sun\star\lib\loader\Loader$CustomURLClassLoader.class
[2010.07.21 15:06:16 | 000,000,620 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\classes\com\sun\star\lib\loader\Loader$Drain.class
[2010.07.21 15:06:16 | 000,007,654 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\classes\com\sun\star\lib\loader\Loader.class
[2010.07.21 15:06:30 | 000,002,966 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\FrameLoader-xref.html
[2010.07.21 15:06:30 | 000,006,899 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\FrameLoader.html
[2010.07.21 15:06:30 | 000,002,181 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\FrameLoaderFactory-xref.html
[2010.07.21 15:06:30 | 000,006,377 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\FrameLoaderFactory.html
[2010.07.21 15:06:32 | 000,002,306 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\SynchronousFrameLoader-xref.html
[2010.07.21 15:06:32 | 000,006,938 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\SynchronousFrameLoader.html
[2010.07.21 15:06:32 | 000,004,765 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XComponentLoader-xref.html
[2010.07.21 15:06:32 | 000,010,150 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XComponentLoader.html
[2010.07.21 15:06:32 | 000,002,988 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XFrameLoader-xref.html
[2010.07.21 15:06:32 | 000,005,817 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XFrameLoader.html
[2010.07.21 15:06:32 | 000,001,574 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XFrameLoaderQuery-xref.html
[2010.07.21 15:06:32 | 000,006,989 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XFrameLoaderQuery.html
[2010.07.21 15:06:32 | 000,002,324 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XSynchronousFrameLoader-xref.html
[2010.07.21 15:06:32 | 000,005,317 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\frame\XSynchronousFrameLoader.html
[2010.07.21 15:06:34 | 000,002,677 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\loader\XImplementationLoader-xref.html
[2010.07.21 15:06:34 | 000,008,623 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\loader\XImplementationLoader.html
[2010.07.21 15:06:38 | 000,004,434 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\resource\OfficeResourceLoader.html
[2010.07.21 15:06:38 | 000,001,911 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\resource\XResourceBundleLoader-xref.html
[2010.07.21 15:06:38 | 000,004,970 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\resource\XResourceBundleLoader.html
[2010.07.21 15:06:38 | 000,001,435 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\sdb\ContentLoader-xref.html
[2010.07.21 15:06:38 | 000,005,505 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\sdb\ContentLoader.html
[2010.07.21 15:06:46 | 000,001,944 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\style\XStyleLoader-xref.html
[2010.07.21 15:06:46 | 000,005,337 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\common\ref\com\sun\star\style\XStyleLoader.html
[2010.07.21 15:07:02 | 000,006,422 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\cpp\ref\names\salhelper\c-ODynamicLoader.html
[2010.07.21 15:07:02 | 000,006,712 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\cpp\ref\names\salhelper\c-ORealDynamicLoader.html
[2010.07.21 15:07:04 | 000,028,698 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\comp\helper\SharedLibraryLoader.html
