Kontrola logu + detekované viry

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#16 Příspěvek od sh4ke »

Který free antivir by jste doporučil? Mám ho instalovat teď nebo po všech procesech?
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#17 Příspěvek od vyosek »

:arrow: Zatim to nechte tak, pak tam dame nejake free zabezpeceni

:arrow: Stahnete Avenger http://forum.viry.cz/viewtopic.php?f=11&t=19832
  • Pokud pouzivate Win Vista ci W7, kliknete na Avenger pravym a dejte Run As Administrator ci Spustit jako spravce
  • Po spusteni Vas program upozorni, ze vse co delate, delate na vlastni riziko - Dejte OK
  • Po potvrzeni uz na Vas koukne hlavni okno, kam vlozite skript, ktery mate nize

  • Kód: Vybrat vše

    Folders to delete:
c:\windows\$NtUninstallKB14358$
  • Do ctverecku u Scan for rootkits a Automatically disable any rootkits found dejte fajecku
  • Nyni uz kliknete na Execute a potvrdte Yes v nasledujicim okne - timto potvrdite spusteni skriptu
  • Na otazku Reboot now odpovezte opet OK - timto se PC restartuje
  • Po restartu by se mel otevrit poznamkovy blok s logem a jeho obsah vlozte sem. Pokud se tak nestane, naleznete pozadovany dokument v C:\avenger.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#18 Příspěvek od sh4ke »

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Folder "c:\windows\$NtUninstallKB14358$" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#19 Příspěvek od vyosek »

Skript pro ComboFix - postup stejny jako minule

Kód: Vybrat vše

KillAll::

Driver::
.norton2009Reset

Collect::
C:\Program Files\Norton2009Reset.exe

Folder::
c:\program files\Eset\MiNODLogin

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"\\??\\c:\\WINDOWS\\system32\\winlogon.exe"=-

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

Firefox::
FF - ProfilePath - c:\documents and settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}

Reboot::
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#20 Příspěvek od sh4ke »

ComboFix 12-04-01.03 - Asus 03.04.2012 11:43:55.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.895.475 [GMT 2:00]
Spuštěný z: c:\documents and settings\Asus\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Asus\Plocha\CFScript.txt
AV: ESET Smart Security 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-03 do 2012-04-03 )))))))))))))))))))))))))))))))
.
.
2012-04-02 15:32 . 2012-04-02 15:33 -------- d-----w- c:\program files\trend micro
2012-04-02 15:32 . 2012-04-02 15:33 -------- d-----w- C:\rsit
2012-04-02 14:41 . 2012-04-02 14:41 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\GHISLER
2012-04-01 17:25 . 2012-04-01 17:25 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\ESET
2012-04-01 17:25 . 2012-04-01 17:25 -------- d-----w- c:\documents and settings\Asus\Data aplikací\ESET
2012-04-01 17:24 . 2012-04-01 17:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2012-04-01 17:23 . 2012-04-01 17:23 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2012-04-01 10:36 . 2012-04-02 15:55 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\LogMeIn Hamachi
2012-04-01 10:35 . 2012-04-03 09:53 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
2012-04-01 10:35 . 2012-04-01 10:35 -------- d-----w- c:\program files\LogMeIn Hamachi
2012-04-01 09:49 . 2012-04-01 09:49 -------- d-----w- C:\ATI
2012-04-01 09:36 . 2012-04-01 09:38 -------- d-----w- C:\totalcmd
2012-04-01 09:27 . 2012-04-01 09:27 -------- d-----w- c:\program files\Valve
2012-03-31 08:28 . 2012-04-01 12:11 165232 ---ha-w- c:\documents and settings\Asus\Data aplikací\Microsoft\Virtual PC\VPCKeyboard.dll
2012-03-31 08:28 . 2012-03-31 08:28 -------- d-----w- c:\program files\Microsoft Virtual PC
2012-03-31 08:18 . 2012-03-31 08:18 -------- d-----w- c:\program files\Microsoft Works
2012-03-31 08:13 . 2012-03-31 08:13 -------- d-----w- c:\documents and settings\Asus\Local Settings\Data aplikací\Microsoft Help
2012-03-31 08:13 . 2012-03-31 08:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Microsoft Help
2012-03-31 08:10 . 2003-06-18 23:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2012-03-31 08:10 . 2003-06-18 23:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2012-03-31 08:08 . 2012-03-31 08:08 -------- d-----w- c:\program files\Microsoft.NET
2012-03-31 08:06 . 2012-03-31 08:06 -------- d-----r- C:\MSOCache
2012-03-31 08:01 . 2012-03-31 08:01 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-03-31 07:59 . 2012-03-31 07:59 -------- d-----w- c:\documents and settings\Asus\Data aplikací\pdfforge
2012-03-31 07:59 . 2012-03-14 16:23 54784 ----a-w- c:\windows\system32\pdfcmon.dll
2012-03-31 07:59 . 2004-03-08 23:00 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-03-31 07:59 . 1998-06-23 23:00 137000 ----a-w- c:\windows\system32\MSMAPI32.OCX
2012-03-31 07:59 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-03-31 07:59 . 2012-03-31 07:59 -------- d-----w- c:\program files\PDFCreator
2012-03-31 07:57 . 2012-03-31 07:57 637848 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-03-31 07:57 . 2012-03-31 07:57 567696 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-31 07:56 . 2012-03-31 07:56 -------- d-----w- c:\program files\CCleaner
2012-03-31 07:31 . 2012-04-03 09:54 -------- d-----w- c:\documents and settings\Asus\.rainlendar2
2012-03-31 07:30 . 2012-03-31 07:30 -------- d-----w- c:\program files\Rainlendar2
2012-03-31 07:22 . 2012-03-31 07:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Skype Extras
2012-03-30 19:13 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2012-03-30 19:11 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2012-03-30 19:09 . 2012-01-09 16:20 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-31 08:01 . 2008-10-21 07:16 473656 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-03-31 07:57 . 2007-09-26 05:27 141312 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-03 09:57 . 2004-08-18 12:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-09 16:20 . 2007-02-01 06:52 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-02_17.30.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-03 09:53 . 2012-04-03 09:53 16384 c:\windows\temp\Perflib_Perfdata_570.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@="{E4000AC4-5E5F-4956-807A-C5854405D64F}"
[HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}]
2007-09-18 09:56 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2011-08-12 2433024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-04-27 344064]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-08 3076144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Aktualizovat ESET licenci.lnk - c:\program files\Eset\MiNODLogin\MiNODLogin.exe [N/A]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43 69632 ----a-w- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
2004-06-09 07:37 40960 ----a-r- c:\windows\VM_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Control Center]
2006-03-21 13:50 1678336 ----a-w- c:\program files\ASUS\WLAN Card Utilities\Center.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-02-13 08:06 3481408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl]
2006-04-17 09:24 110592 ----a-r- c:\windows\ATK0100\HControl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-02-28 15:38 1987976 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-14 15:21 16270848 ----a-w- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-06-01 05:57 573440 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TO2SSM_McciTrayApp]
2008-08-15 16:33 1473536 ----a-w- c:\program files\TO2SSM\McciTrayApp.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Valve\\Half-Life\\hl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [4.8.2011 9:20 118104]
R2 ekrn;ESET Service;c:\program files\Eset\ESET Smart Security\ekrn.exe [8.9.2011 7:34 974944]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [28.2.2012 17:38 1373576]
R3 ZD1211BU(ASUS);ASUS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ASUS);c:\windows\system32\drivers\ZD1211BU.sys [1.2.2007 9:37 425472]
S3 AVerBDA3x;AVerMedia SAA713x BDA Service;c:\windows\system32\drivers\AVerBDA3x.sys [28.3.2007 16:41 1175936]
S3 ZSMC302;VIMICRO USB PC Camera;c:\windows\system32\drivers\usbVM31b.sys [16.10.2007 15:32 91263]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 19:31]
.
2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 19:31]
.
2012-04-03 c:\windows\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} -
FF - ProfilePath - c:\documents and settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-03 11:54
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1952)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2864)
c:\windows\system32\VirtualExpander\VEShellExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Celkový čas: 2012-04-03 11:58:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-03 09:58
ComboFix2.txt 2012-04-02 18:42
ComboFix3.txt 2012-04-02 17:35
.
Před spuštěním: Volných bajtů: 58 166 812 672
Po spuštění: Volných bajtů: 58 145 079 296
.
- - End Of File - - 8189EFFBDC03771F99F0E1525ACB74C7
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#21 Příspěvek od vyosek »