[2010.07.21 15:07:04 | 000,006,294 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\comp\helper\class-use\SharedLibraryLoader.html
[2010.07.21 15:07:04 | 000,032,603 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\lib\unoloader\UnoClassLoader.html
[2010.07.21 15:07:04 | 000,014,530 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\lib\unoloader\UnoLoader.html
[2010.07.21 15:07:04 | 000,006,264 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\lib\unoloader\class-use\UnoClassLoader.html
[2010.07.21 15:07:04 | 000,006,214 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\docs\java\ref\com\sun\star\lib\unoloader\class-use\UnoLoader.html
[2010.07.21 15:07:40 | 000,007,287 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\examples\cpp\DocumentLoader\DocumentLoader.cxx
[2010.07.21 15:07:42 | 000,004,065 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\examples\java\DocumentHandling\DocumentLoader.java
[2010.07.21 15:07:12 | 000,003,979 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\FrameLoader.idl
[2010.07.21 15:07:12 | 000,004,193 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\FrameLoaderFactory.idl
[2010.07.21 15:07:12 | 000,004,031 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\SynchronousFrameLoader.idl
[2010.07.21 15:07:12 | 000,008,283 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\XComponentLoader.idl
[2010.07.21 15:07:12 | 000,003,894 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\XFrameLoader.idl
[2010.07.21 15:07:12 | 000,003,120 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\XFrameLoaderQuery.idl
[2010.07.21 15:07:12 | 000,003,414 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\frame\XSynchronousFrameLoader.idl
[2010.07.21 15:07:14 | 000,006,007 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\loader\XImplementationLoader.idl
[2010.07.21 15:07:16 | 000,003,979 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\resource\OfficeResourceLoader.idl
[2010.07.21 15:07:16 | 000,003,161 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\resource\XResourceBundleLoader.idl
[2010.07.21 15:07:18 | 000,004,142 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\sdb\ContentLoader.idl
[2010.07.21 15:07:20 | 000,003,815 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\sdk\idl\com\sun\star\style\XStyleLoader.idl
[2011.08.06 09:48:50 | 000,029,184 | ---- | M] () -- \Program Files\OpenOffice.org 3\URE\bin\javaloader.uno.dll
[2010.07.19 07:33:34 | 000,003,874 | ---- | M] () -- \Program Files\OpenOffice.org 3\URE\java\unoloader.jar
[2008.02.25 08:05:22 | 000,856,064 | ---- | M] () -- \Program Files\The KMPlayer\ImLoader.dll
[2011.10.26 11:31:47 | 000,015,672 | ---- | M] () -- \WINDOWS\Prefetch\DOWNLOADER_METIN2_CZ.EXE-25625110.pf
[2002.12.12 00:14:32 | 000,033,280 | ---- | M] () -- \WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmloader.dll
[2008.04.14 12:00:00 | 000,035,840 | ---- | M] () -- \WINDOWS\system32\dmloader.dll
[3 \WINDOWS\system32\*.tmp files -> \WINDOWS\system32\*.tmp -> ]
[2009.04.09 07:21:58 | 000,003,584 | ---- | M] () -- \WINDOWS\system32\API_DirectX11\DATA_L\api-ms-win-core-libraryloader-l1-1-0.dll
[2008.04.14 12:00:00 | 000,035,840 | ---- | M] () -- \WINDOWS\system32\dllcache\dmloader.dll
[2009.04.09 07:21:58 | 000,003,584 | ---- | M] () -- \WINDOWS\SysWOW64\API_DirectX11\DATA_L\api-ms-win-core-libraryloader-l1-1-0.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:05EE1EEF

< End of report >

frutas11 · #25 Příspěvek od **frutas11** » 26 říj 2011 20:10

OTL Extras logfile created on: 26.10.2011 20:57:54 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

1022,92 Mb Total Physical Memory | 450,73 Mb Available Physical Memory | 44,06% Memory free
2,40 Gb Paging File | 1,98 Gb Available in Paging File | 82,55% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 1,96 Gb Free Space | 5,26% Space Free | Partition Type: NTFS

Computer Name: UZIVATEL-4C1B50 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Vzdálená správa systému Windows
"80:TCP" = 80:TCP:*:Disabled:Vzdálená správa systému Windows – režim kompatibility (HTTP-In)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Q3Ademo\quake3.exe" = C:\Q3Ademo\quake3.exe:*:Enabled:quake3 -- ()
"C:\Program Files\Metin2\metin2.bin" = C:\Program Files\Metin2\metin2.bin:*:Enabled:metin2 -- ()
"C:\Documents and Settings\Administrator\Local Settings\Temp\Dočasný adresář 1 pro HydraIRC.zip\HydraIRC.exe" = C:\Documents and Settings\Administrator\Local Settings\Temp\Dočasný adresář 1 pro HydraIRC.zip\HydraIRC.exe:*:Enabled:HydraIRC
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Konzola Microsoft Management Console -- (Microsoft Corporation)
"C:\Program Files\QuadCoreM2\pack\core.bin" = C:\Program Files\QuadCoreM2\pack\core.bin:*:Enabled:core
"C:\Program Files\Tremulous\tremulous.exe" = C:\Program Files\Tremulous\tremulous.exe:*:Enabled:tremulous
"C:\Program Files\Metin2\metin2client.bin" = C:\Program Files\Metin2\metin2client.bin:*:Enabled:metin2client -- ()
"C:\Program Files\Tremulous\tremulous-gpp.exe" = C:\Program Files\Tremulous\tremulous-gpp.exe:*:Enabled:tremulous-gpp
"C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory\Sindicate\client.bin" = C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory\Sindicate\client.bin:*:Enabled:client
"C:\UnrealTournament\System\UnrealTournament.exe" = C:\UnrealTournament\System\UnrealTournament.exe:*:Enabled:UnrealTournament
"C:\Program Files\QuadCoreM2(2)\pack\core.bin" = C:\Program Files\QuadCoreM2(2)\pack\core.bin:*:Enabled:core
"C:\Documents and Settings\Administrator\Local Settings\Data aplikací\MediaGet2\mediaget.exe" = C:\Documents and Settings\Administrator\Local Settings\Data aplikací\MediaGet2\mediaget.exe:*:Enabled:MediaGet torrent client
"C:\Celestial-World\metin2client.bin" = C:\Celestial-World\metin2client.bin:*:Enabled:metin2client
"C:\Program Files\sindicate\client.bin" = C:\Program Files\sindicate\client.bin:*:Enabled:client
"C:\Program Files\Metin2\metin2.exe" = C:\Program Files\Metin2\metin2.exe:*:Enabled:metin2 -- ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C186265-F6F9-4FAF-BD49-2BEA28387EFC}" = SolidWorks eDrawings 2011
"{17CA32D1-73BD-4990-B8F6-369D8D34B05D}" = Microsoft Antimalware Service CS-CZ Language Pack
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2258EB2F-185C-43A0-BD05-F8717375A70B}" = Vegas Pro 9.0
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{28DA872A-0848-48CF-B749-19A198157A2A}" = mDriver
"{2A3C47B1-FC9F-4BAA-9927-769E3982C5C7}" = OpenOffice.org 3.2 SDK
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client CS-CZ Language Pack
"{546C143E-68DC-314D-97BC-1E454E3BA429}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - CSY
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{55C98239-914A-46C1-B19D-83E90F7E00CC}" = Fingerprint Sensor Minimum Install
"{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}" = CDBurnerXP
"{5E65E94D-69F2-4850-9E93-6459C53A0F50}" = Microsoft .NET Framework 1.1 Czech Language Pack
"{674756A1-D4E6-445C-959B-AD8D0C03FABC}" = SLOW-PCfighter