:arrow: Odistalujte ESET

:arrow: Nainstalujte free reseni, napr. Avast nebo Avira nebo MSE

:arrow: Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
  • Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
  • Zaskrtnete okenko Pro vsechny uzivatele
  • Zaskrtnete okenko Kontrola na havet "LOP"
  • Zaskrtnete okenko Kontrola na havet "Purity"
  • Stari souboru zmente z 30 dnu na 7 dnu
  • Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

  • Kód: Vybrat vše

    CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s
  • Kliknete na tlacitko Prohledat
  • Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#22 Příspěvek od sh4ke »

OTL logfile created on: 3.4.2012 13:31:50 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Asus\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

895,36 Mb Total Physical Memory | 491,07 Mb Available Physical Memory | 54,85% Memory free
1,37 Gb Paging File | 0,96 Gb Available in Paging File | 69,92% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,53 Gb Total Space | 53,97 Gb Free Space | 72,41% Space Free | Partition Type: NTFS

Computer Name: ASUS | User Name: Asus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2012.04.03 13:29:52 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
PRC - [2012.03.27 04:28:45 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
PRC - [2012.02.28 17:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
PRC - [2011.12.09 12:40:53 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.09 12:40:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.09 12:40:29 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.12.09 12:40:29 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.12 07:45:18 | 002,433,024 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.03 15:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


========== Modules (No Company Name) ==========

MOD - [2012.03.27 04:28:43 | 000,444,400 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\ppgooglenaclpluginchrome.dll
MOD - [2012.03.27 04:28:42 | 003,915,248 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\pdf.dll
MOD - [2012.03.27 04:27:17 | 000,122,880 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avutil-51.dll
MOD - [2012.03.27 04:27:16 | 000,220,672 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avformat-53.dll
MOD - [2012.03.27 04:27:14 | 001,747,456 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\avcodec-53.dll
MOD - [2012.03.27 03:37:41 | 008,747,168 | ---- | M] () -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
MOD - [2011.12.09 12:40:40 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2011.08.12 07:45:26 | 000,198,144 | ---- | M] () -- C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
MOD - [2011.08.12 07:45:18 | 002,433,024 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
MOD - [2010.12.12 12:58:14 | 000,502,784 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_xrc_vc_rny.dll
MOD - [2010.12.12 12:58:00 | 000,131,584 | ---- | M] () -- C:\Program Files\Rainlendar2\wxbase28u_xml_vc_rny.dll
MOD - [2010.12.12 12:57:56 | 000,485,376 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_html_vc_rny.dll
MOD - [2010.12.12 12:57:44 | 000,707,584 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_adv_vc_rny.dll
MOD - [2010.12.12 12:57:36 | 002,633,216 | ---- | M] () -- C:\Program Files\Rainlendar2\wxmsw28u_core_vc_rny.dll
MOD - [2010.12.12 12:56:46 | 001,205,760 | ---- | M] () -- C:\Program Files\Rainlendar2\wxbase28u_vc_rny.dll
MOD - [2010.05.23 20:20:08 | 000,012,288 | ---- | M] () -- C:\Program Files\Rainlendar2\lfs.dll
MOD - [2010.05.23 20:20:04 | 000,126,976 | ---- | M] () -- C:\Program Files\Rainlendar2\lua51.dll
MOD - [2010.04.11 18:48:06 | 000,327,680 | ---- | M] () -- C:\Program Files\WinRAR\rarlng.dll
MOD - [2010.03.15 11:28:24 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.02.28 17:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.12.09 12:40:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.09 12:40:29 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2007.03.26 13:06:24 | 000,292,864 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.03.03 15:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pfc027.sys -- (SoC PC-Camera Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\NSNDIS5.SYS -- (NSNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awwh9xv1)
DRV - [2012.03.31 10:01:37 | 000,473,656 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2011.12.09 12:40:53 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.12.09 12:40:52 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.09 12:40:52 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.08.22 15:43:35 | 000,138,184 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK)
DRV - [2009.03.18 16:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.04.13 20:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.04.13 20:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008.04.13 20:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008.03.29 11:20:55 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2008.03.29 11:20:55 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008.03.13 13:51:52 | 000,057,536 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2008.03.13 13:50:02 | 000,072,000 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2007.03.01 08:11:40 | 001,175,936 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVerBDA3x.sys -- (AVerBDA3x)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.11.15 14:34:40 | 004,225,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.07.24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2006.06.14 18:16:00 | 000,425,472 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ZD1211BU.sys -- (ZD1211BU(ASUS)) ASUS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ASUS)
DRV - [2006.06.01 08:03:00 | 000,894,336 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2006.04.27 03:46:50 | 001,540,096 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.01.18 12:41:58 | 000,080,512 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2005.07.14 13:14:34 | 000,027,904 | ---- | M] (REDC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2005.07.12 20:00:30 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005.02.17 17:07:48 | 000,005,632 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2004.08.18 14:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.18 14:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004.08.17 05:44:22 | 000,091,263 | R--- | M] (VM) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbVM31b.sys -- (ZSMC302)
DRV - [2004.08.04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004.05.28 04:13:04 | 000,016,269 | R--- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\ATK0100\ASNDIS5.sys -- (ASNDIS5)
DRV - [2003.07.16 14:27:40 | 000,043,264 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [1999.09.10 13:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={ ... rer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchT ... urceid=ie7
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?sr ... earchTerms}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 0winampie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = http://google.icq.com/search/search_frame.php
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes,DefaultScope = {91D2E934-3C7C-404D-8CC1-16A2B0E4B762}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{03dda22f-9a77-45d1-8aea-81cd292335e6}: "URL" = http://www.mapy.cz/?query={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{04de38ac-5e22-4cf0-a66d-3abf1b59bc25}: "URL" = http://www.zbozi.cz/?q={searchTerms}&r= ... rceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?clien ... C436A12ADF
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q ... &ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchT ... EA_csCZ319
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{82f4bbed-5a19-4d9f-ab53-4a233ffe7d9c}: "URL" = http://www.firmy.cz/phr/{searchTerms}?sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{91D2E934-3C7C-404D-8CC1-16A2B0E4B762}: "URL" = http://search.seznam.cz/?q={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.as ... =CT2086743
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q ... &ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?sr ... earchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 0winampie7
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.seznam.cz/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10
FF - prefs.js..network.proxy.http: "proxy.local"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://slirsredirect.search.aol.com/sli ... pab&query="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found
FF - HKCU\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.06.13 16:58:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.31 10:18:45 | 000,000,000 | ---D | M]

[2008.10.14 14:13:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Extensions
[2012.04.02 16:13:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions
[2008.10.14 14:13:25 | 000,000,000 | ---D | M] (WebTran) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}
[2010.06.13 13:04:30 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.06.12 19:47:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.13 13:04:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 16:44:22 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2012.03.29 23:23:37 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\askcom.xml
[2008.10.21 09:20:59 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\daemon-search.xml
[2012.03.29 23:33:41 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-1.xml
[2008.10.14 14:27:35 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-2.xml
[2008.11.21 12:58:28 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-3.xml
[2009.01.15 13:31:47 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-4.xml
[2010.09.24 12:00:22 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-5.xml
[2008.02.27 15:14:50 | 000,000,962 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin.xml
[2010.09.12 16:43:47 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\sweetim.xml
[2010.06.13 13:04:42 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\winamp-search.xml
[2010.06.12 18:00:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{0B38152B-1B20-484D-A11F-5E04A9B0661F}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}
[2009.02.25 17:11:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.04.01 18:51:34 | 000,000,638 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\jyxo-cz.xml
[2010.04.01 18:51:34 | 000,001,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\mall-cz.xml
[2010.04.01 18:51:34 | 000,001,367 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\seznam-cz.xml
[2010.04.01 18:51:34 | 000,000,654 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\slunecnice-cz.xml
[2010.04.01 18:51:34 | 000,001,179 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-cz.xml