"{7036A6F4-5DAD-3908-956D-1752CD7F7E5A}" = Microsoft .NET Framework 4 Client Profile CSY Language Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97A795FE-A83E-45BA-ADE4-8F13F271EBA9}" = OpenOffice.org 3.2 Language Pack (Czech)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FAC9E5C-0D20-4DBF-AFE5-2E09C52A95A2}" = ThinkPad Wireless LAN Adapters Software (11a/b, 11b/g, 11a/b/g)
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A2C9CD1B-2551-3AED-B244-6698FB929FA6}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - CSY
"{A2DE62D8-EF1B-36CB-B461-B1E221ED8608}" = Microsoft .NET Framework 4 Extended CSY Language Pack
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1029-7B44-A94000000001}" = Adobe Reader 9.4.6 - Czech
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D796471F-CF8B-41B5-AD8F-C574BB5B1C84}" = OpenOffice.org 3.2
"{DD73CA82-EA82-38AA-863D-9A24A018DC96}" = Microsoft .NET Framework 3.5 Language Pack SP1 - csy
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Basic VX
"{E98D6792-FC51-4187-9448-CA9BF893384E}" = Bluetooth Software
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F42B786C-9FBB-44FD-AD2B-BAC3C0970300}_is1" = Image ReSizer 1.0
"{F48DC94B-E4EC-6F4C-6CA2-B3F2D13FF0FD}" = ATI Catalyst Install Manager
"{F4F7F393-A8E8-42CC-8C2E-7A999B48B2AE}_is1" = DirectX10 LV (Last Version)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Any Video Converter_is1" = Any Video Converter 3.3.0
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_05591014" = ThinkPad Integrated 56K Modem
"conduitEngine" = Conduit Engine
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"DirectX11 by Desings Pro Group Nvidia 2009 11.00" = DirectX11 by Desings Pro Group Nvidia 2009 11.00
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DriverAgent.exe" = DriverAgent by eSupport.com
"Fraps" = Fraps (remove only)
"GIF to Flash Converter" = GIF to Flash Converter
"GOM Player" = GOM Player
"HardResetDemo" = Hard Reset Demo
"HWiNFO32_is1" = HWiNFO32 Version 3.84
"HyperCam 2" = HyperCam 2
"HyperCam Toolbar" = HyperCam Toolbar
"Instalační průvodce_is1" = Instalační průvodce verze 3.2
"IrfanView" = IrfanView (remove only)
"LENOVO.SMIIF" = Lenovo System Interface Driver
"LenovoAutoScrollUtility" = Lenovo Auto Scroll Utility
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Metin2_is1" = Metin2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - csy" = Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile CSY Language Pack" = Microsoft .NET Framework 4 Client Profile CSY Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended CSY Language Pack" = Microsoft .NET Framework 4 Extended CSY Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"mIRC" = mIRC
"MixPad" = MixPad Audio Mixer
"Mozilla Firefox 7.0.1 (x86 cs)" = Mozilla Firefox 7.0.1 (x86 cs)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PhotoStage" = PhotoStage Slideshow Producer
"Picasa 3" = Picasa 3
"Power Management Driver" = ThinkPad Power Management Driver
"PremiumSoft Navicat 8.0 for MySQL_is1" = PremiumSoft Navicat 8.0 for MySQL
"Prism" = Prism Video File Converter
"ProInst" = Intel(R) PROSet/Wireless Software
"PROSet" = Intel(R) PRO Network Connections Drivers
"Quake 3 Arena Demo" = Quake 3 Arena Demo
"SLOW-PCfighter" = SLOW-PCfighter
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"Textus Online" = Textus Online
"The KMPlayer" = The KMPlayer (remove only)
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"VideoPad" = VideoPad Video Editor
"WavePad" = WavePad Sound Editor
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"wxdevcpp" = wxDev-C++ Web-based Installer
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 26.10.2011 9:33:37 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:37:6840)(1580) libCommon.System.Windows - Error
-- 635 readFromPipeTimed(3440) timed out after 120000 totalBytes: 0