========== Chrome ==========

CHR - default_search_provider: PHPNukeEN Customized Web Search (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/ResultsExt.as ... =CT2086743
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Asus\Local Settings\Data aplikac\u00ED\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Vyhled\u00E1v\u00E1n\u00ED Google = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Documents and Settings\Asus\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.04.03 11:53:46 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Podpora odkazu pro Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - Reg Error: Key error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - Reg Error: Key error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftup ... 0375997750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.152.40.4 10.152.40.5
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A959A310-2B37-4770-858E-B1DAC530491B}: DhcpNameServer = 10.152.40.4 10.152.40.5
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Aktuální domovská stránka) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.02.01 08:56:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.g723 - g723.acm File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.I263 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2012.04.03 13:29:50 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
[2012.04.03 13:26:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\Avira
[2012.04.03 13:21:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Avira
[2012.04.03 13:20:56 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.04.03 13:20:54 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.04.03 13:20:54 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.04.03 13:20:54 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.04.03 13:20:53 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.04.03 13:20:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Avira
[2012.04.03 13:11:18 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012.04.03 11:51:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012.04.02 21:01:24 | 000,000,000 | ---D | C] -- C:\Avenger
[2012.04.02 19:07:57 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012.04.02 18:59:31 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012.04.02 18:59:31 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012.04.02 18:59:31 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012.04.02 18:59:31 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012.04.02 18:59:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012.04.02 18:59:20 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.04.02 18:57:37 | 004,453,973 | R--- | C] (Swearware) -- C:\Documents and Settings\Asus\Plocha\ComboFix.exe
[2012.04.02 18:10:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\RK_Quarantine
[2012.04.02 17:55:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Asus\Recent
[2012.04.02 17:32:59 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2012.04.02 17:32:58 | 000,000,000 | ---D | C] -- C:\rsit
[2012.04.02 16:41:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\GHISLER
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 19:24:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\ESET
[2012.04.01 12:36:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\LogMeIn Hamachi
[2012.04.01 12:35:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\LogMeIn Hamachi
[2012.04.01 12:35:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\LogMeIn Hamachi
[2012.04.01 12:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn Hamachi
[2012.04.01 11:49:18 | 000,000,000 | ---D | C] -- C:\ATI
[2012.04.01 11:36:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Total Commander
[2012.04.01 11:36:29 | 000,000,000 | ---D | C] -- C:\totalcmd
[2012.04.01 11:30:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Valve
[2012.04.01 11:27:37 | 000,000,000 | ---D | C] -- C:\Program Files\Valve
[2012.03.31 10:41:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Dokumenty\My Virtual Machines
[2012.03.31 10:39:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Radek
[2012.03.31 10:39:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\OPF-SU-materialy
[2012.03.31 10:39:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Michal K
[2012.03.31 10:38:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\CISCO
[2012.03.31 10:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Virtual PC
[2012.03.31 10:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2012.03.31 10:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2012.03.31 10:16:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\WinRAR
[2012.03.31 10:15:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\WinRAR
[2012.03.31 10:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\WinRAR
[2012.03.31 10:13:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\Microsoft Help
[2012.03.31 10:13:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
[2012.03.31 10:10:27 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mdimon.dll
[2012.03.31 10:09:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Microsoft Office
[2012.03.31 10:09:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012.03.31 10:08:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.03.31 10:08:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.03.31 10:06:42 | 000,000,000 | R--D | C] -- C:\MSOCache
[2012.03.31 10:01:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\DAEMON Tools Lite
[2012.03.31 10:01:22 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.03.31 09:59:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\PDFCreator
[2012.03.31 09:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2012.03.31 09:59:08 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCOMCT2.OCX
[2012.03.31 09:59:08 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSMAPI32.OCX
[2012.03.31 09:59:08 | 000,054,784 | ---- | C] (pdfforge GbR) -- C:\WINDOWS\System32\pdfcmon.dll
[2012.03.31 09:59:06 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSMPIDE.DLL
[2012.03.31 09:59:05 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator
[2012.03.31 09:58:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Sun
[2012.03.31 09:57:45 | 000,637,848 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.03.31 09:57:45 | 000,567,696 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012.03.31 09:57:44 | 000,224,136 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012.03.31 09:57:44 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012.03.31 09:57:44 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012.03.31 09:56:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Nabídka Start\Programy\CCleaner
[2012.03.31 09:56:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.03.31 09:45:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Plocha\Systémové služby
[2012.03.31 09:31:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\.rainlendar2
[2012.03.31 09:30:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Rainlendar2
[2012.03.31 09:30:41 | 000,000,000 | ---D | C] -- C:\Program Files\Rainlendar2
[2012.03.31 09:22:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\Skype Extras
[2012.03.30 21:13:06 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2012.03.30 21:11:12 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2012.03.30 21:09:23 | 000,139,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2012.03.30 20:01:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Nabídka Start\Programy\Google Chrome
[2012.03.30 14:09:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Dokumenty\Stažené soubory
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2012.04.03 13:33:59 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.04.03 13:29:52 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Asus\Plocha\OTL.exe
[2012.04.03 13:24:39 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:21:14 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Avira Control Center.lnk
[2012.04.03 13:14:51 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:13:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.04.03 13:13:50 | 938,921,984 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.03 11:53:46 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012.04.02 22:53:06 | 000,619,236 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\1012638-1024x768-Beautiful_Orchid.jpg
[2012.04.02 19:08:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012.04.02 18:57:59 | 004,453,973 | R--- | M] (Swearware) -- C:\Documents and Settings\Asus\Plocha\ComboFix.exe
[2012.04.02 17:54:29 | 000,677,398 | ---- | M] () -- C:\Documents and Settings\Asus\Dokumenty\cc_20120402_175415.reg
[2012.04.02 16:41:10 | 000,000,124 | ---- | M] () -- C:\WINDOWS\amapro.dat
[2012.04.02 16:40:52 | 000,000,070 | ---- | M] () -- C:\WINDOWS\systems.dat
[2012.04.02 00:10:38 | 000,000,112 | ---- | M] () -- C:\Documents and Settings\All Users\Data aplikací\Aw1n2dA.dat
[2012.04.01 19:46:41 | 000,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\Skype.lnk
[2012.04.01 19:25:38 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2012.04.01 14:12:26 | 4113,652,736 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vhd
[2012.04.01 14:12:26 | 098,562,908 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vsv
[2012.04.01 14:12:26 | 000,012,674 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vmc
[2012.04.01 13:11:17 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2012.04.01 12:35:13 | 000,000,685 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\LogMeIn Hamachi.lnk
[2012.04.01 12:24:32 | 000,442,606 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.04.01 12:24:32 | 000,440,548 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2012.04.01 12:24:32 | 000,084,052 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2012.04.01 12:24:32 | 000,072,542 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.04.01 12:00:43 | 000,198,552 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.04.01 11:49:10 | 000,000,329 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Zástupce - Dokumenty.lnk
[2012.04.01 11:36:31 | 000,000,548 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Total Commander.lnk
[2012.04.01 11:30:34 | 000,001,725 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Team Fortress Classic.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Ricochet.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Deathmatch Classic.lnk
[2012.04.01 11:30:34 | 000,001,669 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Half-Life.lnk
[2012.03.31 10:10:36 | 000,000,390 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2012.03.31 10:01:37 | 000,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\DAEMON Tools Lite.lnk
[2012.03.31 09:59:18 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\PDFArchitect.lnk
[2012.03.31 09:59:18 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\PDFCreator.lnk
[2012.03.31 09:57:24 | 000,224,136 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012.03.31 09:57:24 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012.03.31 09:57:24 | 000,141,312 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012.03.31 09:57:23 | 000,637,848 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.03.31 09:57:23 | 000,567,696 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012.03.31 09:57:23 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012.03.31 09:56:43 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2012.03.31 09:30:56 | 000,001,596 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Rainlendar2.lnk
[2012.03.30 20:01:12 | 000,002,250 | ---- | M] () -- C:\Documents and Settings\Asus\Plocha\Google Chrome.lnk
[2012.03.30 14:06:12 | 000,400,339 | ---- | M] () -- C:\ASWL2K.ini
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.04.03 13:33:59 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.04.03 13:21:14 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\Avira Control Center.lnk
[2012.04.02 22:53:12 | 000,619,236 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\1012638-1024x768-Beautiful_Orchid.jpg
[2012.04.02 19:08:02 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012.04.02 19:07:59 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2012.04.02 18:59:31 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.04.02 18:59:31 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.04.02 18:59:31 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.04.02 18:59:31 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.04.02 18:59:31 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.04.02 17:54:18 | 000,677,398 | ---- | C] () -- C:\Documents and Settings\Asus\Dokumenty\cc_20120402_175415.reg
[2012.04.01 19:47:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Data aplikací\Aw1n2dA.dat
[2012.04.01 19:25:38 | 000,000,819 | ---- | C] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2012.04.01 14:12:15 | 098,562,908 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vsv
[2012.04.01 12:35:13 | 000,000,685 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\LogMeIn Hamachi.lnk
[2012.04.01 11:48:59 | 000,000,329 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Zástupce - Dokumenty.lnk
[2012.04.01 11:36:31 | 000,000,548 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Total Commander.lnk
[2012.04.01 11:30:34 | 000,001,725 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Team Fortress Classic.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Ricochet.lnk
[2012.04.01 11:30:34 | 000,001,719 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Deathmatch Classic.lnk
[2012.04.01 11:30:34 | 000,001,669 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Half-Life.lnk
[2012.03.31 10:40:49 | 051,362,849 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\ccna-vykovy-pruvodce-pripravou-na-zkousku-640-802.pdf
[2012.03.31 10:40:46 | 016,079,753 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\1587201828.pdf
[2012.03.31 10:30:16 | 000,012,674 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vmc
[2012.03.31 10:29:59 | 4113,652,736 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\SrvEnTrial.vhd
[2012.03.31 10:28:16 | 000,001,630 | ---- | C] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Microsoft Virtual PC.lnk
[2012.03.31 10:01:37 | 000,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\DAEMON Tools Lite.lnk
[2012.03.31 09:59:18 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\PDFArchitect.lnk
[2012.03.31 09:59:18 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\PDFCreator.lnk
[2012.03.31 09:56:43 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Plocha\CCleaner.lnk
[2012.03.31 09:30:56 | 000,001,596 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Rainlendar2.lnk
[2012.03.30 20:01:12 | 000,002,250 | ---- | C] () -- C:\Documents and Settings\Asus\Plocha\Google Chrome.lnk
[2011.04.23 13:52:12 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2011.04.21 06:48:24 | 000,000,147 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2011.04.21 06:05:11 | 000,000,122 | ---- | C] () -- C:\WINDOWS\Winchat.ini
[2010.12.15 23:13:44 | 000,000,124 | ---- | C] () -- C:\WINDOWS\amapro.dat
[2010.12.15 23:13:41 | 000,000,070 | ---- | C] () -- C:\WINDOWS\systems.dat
[2010.04.04 20:46:01 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

========== LOP Check ==========

[2006.11.11 20:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\47821628
[2012.03.30 13:50:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Alternative Software Ltd
[2006.12.05 12:09:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Autodesk
[2012.03.31 10:01:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
[2011.04.20 09:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ERS G-Studio
[2009.03.25 00:25:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ICQ
[2007.09.11 13:48:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\Installations
[2009.12.07 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\IsolatedStorage
[2007.10.09 09:33:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PC Suite
[2009.01.13 20:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\PCSettings
[2009.02.25 17:21:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\ScanSoft
[2011.05.28 21:07:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\SugarGames
[2007.10.29 14:39:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[2007.08.07 15:54:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\WinZip
[2008.12.19 07:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011.03.29 13:15:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2011.05.23 20:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Alternative Software Ltd
[2007.04.18 09:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Autodesk
[2010.05.21 13:40:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Broad Intelligence
[2008.11.14 15:00:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Canon
[2009.08.20 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite
[2007.05.30 12:29:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktop Sidebar
[2012.04.02 17:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktopicon
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 11:38:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\GHISLER
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[2007.02.14 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQLite
[2007.10.24 15:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Image Zone Express
[2007.03.17 08:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InterVideo
[2010.05.21 13:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Jpeg Resampler
[2009.08.22 07:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Leadertech
[2007.02.09 15:42:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\NewSoft
[2007.10.09 09:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nokia
[2010.05.21 13:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy
[2007.09.11 13:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC Suite
[2008.07.16 15:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC-FAX TX
[2012.03.31 09:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2011.05.22 22:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\RenPy
[2009.02.25 18:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Samsung
[2008.02.13 14:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Složka odesílání Share-to-Web
[2009.12.07 20:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca
[2009.06.13 19:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Uniblue
[2012.04.03 13:24:39 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

========== Purity Check ==========



========== Custom Scans ==========

< >

< >

< MD5 for: ATAPI.SYS >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.18 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\cmdcons\autochk.exe
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
[2008.04.14 05:22:10 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=C7A9FF12C63E2E448722B02C71A8C431 -- C:\WINDOWS\system32\autochk.exe
[2004.08.18 14:00:00 | 000,601,088 | ---- | M] (Microsoft Corporation) MD5=CEA8636EC12F062C1ED8A7CB4E75324F -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe

< MD5 for: CDROM.SYS >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008.04.13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2004.08.18 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\explorer.exe
[2008.04.14 05:22:22 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=27AFD587C462E280EE046B8CCA3C2CD1 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004.08.18 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=53114D57AB73A406AC7F602227781A99 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:11:59 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=9B32416BD5988C97B6397CE0B02CAF97 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:23:39 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=ED7B460B142A32097B8A8F6ECC941815 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: HAL.DLL >
[2004.08.18 14:00:00 | 018,786,869 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.09.29 12:43:54 | 023,890,583 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:hal.dll
[2008.04.13 20:31:32 | 000,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2008.04.13 20:31:28 | 000,131,840 | ---- | M] (Microsoft Corporation) MD5=6F61D3287A6A15A08A9433222C09D17F -- C:\WINDOWS\system32\HAL.DLL
[2004.08.18 14:00:00 | 000,131,968 | ---- | M] (Microsoft Corporation) MD5=F9A0F579FC18036FFDD9E26E0D268CCD -- C:\WINDOWS\$NtServicePackUninstall$\hal.dll

< MD5 for: SCECLI.DLL >
[2004.08.18 14:00:00 | 000,184,832 | ---- | M] (Microsoft Corporation) MD5=07119058D451CB7EA4317BCFDA8599A6 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 05:21:54 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=830CE8951C71F361D7D2F38416CC8BC1 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008.04.14 05:22:48 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=BE4A520E29B6391F49E79CCC52044D93 -- C:\WINDOWS\system32\svchost.exe
[2004.08.18 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=DFBA2915B0BF58ABB288CD4C9318CB3F -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: TCPIP.SYS >
[2006.04.20 13:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
[2008.06.20 12:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2007.10.30 18:53:32 | 000,360,832 | ---- | M] (Microsoft Corporation) MD5=64798ECFA43D78C7178375FCDD16D8C8 -- C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[2008.06.20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2007.10.30 19:20:55 | 000,360,064 | ---- | M] (Microsoft Corporation) MD5=90CAFF4B094573449A0872A0F919B178 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008.04.13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\ERDNT\cache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2004.08.18 14:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\SoftwareDistribution\Download\fe608cd8d2b8f77abaee7a69a696bcf7\sp3qfe\tcpip.sys
[2006.04.20 14:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 05:22:50 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=7DC1830F22E7D275B438127B68030239 -- C:\WINDOWS\system32\userinit.exe
[2004.08.18 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=836F7960362FF95C5D49E40B891F2CFC -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004.08.18 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=221C29AE1B4CC61D11D8B27DE78B2307 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 05:22:53 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=CDDB1F8E1AEA356F3AD106F2CF9B7FEA -- C:\WINDOWS\system32\winlogon.exe