Error - 26.10.2011 9:33:37 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:37:7440)(1580) libCommon.System.Windows - Error
-- 726 execAndGetPipeData(./pcdrsysinfosoftware.p5x) readFromPipeTimed failed,
killing: 3752

Error - 26.10.2011 9:33:37 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:37:8250)(1580) libCommon.System.Windows - Error
-- 726 execAndGetPipeData(./pcdrsysinfodirect.p5x) readFromPipeTimed failed, killing:
2624

Error - 26.10.2011 9:33:37 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:37:9350)(1580) libCommon.System.Windows - Error
-- 726 execAndGetPipeData(./pcdrsysinfovideocapture.p5x) readFromPipeTimed failed,
killing: 788

Error - 26.10.2011 9:33:38 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:38:0850)(1580) Matrix.ModuleImp - Error -- 54
Unable to get information from module due to failed exec.

Error - 26.10.2011 9:33:38 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:38:0850)(1580) Matrix.ModuleImp - Error -- 54
Unable to get information from module due to failed exec.

Error - 26.10.2011 9:33:38 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:38:1850)(1580) enumerator - Error -- 116 pcdrsysinfosoftware:
Module timed out after 189773 milliseconds and was terminated

Error - 26.10.2011 9:33:38 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:38:2450)(1580) enumerator - Error -- 116 pcdrsysinfodirect:
Module timed out after 189773 milliseconds and was terminated

Error - 26.10.2011 9:33:39 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:39:0560)(1580) Matrix.ModuleImp - Error -- 54
Unable to get information from module due to failed exec.

Error - 26.10.2011 9:33:39 | Computer Name = UZIVATEL-4C1B50 | Source = PC-Doctor | ID = 1
Description = (1580) Asapi: (15:33:39:0560)(1580) enumerator - Error -- 116 pcdrsysinfovideocapture:
Module timed out after 190694 milliseconds and was terminated

[ System Events ]
Error - 26.10.2011 11:42:15 | Computer Name = UZIVATEL-4C1B50 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 26.10.2011 11:43:39 | Computer Name = UZIVATEL-4C1B50 | Source = Service Control Manager | ID = 7000
Description = Služba WLAN Transport neuspěla při spuštění v důsledku následující
chyby: %%2

Error - 26.10.2011 11:56:07 | Computer Name = UZIVATEL-4C1B50 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 26.10.2011 11:57:20 | Computer Name = UZIVATEL-4C1B50 | Source = Service Control Manager | ID = 7026
Description = Zavedení následujícího ovladače pro spouštění počítače nebo systému
se nezdařilo: Aavmker4 Fips HWiNFO32 intelppm lenovo.smi vmm

Error - 26.10.2011 12:07:19 | Computer Name = UZIVATEL-4C1B50 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 26.10.2011 12:08:36 | Computer Name = UZIVATEL-4C1B50 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 26.10.2011 12:09:16 | Computer Name = UZIVATEL-4C1B50 | Source = DCOM | ID = 10005
Description = Služba DCOM zjistila chybu %1084 při pokusu o spuštění služby EventSystem
s argumenty za účelem spuštění serveru: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 26.10.2011 12:11:01 | Computer Name = UZIVATEL-4C1B50 | Source = Service Control Manager | ID = 7000
Description = Služba WLAN Transport neuspěla při spuštění v důsledku následující
chyby: %%2

Error - 26.10.2011 13:25:09 | Computer Name = UZIVATEL-4C1B50 | Source = Service Control Manager | ID = 7000
Description = Služba WLAN Transport neuspěla při spuštění v důsledku následující
chyby: %%2

Error - 26.10.2011 14:47:30 | Computer Name = UZIVATEL-4C1B50 | Source = Service Control Manager | ID = 7000
Description = Služba WLAN Transport neuspěla při spuštění v důsledku následující
chyby: %%2

< End of report >

#26 Příspěvek od **vyosek** » 26 říj 2011 21:54

Spustte znovu OTL

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

:otl
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.startup.homepage: "http://home.sweetim.com"
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZCxdm490YYCZ&ptb=LD9Z2YpFKnYk74q3emA62A&ind=2011081115&ptnrS=ZCxdm490YYCZ&si=&n=77dea99b&psa=&st=kwd&searchfor="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Foxtab Web Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_ss&affID=100468&mntrId=5cb0855d00000000000000112513528f"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZCxdm490YYCZ&ptb=LD9Z2YpFKnYk74q3emA62A&ind=2011081115&ptnrS=ZCxdm490YYCZ&si=&n=77dea99b&psa=&st=kwd&searchfor="
[2011.08.02 12:16:02 | 000,000,941 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\conduit.xml
[2011.08.11 21:54:36 | 000,005,425 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\Foxtab Web Search.xml
[2011.08.11 21:25:10 | 000,009,932 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\mywebsearch.xml
[2011.10.10 07:02:01 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\sweetim.xml
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1547161642-492894223-842925246-500\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found.
O13 - gopher Prefix: missing
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[1 C:\WINDOWS\CSC\*.tmp files -> C:\WINDOWS\CSC\*.tmp -> ]
[42 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[2011.08.24 14:34:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Data aplikací\BabylonToolbar
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:05EE1EEF