< >

< %systemroot%*.* /U /s >
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[10 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[3 C:\WINDOWS\system32\spool\PRINTERS\*.tmp files -> C:\WINDOWS\system32\spool\PRINTERS\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#23 Příspěvek od sh4ke »

< %APPDATA%\*. >
[2009.02.25 16:34:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Adobe
[2007.02.15 15:50:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\AdobeUM
[2011.04.21 15:30:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Ahead
[2011.05.23 20:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Alternative Software Ltd
[2008.04.30 10:52:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Apple Computer
[2007.04.18 09:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Autodesk
[2012.04.03 13:26:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Avira
[2010.05.21 13:40:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Broad Intelligence
[2008.05.05 09:55:55 | 000,000,000 | R--D | M] -- C:\Documents and Settings\Asus\Data aplikací\Brother
[2008.11.14 15:00:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Canon
[2007.02.13 11:29:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Corel
[2007.04.05 09:20:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\CyberLink
[2009.08.20 20:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite
[2007.05.30 12:29:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktop Sidebar
[2012.04.02 17:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Desktopicon
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2010.05.21 13:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESTsoft
[2012.04.01 11:38:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\GHISLER
[2010.05.08 17:31:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Google
[2007.02.09 14:54:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Help
[2007.10.24 15:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\HP
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[2007.02.14 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQLite
[2007.02.01 09:06:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Identities
[2007.10.24 15:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Image Zone Express
[2011.03.29 13:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InstallShield
[2007.03.17 08:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\InterVideo
[2010.05.21 13:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Jpeg Resampler
[2009.08.22 07:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Leadertech
[2007.02.14 12:51:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Macromedia
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Media Player Classic
[2012.03.31 10:28:58 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Asus\Data aplikací\Microsoft
[2011.05.25 19:46:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Motive
[2008.10.14 14:13:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Mozilla
[2011.04.21 00:50:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nero
[2007.02.09 15:42:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\NewSoft
[2007.10.09 09:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Nokia
[2010.05.21 13:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy
[2007.09.11 13:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC Suite
[2008.07.16 15:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\PC-FAX TX
[2012.03.31 09:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\pdfforge
[2009.04.30 19:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Real
[2011.05.22 22:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\RenPy
[2009.02.25 18:04:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Samsung
[2009.08.22 15:22:30 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\Asus\Data aplikací\SecuROM
[2012.04.02 17:55:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Skype
[2012.04.01 19:07:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\skypePM
[2008.02.13 14:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Složka odesílání Share-to-Web
[2009.12.07 20:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca
[2007.09.25 15:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Sun
[2008.12.19 06:05:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Symantec
[2009.01.18 12:32:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\U3
[2009.06.13 19:06:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Uniblue
[2012.04.01 11:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\Winamp
[2012.03.31 10:16:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\WinRAR

< %APPDATA%\*.exe /s >
[2009.10.03 13:29:57 | 001,961,720 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Asus\Data aplikací\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2010.05.21 13:19:10 | 000,078,324 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\OpenCandy\OpenCandy_BA2A2780458240A8AB9D885919E2D5EE\WeFiSetup_5_142_513Wrapped.exe
[2009.12.07 20:17:42 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\SMS posílač Treca\SMSposilac.exe
[2005.06.06 11:29:14 | 000,110,592 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\U3\temp\cleanup.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job >
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:54:31 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007.02.01 09:42:57 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2007.02.01 09:42:57 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2007.02.01 09:42:57 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >
[2012.04.01 12:00:43 | 000,198,552 | ---- | M] () -- C:\WINDOWS\system32\FNTCACHE.DAT
[2012.04.01 12:24:32 | 000,084,052 | ---- | M] () -- C:\WINDOWS\system32\perfc005.dat
[2012.04.01 12:24:32 | 000,072,542 | ---- | M] () -- C:\WINDOWS\system32\perfc009.dat
[2012.04.01 12:24:32 | 000,440,548 | ---- | M] () -- C:\WINDOWS\system32\perfh005.dat
[2012.04.01 12:24:32 | 000,442,606 | ---- | M] () -- C:\WINDOWS\system32\perfh009.dat
[2012.04.01 12:24:31 | 001,048,882 | ---- | M] () -- C:\WINDOWS\system32\PerfStringBackup.INI
[2012.04.03 13:14:51 | 000,012,598 | ---- | M] () -- C:\WINDOWS\system32\wpa.dbl
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"Rainlendar2" = C:\Program Files\Rainlendar2\Rainlendar2.exe -- [2011.08.12 07:45:18 | 002,433,024 | ---- | M] ()

< >

< %PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5 >
[2010.04.01 19:59:58 | 000,910,296 | ---- | M] (Mozilla Corporation) MD5=49958506B773E40D31832E3EEDA522E7 -- C:\Program Files\Mozilla Firefox\firefox.exe

< %PROGRAMFILES%\Internet Explorer\iexplore.exe /md5 >
[2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\Program Files\Internet Explorer\iexplore.exe

< %PROGRAMFILES%\Opera\opera.exe /md5 >

< %PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5 >

< >

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2012.04.03 13:33:59 | 000,000,512 | ---- | M] () MD5=1FDBD6FB4781692E810D70FFF60A10E6 -- C:\PhysicalMBR.bin

< >

< *crack* /s >
[2011.04.20 13:32:27 | 000,000,363 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Microsoft\Office\Naposledy otevřené\dead_space_english_ISO+crack.LNK

< *keygen* /s >
[2011.04.20 13:32:27 | 000,000,508 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Microsoft\Office\Naposledy otevřené\dad space keygen.doc.LNK

< *loader* /s >
[2012.03.16 20:35:32 | 000,009,051 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\loader.gif
[2012.03.16 20:35:32 | 000,016,119 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\logo_loader_page.jpg
[2012.03.16 20:35:32 | 000,018,434 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\img\logo_loader_page.png
[2012.03.16 20:35:32 | 000,006,553 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\DAEMON Tools Lite\MediaInfo\js\app\MediaInfo\ImageInfoLoader.js
[2009.04.12 10:53:38 | 000,000,232 | ---- | M] () -- \Documents and Settings\Asus\Data aplikací\Nero\OnlineServices\NOSWebConfig\MySpace\uploadError-CSY.xml
[2011.12.09 12:40:31 | 000,047,568 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloader.dll
[2011.12.09 12:40:31 | 000,234,448 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloader.exe
[2011.12.09 12:40:32 | 001,715,152 | ---- | M] () -- \Program Files\Avira\AntiVir Desktop\avwebloadergui.dll
[2007.06.27 19:03:00 | 000,177,448 | ---- | M] () -- \Program Files\Common Files\Ahead\Lib\NeGuideStoreLoader.dll
[2006.10.26 13:40:34 | 000,057,344 | ---- | M] () -- \Program Files\Common Files\Microsoft Shared\VS7DEBUG\coloader.dll
[2006.10.26 13:40:34 | 000,005,120 | ---- | M] () -- \Program Files\Common Files\Microsoft Shared\VS7DEBUG\coloader.tlb
[2006.02.03 20:09:02 | 000,352,548 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\models\loader.mdl
[2006.02.03 20:09:12 | 000,012,764 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\sound\ambience\loader_hydra1.wav
[2006.02.03 20:09:12 | 000,012,164 | ---- | M] () -- \Program Files\Valve\Half-Life\valve\sound\ambience\loader_step1.wav
[2010.03.15 11:28:24 | 000,045,056 | ---- | M] () -- \Program Files\WinRAR\RarExtLoader.exe
[2004.08.18 14:00:00 | 000,035,840 | ---- | M] () -- \WINDOWS\$NtServicePackUninstall$\dmloader.dll
[2002.12.12 00:14:32 | 000,033,280 | ---- | M] () -- \WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmloader.dll
[2008.04.14 05:21:39 | 000,035,840 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\dmloader.dll
[2008.04.13 20:31:47 | 000,230,912 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\osloader.exe
[2008.04.13 20:31:48 | 000,278,528 | ---- | M] () -- \WINDOWS\ServicePackFiles\i386\osloader.ntd
[2008.04.14 05:21:39 | 000,035,840 | ---- | M] () -- \WINDOWS\system32\dmloader.dll
[2 \WINDOWS\system32\*.tmp files -> \WINDOWS\system32\*.tmp -> ]
[2002.12.12 00:14:32 | 000,033,280 | ---- | M] () -- \WINDOWS\system32\dllcache\dmloader.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:CB0AACC9

< End of report >
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#24 Příspěvek od sh4ke »

OTL Extras logfile created on: 3.4.2012 13:31:50 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Asus\Plocha
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

895,36 Mb Total Physical Memory | 491,07 Mb Available Physical Memory | 54,85% Memory free
1,37 Gb Paging File | 0,96 Gb Available in Paging File | 69,92% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,53 Gb Total Space | 53,97 Gb Free Space | 72,41% Space Free | Partition Type: NTFS

Computer Name: ASUS | User Name: Asus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" = C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe:*:Enabled:Media Player Classic - Homecinema -- (mpc-hc@Sourceforge)
"C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" = C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup -- (Nero AG)
"C:\Program Files\Valve\Half-Life\hl.exe" = C:\Program Files\Valve\Half-Life\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{066D65EA-ED53-44E4-A96A-F81B6E409D2E}" = PC Connectivity Solution
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = Ovládací panel ATI
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{350C9405-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{654b2e8b-91db-4d50-9af7-9c12b4c83f96}.sdb" = AH64-LB2
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{847CAE64-4CD2-4B2D-AF00-978FF5431029}" = Nero 7 Ultra Edition
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8D70145A-3BD3-4DBF-9CBF-223EF4A43257}" = ATI Parental Control & Encoder
"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver
"{90110405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0010-0405-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Czech) 12
"{90120000-0015-0405-0000-0000000FF1CE}" = Microsoft Office Access MUI (Czech) 2007
"{90120000-0016-0405-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Czech) 2007
"{90120000-0018-0405-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Czech) 2007
"{90120000-0019-0405-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Czech) 2007
"{90120000-001A-0405-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Czech) 2007
"{90120000-001B-0405-0000-0000000FF1CE}" = Microsoft Office Word MUI (Czech) 2007
"{90120000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2007
"{90120000-002C-0405-0000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0405-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Czech) 2007
"{90120000-006E-0405-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2007
"{90120000-00A1-0405-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Czech) 2007
"{90120000-00BA-0405-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Czech) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1029-7B44-A81200000003}" = Adobe Reader 8 - Czech
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet NIC Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E2494AD8-314D-44F8-B39C-4358A60DC184}" = LogMeIn Hamachi
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"All ATI Software" = Softarová utilita ATI - Odinstalovat
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"CodInstl" = Intel A/V Codecs V2.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"DTE" = DTE
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Half-Life_is1" = Half-Life
"HControl" = ATK0100 ACPI UTILITY
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.7.5
"LogMeIn Hamachi" = LogMeIn Hamachi
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MV2Player" = MV2Player (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"O2 Internet Konfigurator" = O2 Internet Konfigurator
"Rainlendar2" = Rainlendar2 (remove only)
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"Totalcmd" = Total Commander (Remove or Repair)
"Uniblue RegistryBooster 2009" = Uniblue RegistryBooster 2009
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24.5.2011 4:53:21 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace explorer.exe, verze 6.0.2900.5512, chybující modul
unknown, verze 0.0.0.0, adresa chyby 0x0fc085ff.

Error - 25.5.2011 15:33:37 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 25.5.2011 15:33:37 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 26.5.2011 7:26:54 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace wmplayer.exe, verze 11.0.5721.5145, chybující modul
kernel32.dll, verze 5.1.2600.5781, adresa chyby 0x00009e8a.

Error - 28.5.2011 15:19:01 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace billclub.dat, verze 1.0.0.3, chybující modul msvcrt.dll,
verze 7.0.2600.5512, adresa chyby 0x00036371.

Error - 30.3.2012 7:41:32 | Computer Name = ASUS | Source = Application Error | ID = 1000
Description = Chybující aplikace svchost.exe, verze 5.1.2600.5512, chybující modul
ntdll.dll, verze 5.1.2600.6055, adresa chyby 0x00019af2.

Error - 31.3.2012 3:24:25 | Computer Name = ASUS | Source = crypt32 | ID = 131077
Description = Načtení automatické aktualizace kořenového certifikátu jiného výrobce
z: <http://www.download.windowsupdate.com/m ... C7DC25.crt>
se nezdařilo. Chyba: Daná operace se vrátila, protože vypršel časový limit.

Error - 31.3.2012 4:27:39 | Computer Name = ASUS | Source = MsiInstaller | ID = 11931
Description = Product: MSXML 6.0 Parser (KB927977) -- Error 1931. The Windows Installer
service cannot update the system file C:\WINDOWS\system32\msxml6r.dll because the
file is protected by Windows. You may need to update your operating system for
this program to work correctly. Package version: 6.0.3883.0, OS Protected version:
6.0.3883.0

Error - 1.4.2012 6:35:17 | Computer Name = ASUS | Source = crypt32 | ID = 131083
Description = Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou
aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab>
se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem
podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.