:services
gusvc

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
"UIUCU"=-
"ISUSPM Startup"=-
"ISUSScheduler"=-
"KernelFaultCheck"=-
"SunJavaUpdateSched"=-

:files
C:\WINDOWS\tasks\mixpadShakeIcon.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
C:\WINDOWS\tasks\photostageShakeIcon.job
C:\WINDOWS\tasks\prismShakeIcon.job
C:\WINDOWS\tasks\SLOW-PCfighter.job
C:\WINDOWS\tasks\SystemToolsDailyTest.job
C:\WINDOWS\tasks\videopadShakeIcon.job
C:\WINDOWS\tasks\wavepadShakeIcon.job
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]

Nasledne kliknete na Opravit
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

frutas11 · #27 Příspěvek od **frutas11** » 26 říj 2011 22:10

All processes killed
========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-1547161642-492894223-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1547161642-492894223-842925246-500\Software\Microsoft\Internet Explorer\URLSearchHooks\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ deleted successfully.
Prefs.js: "SweetIM Search" removed from browser.search.defaultenginename
Prefs.js: "BrotherSoft Extreme Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "http://home.sweetim.com" removed from browser.startup.homepage
Prefs.js: "http://search.mywebsearch.com/mywebsear ... searchfor=" removed from keyword.URL
Prefs.js: "Foxtab Web Search" removed from sweetim.toolbar.previous.browser.search.defaultenginename
Prefs.js: "http://search.conduit.com/ResultsExt.as ... earchTerms}" removed from sweetim.toolbar.previous.browser.search.defaulturl
Prefs.js: "Google" removed from sweetim.toolbar.previous.browser.search.selectedEngine
Prefs.js: "http://search.babylon.com/?babsrc=HP_ss ... 112513528f" removed from browser.startup.homepage
Prefs.js: "http://search.mywebsearch.com/mywebsear ... searchfor=" removed from sweetim.toolbar.previous.keyword.URL
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\conduit.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\Foxtab Web Search.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\mywebsearch.xml moved successfully.
C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\hsrakrqj.default\searchplugins\sweetim.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1547161642-492894223-842925246-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-1547161642-492894223-842925246-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{51A86BB3-6602-4C85-92A5-130EE4864F13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51A86BB3-6602-4C85-92A5-130EE4864F13}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP108D.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP10A6.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1188.tmp\mscorlib.dll deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1188.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP126D.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP128F.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP136D.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1454.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1479.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1487.tmp\WindowsBase.dll deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1487.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1581.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP31.tmp\AjaVideoProperties.dll deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP31.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP41F.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP48.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP52.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP53.tmp\System.Web.Extensions.dll deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP53.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6E.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC3.tmp folder deleted successfully.
C:\WINDOWS\CSC\csc1.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1603.tmp deleted successfully.
C:\WINDOWS\Installer\MSI162.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1670.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1671.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1672.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1673.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1675.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1676.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1677.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1678.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1679.tmp deleted successfully.
C:\WINDOWS\Installer\MSI167A.tmp deleted successfully.
C:\WINDOWS\Installer\MSI167B.tmp deleted successfully.
C:\WINDOWS\Installer\MSI167D.tmp deleted successfully.
C:\WINDOWS\Installer\MSI167E.tmp deleted successfully.
C:\WINDOWS\Installer\MSI167F.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1680.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1681.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1682.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1684.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1685.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1686.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1687.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1688.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1689.tmp deleted successfully.
C:\WINDOWS\Installer\MSI168B.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1812.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1814.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1815.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1816.tmp deleted successfully.
C:\WINDOWS\Installer\MSI1E.tmp deleted successfully.
C:\WINDOWS\Installer\MSI24.tmp deleted successfully.
C:\WINDOWS\Installer\MSI32.tmp deleted successfully.
C:\WINDOWS\Installer\MSI61.tmp deleted successfully.
C:\WINDOWS\Installer\MSI63.tmp deleted successfully.
C:\WINDOWS\Installer\MSI65.tmp deleted successfully.
C:\WINDOWS\Installer\MSI66.tmp deleted successfully.
C:\WINDOWS\Installer\MSIAD.tmp deleted successfully.
C:\WINDOWS\Installer\MSIAE.tmp deleted successfully.
C:\WINDOWS\Installer\MSIAF.tmp deleted successfully.
C:\WINDOWS\Installer\MSIB0.tmp deleted successfully.
C:\WINDOWS\Installer\MSIE3.tmp deleted successfully.
C:\WINDOWS\system32\ConduitEngine.tmp deleted successfully.
C:\WINDOWS\system32\CONFIG.TMP deleted successfully.
C:\WINDOWS\system32\SET16C1.tmp deleted successfully.
C:\Documents and Settings\Administrator\Data aplikací\BabylonToolbar\BabylonToolbar folder moved successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:05EE1EEF deleted successfully.
========== SERVICES/DRIVERS ==========
Service gusvc stopped successfully!
Service gusvc deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UIUCU not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ISUSPM Startup deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ISUSScheduler deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
========== FILES ==========
C:\WINDOWS\tasks\mixpadShakeIcon.job moved successfully.
C:\WINDOWS\tasks\MP Scheduled Scan.job moved successfully.
C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job moved successfully.
C:\WINDOWS\tasks\photostageShakeIcon.job moved successfully.
C:\WINDOWS\tasks\prismShakeIcon.job moved successfully.
C:\WINDOWS\tasks\SLOW-PCfighter.job moved successfully.
C:\WINDOWS\tasks\SystemToolsDailyTest.job moved successfully.
C:\WINDOWS\tasks\videopadShakeIcon.job moved successfully.
C:\WINDOWS\tasks\wavepadShakeIcon.job moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 232709796 bytes
->Temporary Internet Files folder emptied: 3907669 bytes
->Java cache emptied: 1107180 bytes
->FireFox cache emptied: 67876159 bytes
->Flash cache emptied: 4591 bytes