Error - 1.4.2012 8:11:00 | Computer Name = ASUS | Source = Microsoft Virtual PC 2007 | ID = 1000
Description =

[ System Events ]
Error - 2.4.2012 14:26:26 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba LogMeIn Hamachi Tunneling Engine byla neočekávaně ukončena.
Tento stav nastal již 1krát.

Error - 2.4.2012 15:02:24 | Computer Name = ASUS | Source = sr | ID = 1
Description = Filtr nástroje Obnovení systému zjistil neočekávanou chybu 0xC0000001
při zpracování souboru na svazku HarddiskVolume1. Sledování svazku bylo ukončeno.


Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba McciCMService byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Adaptér výkonu služby WMI byla neočekávaně ukončena. Tento
stav nastal již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Pml Driver HPZ12 byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Ati HotKey Poller byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Zařazování tisku byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Služba brány aplikačního rozhraní byla neočekávaně ukončena.
Tento stav nastal již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba Java Quick Starter byla neočekávaně ukončena. Tento stav nastal
již 1krát.

Error - 3.4.2012 5:43:52 | Computer Name = ASUS | Source = Service Control Manager | ID = 7034
Description = Služba LogMeIn Hamachi Tunneling Engine byla neočekávaně ukončena.
Tento stav nastal již 1krát.


< End of report >
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#25 Příspěvek od vyosek »

:arrow: Spustte znovu OTL
  • Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

  • Kód: Vybrat vše

    :otl
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pfc027.sys -- (SoC PC-Camera Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\NSNDIS5.SYS -- (NSNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awwh9xv1)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 685&query={searchTerms}&invocationType=tb50winampie7
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = http://google.icq.com/search/search_frame.php
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes,DefaultScope = {91D2E934-3C7C-404D-8CC1-16A2B0E4B762}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{03dda22f-9a77-45d1-8aea-81cd292335e6}: "URL" = http://www.mapy.cz/?query={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{04de38ac-5e22-4cf0-a66d-3abf1b59bc25}: "URL" = http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=43531B51-63FE-4D54-8BDB-21D9F414407D&apn_sauid=B6FD8225-BBF6-4083-8C1B-FEC436A12ADF
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GPEA_csCZ319
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{82f4bbed-5a19-4d9f-ab53-4a233ffe7d9c}: "URL" = http://www.firmy.cz/phr/{searchTerms}?sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{91D2E934-3C7C-404D-8CC1-16A2B0E4B762}: "URL" = http://search.seznam.cz/?q={searchTerms}&sourceid=IE_5
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2086743
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/sli ... 685&query={searchTerms}&invocationType=tb50winampie7
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..network.proxy.http: "proxy.local"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
[2010.06.13 13:04:30 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.06.13 13:04:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 16:44:22 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2012.03.29 23:23:37 | 000,002,564 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\askcom.xml
[2008.10.21 09:20:59 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\daemon-search.xml
[2012.03.29 23:33:41 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-1.xml
[2008.10.14 14:27:35 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-2.xml
[2008.11.21 12:58:28 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-3.xml
[2009.01.15 13:31:47 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-4.xml
[2010.09.24 12:00:22 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin-5.xml
[2008.02.27 15:14:50 | 000,000,962 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\icqplugin.xml
[2010.09.12 16:43:47 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\sweetim.xml
[2010.06.13 13:04:42 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Asus\Data aplikací\Mozilla\Firefox\Profiles\qfxqjzrv.default\searchplugins\winamp-search.xml
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{0B38152B-1B20-484D-A11F-5E04A9B0661F}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\ASUS\DATA APLIKACĂ­\MOZILLA\FIREFOX\PROFILES\QFXQJZRV.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}
CHR - default_search_provider: search_url = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2086743
O2 - BHO: (no name) - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - No CLSID value found.
3 - HKLM\..\Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\ShellBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-643571872-2322712386-1997616605-1004\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O9 - Extra Button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - Reg Error: Key error. File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - Reg Error: Key error. File not found
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2012.04.01 19:24:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Data aplikací\ESET
[2012.04.01 19:25:38 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Aktualizovat ESET licenci.lnk
[2008.12.19 07:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Data aplikací\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2011.03.29 13:15:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Data aplikací\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2012.04.01 19:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ESET
[2007.04.19 12:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Data aplikací\ICQ Toolbar
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[10 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
[3 C:\WINDOWS\system32\spool\PRINTERS\*.tmp files -> C:\WINDOWS\system32\spool\PRINTERS\*.tmp -> ]
[2012.04.03 13:14:47 | 000,000,936 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2012.04.03 13:24:01 | 000,000,940 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.03 13:54:31 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{82B59B26-DA4B-424B-989B-68008E1019A7}.job
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:CB0AACC9

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
  • Nasledne kliknete na Opravit
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#26 Příspěvek od sh4ke »

Tak nastal následující problém. Při resetování souboru HOSTS došlo k chybě a systém se zasekl. Nemohu se připojit k internetu, DHCP server nepřidělil žádnou IP adresu ani masku. Zkoušel jsem vymazat cache, ale to nepomohlo. Možná je soubor HOSTS poškozený nebo nevím. Každopádně jsem se do něho díval a vypadá netknutý, tak nevím...píši z jiného PC.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#27 Příspěvek od vyosek »

hosts soubor v tom bude nevinne, byl cisty i predtim...

zkuste restartovat router a mrknete na nastaveni pripojeni ci je dle smlouvy
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#28 Příspěvek od sh4ke »

Restart nepomohl, zkoušel jsem i IP adresu uvolnit a znova přidělit, v ipconfig /all ale mám IP adresu a masku 0.0.0.0...zkoušel jsem i zakázat a povolit ovladač na síťové kartě...píše mi to chybu při obnovování IP adresy. Od providera mám nastavené automatické přidělování v rámci DHCP. Jinak to ani nejde u něho. Druhý PC na routeru jede zcela bez problémů.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Kontrola logu + detekované viry

#29 Příspěvek od vyosek »

Restart, mackat F8, zvolit posledni znama funkcni konfigurace
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
sh4ke
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 09 Srp 2006 10:15

Re: Kontrola logu + detekované viry

#30 Příspěvek od sh4ke »

Poslední známá konfigurace nepomohla, zkusím ještě bod obnovení po odebrání Esetu.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“