User: All Users

User: Default User
->Temp folder emptied: 46480278 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21825985871 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 46492015 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 21 195,00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 10262011_230608

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#28 Příspěvek od **vyosek** » 27 říj 2011 06:34

Tyyy kkks, najednou mate 21 giga volneho mista - byl to jen balast, tmp soubory apod

Total Files Cleaned = 21 195,00 mb

Jak se chova PC

frutas11 · #29 Příspěvek od **frutas11** » 27 říj 2011 09:42

Jak je to možné?Ano,řešil sem problémy a nevěděl co mi zabírá tolik místa.Od té doby mi počítač prozatím funguje bez problémů,neseká se,neodpojuje se internet,vše načítá rychle a soubory se neskrývají a dost tomu pomohlo i ten MBAM .Myslím že to problém vyřešilo!Tisíceré díky!!!Chvála vám,notebook funguje super.

#30 Příspěvek od **vyosek** » 27 říj 2011 10:28

Asi jste se o sveho milacka nestaral jak by bylo vhodne

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 232709796 bytes
->Temporary Internet Files folder emptied: 3907669 bytes
->Java cache emptied: 1107180 bytes
->FireFox cache emptied: 67876159 bytes
->Flash cache emptied: 4591 bytes

User: All Users

User: Default User
->Temp folder emptied: 46480278 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21825985871 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 46492015 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 21 195,00 mb

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
- Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
- prepnete se do zalozky Nastroje
- Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
- Toto provedte se vsemi disky
Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
- Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
- Kliknete na Analyzovat
- Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
- Postup provedte se vsemi disky
Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
- Vyhodou programku je, ze se neinstaluje
- Staci tedy jen stahnout dle verze vaseho OS a rozbalit
- Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
- Probehne analyza disku a nasledne i defragmentace

Dejte novy log z RSIT a napiste ci jsou jeste nejake probelmy

VIRY.CZ

Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů

Re: Sekání,skrývaní souborů